Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

[L-03] Incorrect Liquidity Removal When Using Max Withdrawal

phaseTwo

Summary

The _removeLiquidity function contains flawed logic when handling maximum withdrawal requests (type(uint256).max), potentially allowing imbalanced position token transfers and creating liquidation risks.

Vulnerability Details

Affected Code:

if (_positionTokenAmount == type(uint256).max) {
// @audit-info : why are we doing this?
_positionTokenAmountToRemove = _userBalanceShort > _userBalanceLong
? _userBalanceLong
: _userBalanceShort;
}

Core Issues:

  1. Imbalanced Withdrawal Enforcement

  • When using max withdrawal, the function takes the smaller of short/long balances instead of requiring equal amounts

  • Allows partial withdrawal even when position tokens are imbalanced

  • Creates potential for leftover "stranded" position tokens

  1. Incorrect Assumption About Balances

  • Fails to account for possible manual transfers of position tokens

  • Users could intentionally create imbalanced positions to manipulate pool liquidity

Impact

  • Enables partial liquidity removal without full position token sets

  • May lead to accounting inconsistencies in Aave collateral backing

  • Creates attack surface for liquidity manipulation

  • Violates DIVA Protocol's position token parity requirement

Tools Used

  • Manual code analysis

  • DIVA Protocol documentation review

  • ERC-20 token standard reference

Recommendations

  • Enforce Position Token Parity

if (_positionTokenAmount == type(uint256).max) {
if (_userBalanceShort != _userBalanceLong) {
revert ImbalancedPositionTokens();
}
_positionTokenAmountToRemove = _userBalanceShort;
}

  • Add Explicit Balance Checks

require(
_shortTokenContract.balanceOf(msg.sender) >= _positionTokenAmountToRemove &&
_longTokenContract.balanceOf(msg.sender) >= _positionTokenAmountToRemove,
"Insufficient position tokens"
);
Updates

Lead Judging Commences

bube Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!