Aave DIVA Wrapper

Vulnerability Details

The AaveDIVAWrapper constructor takes the following arguments,

• address _aaveV3Pool

• address _diva

• address _owner
  Since it inherits AaveDIVAWrapperCore, the arguments are provided to the parent contract too. However, the order of the arguments provided is incorrect.

What the AaveDIVAWrapperCore constructor expects:

What the AaveDIVAWrapperCore constructor gets:

This would lead to functions being called on the wrong contract which breaks the core functionality of the protocol since the protocol depends heavily on AaaveV3 and DIVA protocols and the functions on DIVA would be called on AaveV3Pool and vice versa, resulting in reverts all over the place.

Recommendations

Provide the arguments in correct order.