Aave DIVA Wrapper

Summary

The _owner variable in the WToken contract is initialized in the constructor and is never modified throughout the contract. Since there is no functionality to change the _owner, making the variable immutable would save gas by reducing storage costs and improving clarity. The current implementation, using a private mutable state variable, is unnecessary and introduces minor inefficiencies.

Vulnerability Details

Type: Code Optimization / Gas Inefficiency

• Location: WToken.sol, Line (exact line depends on your file version):

  @> address private _owner;

• Issue:

  • The _owner variable is initialized in the constructor:

    @> _owner = owner_;

  • There is no function to modify _owner after initialization.

  • This means _owner can safely be declared as immutable, which:

    • Saves gas by storing the variable directly in bytecode rather than in storage.

    • Enhances clarity for developers and auditors.

• Problem:

  • Leaving _owner mutable implies that it could be changed in the future, leading to potential confusion for integrators or auditors.

  • Missing the opportunity to save gas costs by using the immutable keyword.

Impact

This issue has a Medium severity because it does not affect security or functionality but represents a missed opportunity for optimization and clarity.

Tools Used

The following tools and techniques were used to identify and analyze the issue:

• Static Code Review: Manual inspection of the _owner variable and related functions.

• Solidity Compiler (v0.8.26): Verified the impact of making _owner immutable.

Recommendations

1. Change _owner to immutable: Update the _owner declaration to include the immutable keyword:

   - address private _owner;

   + address private immutable _owner;

2. Update the Constructor: Since the immutable keyword requires initialization in the constructor, ensure _owneris set during deployment:

   constructor(string memory symbol_, uint8 decimals_, address owner_) ERC20(symbol_, symbol_) {

   _owner = owner_; // Immutable initialization

   _decimals = decimals_;

   }

3. Document the Change: Include a note in the documentation to highlight the optimization and clarify that _owner is immutable and cannot be changed after deployment.

Example Implementation

Here is the updated version of the relevant portions of the contract:

This ensures the _owner is immutable, stored in bytecode rather than storage, saving gas and enhancing clarity.