Aave DIVA Wrapper

Summary

The _registerCollateralToken function attempts to approve the Aave V3 Pool (_aaveV3Pool) for an unlimited allowance of the collateral token. However, if the collateral token is USDT on Ethereum Mainnet, the transaction will revert due to USDT's non-standard approve implementation, which does not return a boolean value as expected by OpenZeppelin's IERC20 interface.

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L116C9-L116C33

Vulnerability Details

The function _registerCollateralToken calls:

_collateralTokenContract.approve(_aaveV3Pool, type(uint256).max);

USDT's approve function does not return a boolean value, whereas OpenZeppelin's IERC20 interface expects a bool return type. When compiled and executed, this mismatch causes a revert in Solidity 0.8+ because the function signature does not align with the expected interface. As a result, the contract will fail to register USDT as a collateral token, preventing its use in the system.

Impact

1. USDT is one of the most widely used stablecoins in DeFi. The inability to register USDT as collateral** limits protocol** adoption and usability.

2. Any attempt to register USDT as a collateral token will always fail, making the system incompatible with one of the most liquid assets in the ecosystem.

3. The issue may also extend to other ERC20 aave supported tokens that do not strictly follow the OpenZeppelin IERC20 standard.

Tools Used

Manual Review

Recommendations

Use OpenZeppelin’s SafeERC20 Library:

Replace the direct approve call with SafeERC20.safeApprove, which accounts for non-standard tokens like USDT: