Aave DIVA Wrapper

Summary

The _approveCollateralTokenForAave() function in AaveDIVAWrapper.sol lacks an onlyOwner restriction, allowing any external caller to approve unlimited collateral spending to AaveV3. This can lead to unauthorized fund withdrawals, resulting in a critical loss of user funds.

Vulnerability Details

• function _approveCollateralTokenForAave(address _collateralToken) internal {

  // Ensure the collateral token is registered before setting approval.

  if (_collateralTokenToWToken[_collateralToken] == address(0)) {

  revert CollateralTokenNotRegistered();

  }

  uint256 currentAllowance = IERC20Metadata(_collateralToken).allowance(address(this), _aaveV3Pool);

  IERC20Metadata(_collateralToken).safeIncreaseAllowance(_aaveV3Pool, type(uint256).max - currentAllowance);

  }

  ​

Impact

Anyone can call approveCollateralTokenForAave() externally.

• This allows an attacker to set unlimited collateral token approvals to AaveV3.

• Once approved, malicious actors can drain collateral tokens from the contract.

• A full loss of collateral funds is possible if an attacker exploits this bug.

Attack Scenario:

1. The attacker calls approveCollateralTokenForAave(collateralToken), approving type(uint256).max.

2. The attacker then calls Aave’s withdraw() function, draining all approved collateral tokens.

3. The contract loses all collateral funds, and the attacker escapes with stolen assets.

##Proof of Exploit (PoC)
An attacker can execute the following script to exploit the contract:

Tools Used

Manual Review

Recommendations

Add an onlyOwner modifier to approveCollateralTokenForAave() in AaveDIVAWrapper.sol:

Additionally, update _approveCollateralTokenForAave() to use safeApprove() instead of safeIncreaseAllowance():