Aave DIVA Wrapper

Summary

The approveCollateralTokenForAave function contract AaveDIVAWrapper.sol line 22 is callable by any user. This could allow unauthorized entities to approve collateral tokens, potentially disrupting the protocol's token approval mechanism.

Vulnerability Details

Unlike other functions in the contract (e.g., registerCollateralToken), the approveCollateralTokenForAave function lacks the onlyOwner modifier. This allows any user to invoke it, as seen below:

This could lead to unwanted token approvals by malicious or unintended actors.

Impact

Unrestricted access could disrupt the system's operation or allow attackers to manipulate token approval logic, affecting subsequent transactions.

Tools Used

Manual code review

Recommendations

Add the onlyOwner modifier to this function to restrict access to authorized entities only: