Aave DIVA Wrapper

Issue

The _owner variable in the WToken contract is immutable, meaning the assigned owner (AaveDIVAWrapper) cannot be changed after deployment.

Risk Scenario

• If AaveDIVAWrapper is upgraded or replaced, the new contract cannot mint or burn wTokens.

• Users won’t be able to redeem collateral, causing potentially locked funds.

Impact

🟠 Low Severity

• Likelihood: Low (Only affects upgrades).

• Impact: Medium (Users may face issues redeeming funds).

Solution

• Implement an ownership transfer function to allow a new AaveDIVAWrapper to control WTokens.

• Example fix:

  function transferOwnership(address newOwner) external onlyOwner {

  require(newOwner != address(0), "Invalid owner");

  _owner = newOwner;

  }

  ​

✅ Ensures smooth contract upgrades without breaking fund redemption.