Aave DIVA Wrapper

Summary

The AaveDIVAWrapper contract incorrectly passes parameters to its parent contract AaveDIVAWrapperCore in the wrong order during initialization, leading to critical address misassignments in the contract's storage variables.

Vulnerability Details

File: AaveDIVAWrapper.sol (Line 12)

The child contract AaveDIVAWrapper implements its constructor as:

However, the parent contract AaveDIVAWrapperCore defines its constructor parameters in a different order:

Parameter Mismatch:

• Parent contract expects parameters: (diva_, aaveV3Pool_, owner_)

• Child contract passes parameters: (_aaveV3Pool, _diva, _owner)

This inversion causes:

1. _diva state variable will store the Aave V3 Pool address

2. _aaveV3Pool state variable will store the DIVA Protocol address

3. Critical protocol dependencies are initialized with incorrect addresses

Impact

Severity: High

The address misassignment will:

1. Break core protocol functionality relying on Aave/DIVA integrations

2. Cause failed transactions when interacting with external protocols

3. Potentially allow unintended contract interactions (e.g., using Aave pool as DIVA protocol)

4. Require contract redeployment to fix due to immutable variables

Tools Used

• Foundry

Recommendations

Correct the parameter order in the child constructor:

Additional Checks:

1. Add parameter validation in child constructor

2. Implement unit tests verifying address assignments

3. Use NatSpec comments to explicitly document parameter order