Aave DIVA Wrapper

Summary https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/WToken.sol

The mint and burn functions lack input validation for _recipient and _redeemer addresses. This opens up two problematic scenarios:

Minting to the Zero Address:

_mint(address(0), _amount) increases the total supply, but tokens are effectively locked forever, causing a discrepancy in token economics.

Burning from the Zero Address:

_burn(address(0), _amount) will revert, but this is not explicitly prevented, which could lead to wasted gas or unintended behavior.

Impact

The minting to the zero address results in unexpected token supply behavior (not an exploit but an operational flaw).

Burning from the zero address can waste gas or lead to reverts when it could be prevented.

Tools Used

Manual Review

Recommendations

Add input validation:

function mint(address _recipient, uint256 _amount) external override onlyOwner {
require(_recipient != address(0), "WToken: cannot mint to the zero address");
_mint(_recipient, _amount);
}

function burn(address _redeemer, uint256 _amount) external override onlyOwner {
require(_redeemer != address(0), "WToken: cannot burn from the zero address");
_burn(_redeemer, _amount);
}

This issue results in operational risks (minting/burning failures or unexpected supply changes) that could have been mitigated with proper input validation.