HardhatDeFi
15,000 USDC
View results
Submission Details
Severity: low
Valid

Constructor Parameter Mismatch in `AaveDIVAWrapper` Contracts

## Summary

An issue has been identified in the `AaveDIVAWrapper` and `AaveDIVAWrapperCore` contracts related to the mismatch of constructor parameters. This mismatch leads to the incorrect initialization of essential contract addresses, potentially disrupting the contract's intended interactions with external protocols.

\

## Vulnerability Details

The issue arises from the inconsistent ordering of constructor parameters between the `AaveDIVAWrapper` and `AaveDIVAWrapperCore` contracts

In `AaveDIVAWrapper`:

https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/AaveDIVAWrapper.sol?plain=1#L12

```js

constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}

```

The constructor passes `_aaveV3Pool` as the first argument, followed by `_diva` and `_owner`.

In `AaveDIVAWrapperCore`:

https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/AaveDIVAWrapperCore.sol?plain=1#L52

```js

constructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_) {

```

The `AaveDIVAWrapperCore` expects the first parameter to be `diva_`, the second to be `aaveV3Pool_`, and the third to be `owner_`.


\

## Root Cause

The `AaveDIVAWrapper` contract incorrectly maps its constructor parameters to the `AaveDIVAWrapperCore` constructor. This misalignment results in:

`_diva` in `AaveDIVAWrapperCore` being set to the value of `_aaveV3Pool`.

`_aaveV3Pool` in `AaveDIVAWrapperCore` being set to the value of `_diva`.



\

## Impact

- Loss of Deployer Funds Due to Deployment Costs

- Incorrect Address Initialization

- Protocol Interaction Failures



\

## Severity Assessment

Medium

The likelihood of occurrence is high due to the straightforward nature of the constructor parameter mismatch.

The impact of the vulnerability is low because the only loss incurred is the deployment cost, and the deployer can redeploy the contract without suffering any additional financial loss.




\

## Recommendations

Correct the Constructor Parameter Order




\

Updates

Lead Judging Commences

bube Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Constructor arguments mismatch

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!