Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of proper Accounting for yield distribution will result in donation recipients(Farmers) not getting fair increased distribution payouts or getting 0 increased distribution payouts.

oldguard

Summary

Users who use AaveDivaWrapper through Diva Donate for donation purposes with hopes of perhaps increasing donation payout will not get the increased payout.

Vulnerability Details

function _getAccruedYieldPrivate(
address _collateralToken
) private view returns (uint256) {
uint256 aTokenBalance = IERC20Metadata(
IAave(_aaveV3Pool).getReserveData(_collateralToken).aTokenAddress
).balanceOf(address(this));
uint256 wTokenSupply = IERC20Metadata(
_collateralTokenToWToken[_collateralToken]
).totalSupply();
​
// Handle case where the aToken balance might be smaller than the wToken supply (e.g., due to rounding).
// In that case, the owner should just wait until yield accrues.
return aTokenBalance > wTokenSupply ? aTokenBalance - wTokenSupply : 0;
}
}

when owner claims yield it clears the yield of contingent pools with the same collateral token and without a proper accounting and mechanism for fair yield sharing it's impossible to know how much exactly recipients are entitled to which should be depend on how much was deposited as collateral into the contingent pool. if owner decides to guess who gets what it results in unfairness as recipients whose donators didn't desposit as much as other recipients who are much more deserving of a high increased donation payout will get high amounts of increased donation payouts

Impact

Because there is no mechanism for fair allocation of yields to donatees owners might decide to not distribute which removes one of the appealing features of the AaveDivaWrapper contracts, users might feel it's a redundant path to participating in the network as there is no additional benefit.

Tools Used

Recommendations

  • Consider creating a mechanism of fair distribution of accrued yields.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.