Aave DIVA Wrapper

Summary

The AaveDIVAWrapper contract does not have a proper validation checks for zero addresses (0x0000000000000000000000000000000000000000) in several critical functions which could lead to permanent loss of user funds if tokens are accidentally or maliciously sent to the zero address. It is the contract developer's responsibility anticipate and protect users from common mistakes, solidity best practices to Implement comprehensive input validation.

Vulnerability Details

The contract accepts address inputs without verifying if they are valid (non-zero) addresses. This is similar to a bank accepting transfers to invalid account numbers without any verification. The issue is present in multiple functions:
https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapper.sol#L37-L44

For example, if someone calls this function with a zero address:

Similar vulnerabilities exist in other functions like:

• registerCollateralToken (Line 21)

• removeLiquidity (Line 49)

• redeemPositionToken (Line 60)

• redeemWToken (Line 71)

Impact

The impact of this vulnerability is severe:

1. Permanent loss of user funds if sent to a zero address

2. No possibility of fund recovery once sent

3. Potential for both accidental losses and malicious exploitation

4. Reputational damage to the protocol if users lose funds

Tools Used

Manual code review
Review of contract interfaces and dependencies

Recommendations

Implement address validation checks at the beginning of each function that handles address parameters.