Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Parameter Order Mismatch in `AaveDIVAWrapper` Constructor Leading to Potential Incorrect Initialization

0xaadi

Summary

The AaveDIVAWrapper contract constructor delegates initialization to the AaveDIVAWrapperCore constructor. However, there is a discrepancy in the order of parameters between the two constructors, which could lead to incorrect initialization and cause DoS of major contract functions.

Vulnerability Details

The order of parameters in the initialization of AaveDIVAWrapperCore constructor (_aaveV3Pool, _diva, _owner) in the AaveDIVAWrapper constructor does not match the order in the AaveDIVAWrapperCore constructor (diva_, aaveV3Pool_, owner_). This will cause using aaveV3Pool_ as DIVA contract and diva_used as AAVE contract.

constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapper.sol#L12

@>constructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_) {
// Validate that none of the input addresses is zero to prevent unintended initialization with default addresses.
// Zero address check on `owner_` is performed in the OpenZeppelin's `Ownable` contract.
if (diva_ == address(0) || aaveV3Pool_ == address(0)) {
revert ZeroAddress();
}
// Store the addresses of DIVA Protocol and Aave V3 in storage.
@> _diva = diva_;
@> _aaveV3Pool = aaveV3Pool_;
}

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L52

This mismatch can cause incorrect assignment of addresses, potentially leading to unintended behaviors and systemwide DOS.

Impact

If the parameters are not passed in the correct order, the contract may initialize with incorrect addresses, affecting its functionality, contract become unuseful due to the DOS of major functions and may cause unintended behaviors.

Tools Used

Manual Review

Recommendations

Ensure that the parameters are passed in the correct order when calling the AaveDIVAWrapperCore constructor from AaveDIVAWrapper.

- constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}
+ constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_diva, _aaveV3Pool, _owner) {}
Updates

Lead Judging Commences

bube Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Constructor arguments mismatch

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.