Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The order of the passed parameters is incorrect.

qwer0001337

Summary

The order of the parameters passed to the constructors of AaveDIVAWrapper and AaveDIVAWrapperCore is incorrect, leading to a Denial of Service (DoS) issue in the project.

Vulnerability Details

In the constructor of AaveDIVAWrapper, the order of the parameters passed is AaveDIVAWrapperCore(aaveV3Pool, diva, owner)*, while in the constructor of AaveDIVAWrapperCore, the expected order of the parameters is *constructor(address diva, address aaveV3Pool, address owner). This mismatch in parameter order will lead to a Denial of Service (DoS) issue for all diva and aaveV3Pool-related functionality in the project.

// contracts/src/AaveDIVAWrapper.solconstructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}
// contracts/src/AaveDIVAWrapperCore.solconstructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_) {

Impact

All functions related to diva and aave V3 Pool in the project will be Dos.

Tools Used

Manual review

Recommendations

Modify the parameter order in the constructor of AaveDIVAWrapperCore to constructor(address aaveV3Pool_, address diva_, address owner_).

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Constructor arguments mismatch

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.