Aave DIVA Wrapper

Summary

The AaveDIVAWrapper contract imports the SafeERC20 library from OpenZeppelin, which is designed to safely interact with ERC-20 tokens, including non-standard tokens like USDT. However, the contract does not fully utilize the library's functionality. Instead of using the safeApprove or forceApprove functions provided by SafeERC20, the contract uses the standard approve function. This creates a potential issue when interacting with tokens like USDT, which require specific handling for approve (e.g., setting allowance to zero before setting a new non-zero allowance).

Vulnerability Details

• forceApprove: A more robust version of safeApprove that forcefully sets the allowance, even if the current allowance is non-zero.

Current implementation:

Impact

• Transaction Reverts: When interacting with USDT or similar tokens, the approve function will revert if the current allowance is non-zero.

Tools Used

Manual Review -> Kann Audits

Recommendations
use forceApprove

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol