Aave DIVA Wrapper

Summary

The function _approveCollateralTokenForAave attempts to increase the allowance of a collateral token for the Aave V3 Pool using safeIncreaseAllowance. However, if the current allowance is already at the maximum (type(uint256).max), the function will effectively pass a zero value, resulting in a no-op.

Vulnerability Details

• The function retrieves the current allowance of the collateral token for _aaveV3Pool.

• It calculates the required increase by subtracting the current allowance from type(uint256).max.

• If the allowance is already maxed out, this results in safeIncreaseAllowance(token, spender, 0), which does nothing.

Impact

Unnecessary function calls with zero-value approvals, leading to gas inefficiencies.

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L358

Tools Used

Manual code review

Recommendations

Explicitly Check for Max Allowance Before Calling safeIncreaseAllowance