Aave DIVA Wrapper

Summary and Impact

The AaveDIVAWrapper contract contains two critical flaws in its ERC20 token allowance management:

1. Non-Compliant approve Usage: The registerCollateralToken function directly uses approve instead of OpenZeppelin’s safeApprove, which reverts for tokens like USDT that do not return a boolean. This prevents registration of widely used collateral tokens, violating the protocol’s core invariant of supporting Aave V3-compatible assets.

2. Faulty Allowance Reset Logic: The approveCollateralTokenForAave function uses safeIncreaseAllowance, which fails for tokens requiring an allowance reset to 0 before setting a new value. This blocks Aave interactions (supply/withdraw) for affected tokens, rendering the protocol unusable for these assets.

Impact:

• Token Registration Failure: USDT and similar tokens cannot be registered, limiting protocol utility.

• Aave Functionality Freeze: Users cannot deposit/withdraw collateral for registered tokens after initial allowance exhaustion, violating the invariant that "registered tokens generate yield via Aave".

• Broken Core Features: Both issues directly impede the protocol’s ability to interact with Aave V3, a central value proposition stated in the documentation.

Vulnerability Details

1. Non-Compliant approve in Token Registration

Code Snippet:

Issue:

• USDT’s approve lacks a return value, causing the transaction to revert when approve is called directly.

• This violates the ERC20 standard’s recommended SafeERC20 pattern, which the protocol otherwise uses (e.g., safeTransferFrom).

2. Incorrect Allowance Reset Mechanism

Code Snippet:

Issue:

• safeIncreaseAllowance attempts to increase an existing allowance, but tokens like USDT require resetting to 0 first.

• Example: If currentAllowance = 100, calling safeIncreaseAllowance(2^256 - 1 - 100) tries to set allowance to 2^256 - 1, which USDT rejects.

Tools Used

• Manual Review

Recommendations

1. Replace approve with safeApprove:

1. Fix Allowance Reset Logic:

Rationale:

• safeApprove handles non-standard tokens by using low-level calls and validating success.

• Resetting to 0 before setting a new allowance complies with tokens like USDT.