Aave DIVA Wrapper

Summary

The contract currently uses the approve function to grant token allowances for the _diva and _aaveV3Pool protocol addresses. However, directly using approve poses security risks, such as double-spend vulnerabilities and allowance race conditions.

Vulnerability Details

The AaveDIVAWrapperCore.sol is using approve while approving the _diva and _aaveV3Pool protocol addresses

https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/AaveDIVAWrapperCore.sol#L115-L116

Impact

• Allowance Race Condition: If a previous allowance exists, a race condition may occur if malicious actors manage to spend tokens before the allowance is updated.

• Potential Double-Spend Vulnerability: Without proper zero-setting of the allowance, there may be scenarios where approvals can be exploited.

Tools Used

Manual

Recommendations

Use the safeApprove function from the OpenZeppelin SafeERC20 library instead of approve. safeApprove adds additional safety checks, reducing the likelihood of security issues.