Submission Details
Severity:
[L-02] Lack of access control in approveCollateralTokenForAave Function
Summary
The approveCollateralTokenForAave function in the AaveDIVAWrapper contract is designed to be publicly accessible, allowing any user to reset token allowances for Aave. While this is an intentional design choice, it warrants documentation for transparency and user awareness.
Recommendations
Add clearer documentation and consider implementing event logging for allowance modifications
/// @notice Approves collateral tokens for Aave protocol
/// @dev Intentionally public to allow users to reset allowances when needed
/// @dev Only works with registered collateral tokens and Aave protocol address
function approveCollateralTokenForAave(address _collateralToken) external override {
_approveCollateralTokenForAave(_collateralToken);
emit CollateralTokenApproved(_collateralToken, msg.sender);
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
51929 USDC / LOC
14,000
1,000
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.