Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing access control on token approval functions enables unauthorized token approvals

zubyoz

Summary

The AaveDIVAWrapper contract contains token approval functions does not implement any form of access control, allowing anyone to call it. This creats a severe security risk as these functions should be restricted to privileged roles.

Vulnerability Details

The following functions in the AaveDIVAWrapper contract lack access control:
https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapper.sol#L92

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapper.sol#L202

function approveCollateralTokenForAave(address _collateralToken) external override {
_approveCollateralTokenForAave(_collateralToken);
}
​
function batchApproveCollateralTokenForAave(address[] calldata _collateralTokens) external override {
uint256 _length = _collateralTokens.length;
for (uint256 i = 0; i < _length; i++) {
_approveCollateralTokenForAave(_collateralTokens[i]);
}
}

Impact

The vulnerability has the following potential impacts:
Unauthorized users can approve any token for Aave integration
Malicious actors could exploit this to approve unintended or malicious tokens
Inconsistency with the contract's security model where other sensitive functions are properly protected
Potential manipulation of the protocol's token approval system

Tools Used

Manual code review

Recommendations

Add the onlyOwner modifier to both functions to restrict access to the contract owner:

function approveCollateralTokenForAave(address _collateralToken) external override onlyOwner {
_approveCollateralTokenForAave(_collateralToken);
}
​
function batchApproveCollateralTokenForAave(address[] calldata _collateralTokens) external override onlyOwner {
uint256 _length = _collateralTokens.length;
for (uint256 i = 0; i < _length; i++) {
_approveCollateralTokenForAave(_collateralTokens[i]);
}
}
Updates

Lead Judging Commences

bube Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.