Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Parameters are passed on to the constructor of `AaveDIVAWrapper -> AaveDIVAWrapperCore` in the Wrong Order

sakibcy

Summary

Parameters are passed on to the constructor of AaveDIVAWrapper in the Wrong Order.

As a result _diva will get the address of _aaveV3Pool and _aaveV3Pool will get the address of _diva.

This will break the whole Aave DIVA Wrapper's functionally or it will not work as expected.

!!!! Note: This is not an admin input validation vulnerability, This vulnerability is present in the actual implementation code of the contract.

Vulnerability Details

On AaveDIVAWrapperCore we can see it is taking the parameters as follows constructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_).

constructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_) {
// Validate that none of the input addresses is zero to prevent unintended initialization with default addresses.
// Zero address check on `owner_` is performed in the OpenZeppelin's `Ownable` contract.
if (diva_ == address(0) || aaveV3Pool_ == address(0)) {
revert ZeroAddress();
}
​
// Store the addresses of DIVA Protocol and Aave V3 in storage.
_diva = diva_;
_aaveV3Pool = aaveV3Pool_;
}

But on the constructor of AaveDIVAWrapper we can see it is passing the parameters in the constructor of AaveDIVAWrapperCore as following AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner)

constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}

It is passing the _aaveV3Pool address as _diva's address and _diva's address as _aaveV3Pool's address.

Impact

After the deployment, the Aave DIVA Wrapper will get the address of diva and aaveV3Pool totally opposite way.
So, it will break the whole Aave DIVA Wrapper's functionality or it will not work as expected.

Tools Used

Manual review

Recommendations

Pass the parameters in the correct order on AaveDIVAWrapper's constructor.

- constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}
+ constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_diva, _aaveV3Pool, _owner) {}
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Constructor arguments mismatch

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.