Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Swapped Constructor Parameters in AaveDIVAWrapper

Deleted user

Summary

The AaveDIVAWrapper constructor incorrectly passes the Aave V3 Pool and DIVA Protocol addresses in the wrong order to the AaveDIVAWrapperCore parent contract.

Vulnerability Details

The constructor parameters for AaveDIVAWrapper are passed as (_aaveV3Pool, _diva, _owner) to AaveDIVAWrapperCore, but the parent contract expects the order (diva_, aaveV3Pool_, owner_). This swaps the _diva and _aaveV3Pool state variables, causing all interactions with the wrong protocol addresses.

Impact

Severity: Critical
All calls to DIVA Protocol (e.g., creating pools) and Aave V3 (e.g., supplying collateral) will fail or interact with unintended contracts, rendering the contract non-functional.

Tools Used

  • Manual Review

Recommendations

Correct the parameter order in the AaveDIVAWrapper constructor:

constructor(address _diva, address _aaveV3Pool, address _owner)
AaveDIVAWrapperCore(_diva, _aaveV3Pool, _owner) {}
Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Constructor arguments mismatch

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.