Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`AaveDIVAWrapperCore::_redeemPositionToken` Violates Contract Invariants, Compromising Protocol Functionality

bizarro

Summary

The AaveDIVAWrapperCore::_redeemPositionToken calls the DIVA protocol's redeemPositionToken which burns the user's positionToken.
https://github.com/Cyfrin/2025-01-diva/blob/23cdc88da7e2a9341f453854e876eee82a18e53e/contracts/src/AaveDIVAWrapperCore.sol#L294C9-L294C10

However, this operation burns only one token (longToken or shortToken) at a time, based on the _positionToken parameter.

Vulnerability Details

Proof of Code:

it.only("Should Break The Invariant of the tokens", async() => {
const beforeLongToken = await longTokenContract.totalSupply();
const beforeShortToken = await shortTokenContract.totalSupply();
const beforeWToken = await shortTokenContract.totalSupply();
expect(beforeLongToken).to.be.eq(beforeShortToken);
expect(beforeLongToken).to.be.eq(beforeWToken);
expect(beforeShortToken).to.be.eq(beforeWToken);
​
expect(longTokenBalance).to.be.gt(0);
​
await s.aaveDIVAWrapper
.connect(s.impersonatedSigner)
.redeemPositionToken(
poolParams.longToken,
longTokenBalance,
s.impersonatedSigner.address,
);
​
const afterLongToken = await longTokenContract.totalSupply();
const afterShortToken = await shortTokenContract.totalSupply();
const afterWToken = await shortTokenContract.totalSupply();
expect(afterLongToken).not.to.be.eq(afterShortToken);
expect(afterLongToken).not.to.be.eq(afterWToken);
expect(afterShortToken).to.be.eq(afterWToken);
})

Add This Test to the redeemPositionToken test group.

Impact

This function will break the invariant short token supply = long token supply = wToken supply.

https://github.com/Cyfrin/2025-01-diva/blob/main/DOCUMENTATION.md#invariants

This disruption compromises the core functionality and balance of the protocol.

Recommendations

Refactor the functionality to ensure that the invariant (short token supply = long token supply = wToken supply) remains intact under all scenarios.

Updates

Lead Judging Commences

bube Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!