Submission Details
Severity:
Wrong param order on contract creation
Summary
When users try to deploy AaveDIVAWrapperCore contract, wrong order of parameters passed from AaveDIVAWrapper contract.
Vulnerability Details
When we deploy AaveDIVAWrapper we should pass the required params that are passed to the AaveDIVAWrapperCore:
constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}
However in AaveDIVAWrapperCore we have differen order:
constructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_) {}
In this case aaveVePool address will be set as the Diva contract address and vice versa. This will break the protocol.
Impact
The protocol will be broken.
Tools Used
Manual review
Recommendations
Consider passing the params in the right order, like:
constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_diva, _aaveV3Pool, _owner) {}
Updates
Lead Judging Commences
bube 7 months ago
Submission Judgement Published Assigned finding tags:
Constructor arguments mismatch
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
51929 USDC / LOC
14,000
1,000
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.