Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Aave Pool Deprecation Risk in AaveDIVAWrapper Contract

m3dython

Root Cause

The AaveDIVAWrapper contract integrates with Aave V3 pools but does not account for potential pool deprecation on Aave. When an Aave pool is deprecated:

  1. The associated aToken may lose functionality (e.g., supply()/withdraw() could be disabled)

  2. Underlying assets may become non-redeemable

  3. Interest accrual could stop permanently

Critical dependencies:

// Contract stores immutable Aave pool address
address private immutable _aaveV3Pool;
​
// Uses Aave pool without status checks
IAave(_aaveV3Pool).supply(_collateralToken, _collateralAmount, ...);
IAave(_aaveV3Pool).withdraw(_collateralToken, _wTokenAmount, ...);

Impact

Severity Consequences
High Permanent loss of user funds locked in deprecated pools
High Broken core functionality (add/remove liquidity, redemptions)
Medium Stuck yield claims for protocol owner

Example Attack Scenario:

  1. Aave deprecates USDC pool via governance

  2. Existing aUSDC becomes non-transferable

  3. Users cannot redeem wUSDC → USDC via redeemWToken()

  4. All USDC liquidity remains permanently locked in deprecated pool

Recommendations

1. Add Pool Status Checks

Implement Aave's ReserveConfiguration helpers:

import {ReserveConfiguration} from "aave-v3-core/contracts/protocol/libraries/configuration/ReserveConfiguration.sol";
​
function _validatePoolActive(address asset) internal view {
DataTypes.ReserveData memory reserve = IAave(_aaveV3Pool).getReserveData(asset);
require(
ReserveConfiguration.getActive(reserve.configuration),
"Pool deprecated"
);
}

2. Emergency Withdrawal Mechanism

Add fallback for deprecated pools:

function emergencyWithdraw(
address _collateralToken,
address _recipient
) external onlyOwner {
address aToken = _getAToken(_collateralToken);
uint256 balance = IERC20(aToken).balanceOf(address(this));
IERC20(aToken).transfer(_recipient, balance); // Let recipient handle aToken redemption
}

3. Deprecation Monitoring System

  • Track Aave governance proposals

  • Implement Chainlink Automation to detect pool status changes

  • Add time-locked admin functions to pause deposits

Updates

Lead Judging Commences

bube Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.