Aave DIVA Wrapper

Summary

The _claimYield function is responsible for withdrawing accrued yield from Aave and transferring it to a recipient. However, it lacks proper event integrity, which may lead to incorrect or misleading event logs.
https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L350

Vulnerability Details

The function emits the YieldClaimed event using owner() instead of msg.sender.
If multiple parties have access to this function, the event log may incorrectly attribute the action to the contract owner rather than the actual caller.

Impact

Misleading event logs could result in incorrect attribution of yield claims.
It may cause issues in audit trails, compliance, and debugging.
In multi-user or DAO-managed systems, incorrect event attribution could lead to governance disputes or accountability issues.

Tools Used

Manual Code Review

Recommendations

Replace owner() with msg.sender in the event emission to correctly attribute the transaction to the caller.

emit YieldClaimed(msg.sender, _recipient, _collateralToken, _amountReturned);