Aave DIVA Wrapper

Description

In the _registerCollateralToken function of AaveDIVAWrapperCore.sol, the approve function is used to set unlimited allowances for the collateral token to Aave V3. While this works for standard ERC20 tokens, it can cause issues with non-standard tokens like USDT, which require the allowance to be set to zero before it can be set to a non-zero value. Using approve directly on such tokens will revert, preventing the registration of the collateral token.

The approveCollateralTokenForAave function is available to reset the allowance to unlimited, but it does not address the issue of non-standard tokens during the initial registration. Additionally, approve is susceptible to race conditions if multiple transactions try to approve tokens simultaneously.

Impact

• For non-standard tokens (e.g., USDT): The function will revert, preventing the registration of the collateral token and breaking core functionality.

• For standard tokens: While approve works, it is less robust and could lead to race conditions or unexpected behavior in edge cases.

This issue affects the ability to register collateral tokens, which is a critical part of the protocol's functionality. If non-standard tokens are used, the contract will fail to register them, rendering the protocol unusable for those tokens.

Tools Used

Manual review

POC/Proof Of Code

Current Code in _registerCollateralToken:

Steps to Reproduce:

1. Deploy the AaveDIVAWrapper contract.

2. Call registerCollateralToken with a non-standard token like USDT.

3. The transaction will revert because approve does not handle the non-standard behavior of USDT.

Recommended Mitigation

Replace approve with safeIncreaseAllowance for the collateral token in _registerCollateralToken. This ensures compatibility with non-standard tokens and avoids race conditions.

Updated Code:

• safeIncreaseAllowance safely increases the allowance, even for non-standard tokens like USDT.

• It avoids race conditions by incrementing the allowance rather than setting it directly.

• It is future-proof, ensuring compatibility with a wider range of tokens.