Aave DIVA Wrapper

Bug Description

The _getAccruedYieldPrivate function incorrectly calculates the accrued yield by subtracting the total supply of wTokens from the aToken balance. This logic is flawed because aTokens represent both the principal (collateral tokens supplied by users) and the accrued yield. The current implementation assumes that the difference between the aToken balance and the wToken supply is the yield, but this is incorrect because the wToken supply only represents the principal. As a result, the function overestimates the yield by including the principal in the aToken balance.
code snippet:

This logic fails to isolate the yield because it does not account for the fact that the aToken balance includes both the principal and the yield. Consequently, the function returns an inflated yield amount, which could lead to the contract owner claiming more tokens than the actual yield.

Impact

If the owner claims the incorrect yield amount, the contract may not have enough aTokens to cover user redemptions, leading to a situation where users cannot withdraw their collateral tokens.

Mitigation

Track the total principal supplied to Aave separately and calculate the yield as the difference between the current aToken balance and the tracked principal.