Aave DIVA Wrapper

Summary

The contract IAave.sol exposes two important functions, supply and withdraw, to external users without appropriate access control or verification mechanisms. These functions allow any address to supply or withdraw assets to/from the reserve. While this may be the intended functionality for user interaction, improper implementation or lack of safeguards could lead to abuse.

Vulnerability Details

• The functions supply and withdraw are public-facing, but there’s no mention of who is authorized to call them and under what conditions, which leaves the protocol exposed to potential abuse.

• For example, the withdraw function can be called with a uint256.max value to withdraw the total available assets, leading to theft if not properly guarded.

Impact

• Unauthorized users could exploit these functions, causing significant financial loss to the protocol or others.

• If there's insufficient access control, an attacker could drain the funds or manipulate the reserve states.

Proof of Concept for Unprotected Supply and Withdraw Functions

Overview:

Exposing functions like supply and withdraw without proper access control could allow an attacker to drain funds or disrupt the protocol.

Actors:

• Attacker: An unauthorized address calling withdraw with malicious intent.

• Victim: The protocol's liquidity reserve.

• Protocol: The Aave contract system responsible for handling user deposits and withdrawals.

Working Test Case:

Outcome & Implications:

The attacker could exploit the unprotected function to withdraw all assets from the protocol.

Tools Used

Manual code review

Recommendations

• Implement access control (e.g., owner or role-based access) or verify the source of requests using signatures, ensuring only authorized addresses can interact with these functions.

• Consider rate-limiting or checking for specific conditions before allowing asset withdrawals.