Aave DIVA Wrapper

Description: Unchecked external calls occur when a contract makes a call to an external contract without verifying the success of the call. This can lead to unexpected behavior if the external call fails, as the transaction may continue executing without reverting. In the AaveDIVAWrapperCore contract, external calls are made to various interfaces such as IAave, IDIVA, and token contracts without explicitly checking their return values. Functions like _handleTokenOperations, _redeemWTokenPrivate, and others make calls to external contracts (e.g., IAave(_aaveV3Pool).supply, IERC20Metadata(_collateralToken).safeTransferFrom) without verifying the success of these operations.

Impact:

• If an external call fails and the failure is not checked, the contract may assume that the operation succeeded, leading to incorrect state updates or financial loss.

• This can also open up the contract to potential exploits, where an attacker could manipulate the contract's logic by causing external calls to fail.

Proof of Concept:

In this example, if the safeTransferFrom or supply calls fail, the subsequent operations will still execute, leading to potential inconsistencies or incorrect behavior. Implementing the recommended mitigations will ensure these operations are properly checked and handled.

Recommended Mitigation:

1. Use SafeERC20 for Token Transfers: Ensure that all token transfers and approvals use the SafeERC20 library, which checks for success and reverts on failure.

Example:

1. Check Return Values of External Calls: Always check the return values of external calls to ensure they succeed. If the external call returns a boolean, verify it.

Example:

1. Use Try-Catch for External Calls: For calls that might throw an exception, use Solidity's try-catch feature to handle failures gracefully.

Example:

By implementing these mitigations, you can ensure that your contract handles external call failures appropriately, maintaining correct state and reducing the risk of exploitation.