Aave DIVA Wrapper

Summary

When transferring assets from msg.sender to the contract ie address(this) the return values are not checked.

Vulnerability Details

https://github.com/Cyfrin/2025-01-diva/blob/23cdc88da7e2a9341f453854e876eee82a18e53e/contracts/src/AaveDIVAWrapperCore.sol#L229-L230

https://github.com/Cyfrin/2025-01-diva/blob/23cdc88da7e2a9341f453854e876eee82a18e53e/contracts/src/AaveDIVAWrapperCore.sol#L285-L289

The function signature has a boolean return value and they indicate errors that way instead.

Impact

By not checking the return value, operations that should have marked as failed, may potentially go through without actually transfer anything.

Tools Used

Manual review

Recommendations