Aave DIVA Wrapper

Summary

In AaveDIVAWrapper.sol, the order of parameters in the constructor specifies the Aave address first, followed by the DIVA address:

However, in AaveDIVAWrapperCore.sol, the constructor expects the DIVA address first, followed by the Aave address:

This discrepancy leads to incorrect contract initialization as the parameters are mismatched, resulting in invalid addresses being assigned.

Vulnerability Details

When deploying AaveDIVAWrapper, the incorrect parameter order causes the Aave and DIVA contract addresses to be swapped. This results in:

1. Functionality relying on the Aave or DIVA address failing.

2. Potential misallocation of funds or loss of access to critical resources due to invalid addresses being used in contract interactions.

Impact

The contract cannot perform as intended, which may lead to severe issues, including:

1. Malfunctioning interactions with the Aave protocol and DIVA.

2. Potentially high financial risk due to misconfigured contract addresses.

Tools Used

Manual code review.

Recommendations

Ensure the parameter order in AaveDIVAWrapper matches the expected order in AaveDIVAWrapperCore. Update AaveDIVAWrapper as follows: