Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Fee-on-Transfer Token Exploit

0xdaxun

Summary

The _handleTokenOperations function in AaveDIVAWrapperCore.sol does not account for fee-on-transfer tokens, leading to overminting of wToken.

Vulnerability Details

  • Location: AaveDIVAWrapperCore.sol

  • Code:

    function _handleTokenOperations(...) private {
    IERC20(_collateralToken).safeTransferFrom(msg.sender, address(this), _collateralAmount);
    IWToken(_wToken).mint(address(this), _collateralAmount);
    }

  • Issue: Tokens like USDT (Polygon) deduct fees on transfer, causing wToken overminting.

Impact

  • High: Overminting of wToken breaks the 1:1 collateral-to-wToken ratio, leading to potential fund loss.

Tools Used

  • Manual code review.

Recommendations

Measure balance changes after transfers:

uint256 balanceBefore = IERC20(_collateralToken).balanceOf(address(this));
IERC20(_collateralToken).safeTransferFrom(msg.sender, address(this), _collateralAmount);
uint256 receivedAmount = IERC20(_collateralToken).balanceOf(address(this)) - balanceBefore;
IWToken(_wToken).mint(address(this), receivedAmount);
Updates

Lead Judging Commences

bube Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!