Aave DIVA Wrapper

Summary

The _registerCollateralToken function in the AaveDIVAWrapperCore contract deploys a wrapped version of a collateral token (wToken) and derives its symbol by prefixing the original collateral token's symbol with "w". However, the function assumes that the symbol() function of the collateral token returns a string. For tokens like MKR, where the symbol() function returns a bytes32 value instead of a string, this assumption leads to incorrect and non-human-readable token symbols.

Vulnerability Details

NOTE-1: According to the readMe, all tokens used by aave are in scope. The following report is about an issue with "MKR" token which is a valid aave token.

registerCollateralToken function deploys a token that represents a wrapped version of the collateral token to be used as proxy collateral in DIVA Protocol. The symbol and name of the wToken are derived from the original collateral token, prefixed with 'w' (e.g., wUSDT or wUSDC).

The issue is that the function assumes that the symbol() function of the _collateralTokenContract returns a string. However, if the _collateralTokenContract is MKR token where the symbol() function returns a bytes32 instead of a string, the code will not work correctly as written. This is because abi.encodePacked("w", _collateralTokenContract.symbol()) expects the symbol to be a string, not bytes32.
AaveDIVAWrapperCore.sol#L92-L96

In Solidity, bytes32 can be concatenated with a string using abi.encodePacked, but the result will not be human-readable without proper conversion. This is because bytes32 is a fixed-length byte array, and string is a dynamically sized UTF-8 encoded byte array. When you concatenate them directly, the result will be a byte array that combines the raw bytes of the string and the bytes32 value.

Casting this result to a string produces a non-human-readable string with embedded null bytes, which are displayed as square boxes in tools like Remix.

This is likely not what you want, as the bytes32 value will not be properly interpreted as a string unless it is explicitly converted.

A short POC to test in remix:

Steps to Reproduce:

1. Deploy the PoC contract in Remix.

2. Call demonstrateIssue() and observe the output: "wMKR" followed by square boxes.

3. Call demonstrateCorrectWay() and observe the clean output: "wMKR".

Impact

Wrapped tokens will be deployed with non-standard symbols containing embedded null bytes, leading to display issues in user interfaces, interoperability problems with external systems, and potential data corruption in applications relying on clean, human-readable token symbols.

Tools Used

Manual Review

Recommendations

To resolve this issue, explicitly convert the bytes32 symbol to a string by trimming the null bytes before concatenation. Use a helper function like bytes32ToString to ensure the resulting string is clean and human-readable.