Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Approving the maximum token amount `type(uint256).max` may not work for certain tokens that do not support this approval value.

bizarro

Summary

AaveDIVAWrapperCore::_registerCollateralToken approves the maximum amount of collateralToken to be spent by the aaveV3Pool. The tokens like UNI or COMP
will revert when approving the max tokens.

https://github.com/Uniswap/governance/blob/eabd8c71ad01f61fb54ed6945162021ee419998e/contracts/Uni.sol#L149

function approve(address spender, uint rawAmount) external returns (bool) {
uint96 amount;
if (rawAmount == uint(-1)) {
amount = uint96(-1);
} else {
amount = safe96(rawAmount, "Uni::approve: amount exceeds 96 bits");
}
​
allowances[msg.sender][spender] = amount;
​
emit Approval(msg.sender, spender, amount);
return true;
}

Both the tokens contain this piece of code which reverts when the amount exceeds 96 bits.

Proof of Concept

https://github.com/Cyfrin/2025-01-diva/blob/5b7473c13adf54a4cd1fd6b0f37ab6529c4487dc/contracts/src/AaveDIVAWrapperCore.sol#L116

Impact

This functionality can revert for tokens that doesn't suppport max unit256 approval, If this occurs, the entire batch of tokens awaiting approval will also fail.

Tools Used

Manual Review

Recommendations

I would suggest approve only the necessay amount of token to the aaveV3Pool instead of the type(uint256).max amount.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Appeal created

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.