Aave DIVA Wrapper

Summary

If Aave’s aToken balance drops below the total wToken supply (e.g., due to a hack), users cannot redeem collateral.

Vulnerability Details

_redeemWTokenPrivate withdraws collateral from Aave based on wToken balances. If Aave’s aToken balance is less than wToken.totalSupply(), redemptions will partially fail, leaving users with worthless wTokens.

Impact

Permanent loss of user funds if Aave’s reserves are compromised.

Tools Used

• Manual Review

Recommendations

1. Implement a pause mechanism to halt redemptions if aTokenBalance < wTokenSupply.

2. Monitor Aave’s reserves and trigger emergency protocols if anomalies occur.