Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing main Diva contract and Aave Pool addresses update mechanism

crunter

Summary

During creation, the wrapper contract set the corresponding addresses for the Aave pool contract and the main DIVA contract. However, in the event when one of those contracts addresses is updated, the inability to set the new address will result in the loss of the wrapper contract's functionality.

Vulnerability Details

In AaveDIVAWrapperCore contract, Aave pool contract and DIVA protocol addresses are set during creation.

> AaveDIVAWrapperCore.sol
​
constructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_) {
// Validate that none of the input addresses is zero to prevent unintended initialization with default addresses.
// Zero address check on `owner_` is performed in the OpenZeppelin's `Ownable` contract.
if (diva_ == address(0) || aaveV3Pool_ == address(0)) {
revert ZeroAddress();
}
​
// Store the addresses of DIVA Protocol and Aave V3 in storage.
@> _diva = diva_;
@> _aaveV3Pool = aaveV3Pool_;
}

Both _diva and _aaveV3Pool are declared as immutable variables, which means that no subsequent action can update their initial value. However, for several reasons, it is not uncommon for protocols to renew/upgrade their contracts. This restricts the functionality of the wrapper contract in case the DIVA protocol V1 (or, more unlikely, the Aave Pool contract) updates to a new version.

Impact

Impact: High

Likelihood: Low

Tools Used

Manual Review

Recommendations

It is highly recommended to declare the _diva and _aaveV3Pool variables without the immutable keyword, allowing their value to be changed if needed. It is also required to introduce new admin functions in order to perform those changes.

- address private immutable _diva;
- address private immutable _aaveV3Pool;
​
+ address private _diva;
+ address private _aaveV3Pool;
​
...
​
+ function setDIVAMainAddress(address diva_) external onlyOwner {
+ if (diva_ == address(0)) {
+ revert ZeroAddress();
+ }
​
+ _diva = diva_;
+ }
​
+ function setAavePoolAddress(address aaveV3Pool_) external onlyOwner {
+ if (aaveV3Pool_ == address(0)) {
+ revert ZeroAddress();
+ }
​
+ _aaveV3Pool = aaveV3Pool_;
+ }
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Immutable Aave pool address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.