Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Constructor Parameter Order in `AaveDIVAWrapper` Leading to Permanent Contract Corruption

owanemi

Summary

The AaveDIVAWrapper contract incorrectly initializes its parent constructor AaveDIVAWrapperCore by swapping the order of the _diva and _aaveV3Pool addresses. This results in permanent corruption of the immutable protocol addresses, rendering the contract unusable and risking fund loss.

Vulnerability Details

The child contract AaveDIVAWrapper passes parameters to AaveDIVAWrapperCore in the order (_aaveV3Pool, _diva, _owner), but the parent expects (diva_, aaveV3Pool_, owner_).

This swaps the _diva and _aaveV3Pool addresses during initialization.

Below is the proof of concept to further prove the existence of this bug:

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {Test, console} from "forge-std/Test.sol";
import {AaveDIVAWrapper} from "../src/AaveDIVAWrapper.sol";
​
contract PocTest is Test {
address constant DIVA_PROTOCOL = address(0x123);
address constant AAVE_V3_POOL = address(0x456);
address constant OWNER = address(0x789);
​
//Demonstrate wrong parameter ordering
function testWrongParameterOrder() public {
AaveDIVAWrapper wrapper = new AaveDIVAWrapper(
AAVE_V3_POOL, // Incorrectly passed as _diva
DIVA_PROTOCOL, // Incorrectly passed as _aaveV3Pool
OWNER
);
​
// this will pass becuase the paramter order is mismatched and state variables have been set wrongly
assert(wrapper._diva() != DIVA_PROTOCOL);
​
console.log("expected diva address: ", DIVA_PROTOCOL);
console.log("diva address inputted: ", wrapper._diva());
​
assert(wrapper._aaveV3Pool() != AAVE_V3_POOL);
​
console.log("expected aavev3 pool address: ", AAVE_V3_POOL);
console.log("aavev3 pool address inputted: ", wrapper._aaveV3Pool());
}
}

the output would look like this below

$ forge test --match-test testWrongParameterOrder -vvvv
[⠊] Compiling...
[⠊] Compiling 24 files with Solc 0.8.26
[⠢] Solc 0.8.26 finished in 3.03s
Compiler run successful!
​
Ran 1 test for test/PocTest.t.sol:AuditTest
[PASS] testWrongParameterOrder() (gas: 3226709)
Logs:
expected diva address: 0x0000000000000000000000000000000000000123
diva address inputted: 0x0000000000000000000000000000000000000456
expected aavev3 pool address: 0x0000000000000000000000000000000000000456
aavev3 pool address inputted: 0x0000000000000000000000000000000000000123

Impact

  • Fund Loss: Users interacting with the contract will deposit funds into incorrect protocols (e.g., sending collateral to DIVA instead of Aave).

  • Permanent Protocol Misconfiguration: Immutable variables cannot be updated after deployment, rendering the contract permanently unusable

Tools Used

  • Foundry

  • Manual Review

Recommendations

change the ordering of the parameters passed into the constructor in AaveDIVAWrapper

- constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}
+ constructor(address _diva, address _aaveV3Pool, address _owner) AaveDIVAWrapperCore(_diva, _aaveV3Pool, _owner) {}
​
Updates

Lead Judging Commences

bube Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Constructor arguments mismatch

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.