Incorrect Token Symbol/Name Causes User Confusion in AaveDIVAWrapper

Issue Overview

The WToken contract sets both the name and symbol to the same value, which can lead to confusing token representations in wallets, explorers, and user interfaces.

Root Cause

Vulnerable Code

• The token name is assigned the same value as the symbol (symbol_).

• Example: If the symbol is "wUSDC", the token name is also "wUSDC", violating ERC20 conventions.

• Expected Behavior: The name should be descriptive (e.g., "Wrapped USDC"), and the symbol should be short and identifiable (e.g., "wUSDC").

Attack Scenario: User Misinterpretation of Token Identity

1. Confusion in Wallets & Block Explorers

   • Users interacting with wUSDC expect to see "Wrapped USDC" in their wallets.

   • Instead, wallets display only "wUSDC" as both the name and symbol, making it unclear what the token represents.

2. Potential for Impersonation Risks

   • A malicious token with the same symbol ("wUSDC") but different internal logic could be mistaken for the official wrapped token.

   • Users may trust a fake token, leading to scams or lost funds.

Impact Analysis

🔵 Severity: Medium
✅ Likelihood: Moderate – Users often rely on token names for identification.
✅ Impact: High – Incorrect naming can lead to trust issues, user confusion, and impersonation risks.

Proposed Solution

✅ Fix 1: Define Separate Name and Symbol Values

Modify the constructor to allow a distinct name and symbol for clarity.

Example Usage:

✅ Ensures proper token identification across wallets and explorers.

✅ Fix 2: Enforce Naming Conventions During Token Deployment

Require names to follow a standardized format ("Wrapped <Asset>").

✅ Prevents contracts from using identical name and symbol values.