Aave DIVA Wrapper

Summary

Conflicting signature allows for more than just NFTs to be used as the permissioned asset.

Vulnerability Details

When creating a new pool, a permissionedERC721Token argument needs to be passed. This leads to the creation of a permissioned position token in place of a standard ERC20. When transacting these tokens, the only function the permissioned token contract calls is balanceOf, which has the same function signature for both ERC20s and ERC721s tokens. No checks are done in the AaveDIVAWrapper to prevent this either.

Impact

This allows for some unintentional features. For example, you could pass the USDC address as the pool parameter argument, allowing only USDC holders to own position tokens.

Recommendations

The ERC721 inherits the ERC165 supportsInterface() function. Use it in order to correctly identify a contract as a NFT contract. This will also exclude some weird ERC721s from operating with the system.