Aave DIVA Wrapper

Summary

Using approve to change the allowance introduces risks, as an attacker might front-run the transaction and use both the old and new allowances simultaneously. It is recommended to use increaseAllowance or decreaseAllowance to avoid this issue.

https://docs.google.com/document/d/1YLPtQxZu1UAvO9cZ1O2RPXBbT0mooh4DYKjA_jp-RLM/edit?tab=t.0#heading=h.m9fhqynw2xvt

Vulnerability Details

The specific scenario is as follows:

1. The Owner approves 10 ether for the consumer.

2. The Owner intends to change the approval from 10 ether to 1 ether.

3. Before the transaction is executed, the consumer transfers the 10 ether approved by the Owner to their own account.

4. The Owner executes the transaction (changing the approval from 10 ether to 1 ether), and the consumer can transfer the 1 ether to their account.

5. At this point, the Owner only intends to approve 1 ether for the consumer, but the consumer ends up with 10 ether + 1 ether, exceeding the Owner's approved amount.

Impact

Using approve to change the allowance introduces risks, as someone might exploit an unfortunate transaction order to simultaneously use both the old and new allowances.

Tools Used

Manual review

Recommendations

In WToken.sol, prefer using increaseAllowance/decreaseAllowance over approve.