Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

[L-02] Incorrect Yield Calculation When aToken Balance Equals wToken Supply

phaseTwo

Summary

The _getAccruedYieldPrivate function contains flawed logic that improperly handles the case where aToken balances exactly match wToken supply, potentially obscuring protocol health indicators and creating accounting inaccuracies.

Vulnerability Details

Affected Function:

function _getAccruedYieldPrivate(...) private view returns (uint256) {
uint256 aTokenBalance = ...;
uint256 wTokenSupply = ...;
return aTokenBalance > wTokenSupply ? aTokenBalance - wTokenSupply : 0;
}

Issue Analysis

While the current implementation correctly returns 0 when aTokenBalance <= wTokenSupply, this fails to account for critical protocol states:

  1. Perfect Balance Edge Case
    When aTokenBalance == wTokenSupply, this indicates either:

  • Instantaneous equality after deposit/withdrawal

  • Protocol insolvency (aTokens < wTokens) masked by rounding

  • Potential manipulation via precision loss attacks

  1. Silent Error Masking
    Returns identical values (0) for both:

  • Healthy state with aTokenBalance == wTokenSupply (temporary)

  • Dangerous state with aTokenBalance < wTokenSupply (protocol insolvency)

Impact

  • Obscures protocol solvency status

  • Enables undetected accounting discrepancies

  • May lead to false yield claims during transient balance states

  • Creates risk surface for precision-based manipulation attacks

Tools Used

  • Manual code analysis

  • Mathematical edge case evaluation

  • Aave protocol interaction patterns review

Recommendations

  • Explicit State Handling

function _getAccruedYieldPrivate(...) private view returns (uint256) {
if (aTokenBalance >= wTokenSupply) {
return aTokenBalance - wTokenSupply;
}
revert ProtocolInsolvent(aTokenBalance, wTokenSupply);
}
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.