Aave DIVA Wrapper

Summary

The current implementation of the Aave integration includes a hardcoded referralCode parameter set to 0 in the IAave(_aaveV3Pool).supply() function. Referral supply is currently inactive, and the parameter does not impact functionality. However, this program may be activated in the future through an Aave governance proposal, requiring this parameter to be configurable.

Vulnerability Details

Hardcoded Referral Code:

• The referral code is hardcoded to 0 in the current implementation.

• If the referral program is activated through governance, the contract will need updates to support dynamic referral codes, potentially requiring a redeployment or additional governance actions. Currently the contract is not upgradeable.

Impact

• Missed Opportunities:

  • The inability to configure the referral code dynamically may result in missed opportunities to utilize referral programs and generate additional benefits.

Tools Used

Manual code review.

Recommendations

1. Make Referral Code Configurable: Add a parameter for referralCode that can be set by the contract owner or governance.

2. Default to 0: Use 0 by default if referral supply is inactive.