Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

AToken address Validation from AAVE

elooo

Summary

AToken Validation from Aave in the get accrued yield private function.

Vulnerability Details

In _getAccruedYieldPrivate, the following line assumes the returned aTokenAddress from Aave is valid:

solidityuint256 aTokenBalance = IERC20Metadata(IAave(_aaveV3Pool).getReserveData(_collateralToken).aTokenAddress)
.balanceOf(address(this));

Impact

  • If _collateralToken is invalid or not registered in Aave, getReserveData will return an empty ReserveData struct, where aTokenAddress == address(0).

  • Calling balanceOf(address(this)) on address(0) will revert with a low-level error: "call to a non-contract address".

Tools Used

Manual review

Recommendations

Add a check to ensure the aTokenAddress is valid:

address aTokenAddress = IAave(_aaveV3Pool).getReserveData(_collateralToken).aTokenAddress; if (aTokenAddress == address(0)) revert("Unsupported collateral token");
​
Updates

Lead Judging Commences

bube Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.