Aave DIVA Wrapper

Summary

The approveCollateralTokenForAave function in AaveDIVAWrapper.sol lacks the onlyOwner modifier, allowing any user to reset Aave V3 allowances for registered collateral tokens.

Vulnerability Details

• Location: AaveDIVAWrapper.sol

• Code:

  function approveCollateralTokenForAave(address _collateralToken) external override {

  _approveCollateralTokenForAave(_collateralToken);

  }

• Issue: The function is callable by anyone, enabling malicious actors to reset allowances and potentially drain funds if combined with other vulnerabilities.

Impact

• Critical: An attacker could reset allowances for collateral tokens, leading to unauthorized transfers or fund loss.

Tools Used

• Manual code review.

Recommendations

Add the onlyOwner modifier to restrict access: