Aave DIVA Wrapper

Summary

while calling createContingentPool users can specify parameters such as capacity and collateralAmount. However, a malicious user can exploit this functionality to create multiple pools with zero or very low capacity and collateralAmount. This could lead to a denial-of-service (DoS) attack, rendering the protocol unusable for legitimate users. Specifically:

1. Zero or Low Capacity: A malicious user can create pools with zero or very low capacity, preventing other users from adding liquidity to the pool. This is because the _addLiquidity function checks the pool's capacity, and if it is too low, legitimate users will be unable to participate.

2. Zero Collateral Amount: A malicious user can create pools with zero collateralAmount, effectively creating "empty" pools that serve no purpose but clog the system. This could lead to unnecessary bloat in the contract's state and make it harder for legitimate users to find usable pools.

Vulnerability Details

https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/AaveDIVAWrapper.sol#L113

https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/AaveDIVAWrapperCore.sol#L141C1-L157C11

https://github.com/divaprotocol/diva-protocol-v1/blob/1263828cd5c5b2192e876edef90444448e66176d/contracts/libraries/LibDIVA.sol#L815

Impact

The impact of this vulnerability is significant:

1. Denial of Service: Malicious users can flood the system with unusable pools, making it difficult or impossible for legitimate users to create or interact with functional pools. This could lead to a complete halt in the protocol's operations.

2. Resource Exhaustion: Creating multiple pools with zero or low parameters consumes on-chain storage and increases gas costs for users interacting with the protocol. Over time, this could lead to increased transaction fees and reduced efficiency.

3. Financial Loss: Legitimate users may be unable to participate in pools leading to potential financial losses.

Recommendations

To mitigate this vulnerability, the following measures can be implemented:

1. Minimum Capacity and Collateral Requirements:
   Enforce minimum values for capacity and collateralAmount during pool creation.

   require(_poolParams.capacity >= MIN_CAPACITY, "Capacity too low");

   require(_poolParams.collateralAmount >= MIN_COLLATERAL, "Collateral amount too low");

2. Pool Creation Fees:
   Introduce a fee for pool creation. This would discourage malicious users from creating unnecessary pools, as they would incur a cost for each pool created.