Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Improper Validation of User Balances in `_redeemPositionToken` Function

godwinx

Summary

The _redeemPositionToken function in `AaveDIVAWrapperCore` contract fails to validate whether the user's balance is greater than zero before assigning _userBalance to _positionTokenAmountToRedeem when _positionTokenAmount equals type(uint256).max. This could lead to erroneous behavior in the function, especially if the user's balance is zero.

https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/AaveDIVAWrapperCore.sol#L278

Vulnerability Details

Description

In the _redeemPositionToken function, if _positionTokenAmount is set to type(uint256).max, the contract assigns _userBalance (the user's token balance) to _positionTokenAmountToRedeem without validating whether _userBalance is greater than zero.

Problematic Code:

uint256 _userBalance = _positionTokenContract.balanceOf(msg.sender);
uint256 _positionTokenAmountToRedeem = _positionTokenAmount;
if (_positionTokenAmount == type(uint256).max) {
// @audit-low the _userBalance is not validated to ensure the user balance is > 0 before assigning it to _positionTokenAmountToRedeem
_positionTokenAmountToRedeem = _userBalance;
}

If _userBalance is zero, the following transfer and redemption logic will still execute, resulting in an unnecessary function call, gas usage, and potential unexpected behavior.

Impact

  1. Unnecessary Gas Consumption: If _userBalance is zero, the transfer and redemption functions are still executed, leading to wasted gas costs for the user.

  2. Unexpected Behavior: Depending on how downstream functions handle zero _positionTokenAmountToRedeem, there could be unintended consequences, such as unnecessary state changes or failed transactions.

Tools Used

  • Manual Code Review

  • Static Analysis

Recommendations

  1. Validate _userBalance: Before assigning _userBalance to _positionTokenAmountToRedeem, ensure _userBalance > 0. Example fix:

uint256 _userBalance = _positionTokenContract.balanceOf(msg.sender);
uint256 _positionTokenAmountToRedeem = _positionTokenAmount;
if (_positionTokenAmount == type(uint256).max) {
require(_userBalance > 0, "No position tokens to redeem");
_positionTokenAmountToRedeem = _userBalance;
}

  1. Early Exit for Zero Balance: If _userBalance is zero, revert the transaction early to save gas and ensure no unnecessary function calls occur.

require(_userBalance > 0, "No position tokens to redeem");
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.