Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Irreversible Allowance Vulnerability in AaveDIVAWrapper Poses Token Security Threat

0xaadi

Summary

If the known attack described below occurs, even if there is enough time to act, there is no way to protect the AaveDIVAWrapper contract from losing tokens.

Known Issues

  • Integration risk with both Aave V3 and DIVA Protocol - vulnerabilities in either protocol may affect AaveDIVAWrapper.

The AaveDIVAWrapper contract sets unlimited allowances for collateral tokens to Aave and Diva, and there is no way to reset the allowance, which poses a security risk if these protocols compromised.

Vulnerability Details

The contract grants infinite approval for collateral tokens to be transferred to Aave's V3 Pool and Diva. This is intended to optimize gas costs by avoiding repeated approval transactions.

@> _wTokenContract.approve(_diva, type(uint256).max);
@> _collateralTokenContract.approve(_aaveV3Pool, type(uint256).max);

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L116C9-L116C74

In the code below, allowances can only be increased to the maximum; it is not possible to remove or decrease them.

function _approveCollateralTokenForAave(address _collateralToken) internal {
// Ensure the collateral token is registered before setting approval.
if (_collateralTokenToWToken[_collateralToken] == address(0)) {
revert CollateralTokenNotRegistered();
}
uint256 currentAllowance = IERC20Metadata(_collateralToken).allowance(address(this), _aaveV3Pool);
// Using OpenZeppelin's `safeIncreaseAllowance` to accommodate tokens like USDT on Ethereum that
// require the approval to be set to zero before setting it to a non-zero value.
@> IERC20Metadata(_collateralToken).safeIncreaseAllowance(_aaveV3Pool, type(uint256).max - currentAllowance);
}

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L366

This contract does not provide a mechanism to reduce or revoke these allowances, leaving it vulnerable in the event of a security breach at Aave or Diva.

Impact

A compromised Aave and Diva protocols could lead to unauthorized and potentially unlimited transfers of tokens from the AaveDIVAWrapper contract.

Tools Used

Manual Review

Recommendations

Add functions to dynamically reduce or revoke allowances for collateral tokens to Aave and Diva, especially in response to security threats.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.