Aave DIVA Wrapper

Summary

The protocol integrates the Aave V3 pool through an immutable address:

While this ensures immutability and security, it introduces potential limitations if the pool is paused or deprecated, as there is no mechanism to change or upgrade the contract.

Vulnerability Details

Immutable Aave V3 Pool Address:

• The _aaveV3Pool address is immutable, preventing changes to the integration.

• If the pool is paused or fully deprecated, the protocol will lose functionality and require redeployment.

Impact

• Downtime and Redeployment Risks:

  • If the Aave V3 pool is deprecated or paused, the immutability of _aaveV3Pool may result in full dos.

Tools Used

Manual review.

Recommendations

Add a function to update the _aaveV3Pool in such scenario.