Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Token Whitelisting Enables Registration of Potentially Malicious Collateral Assets

cheatc0d33

Summary

The contract allows registration of any token that has an associated Aave aToken without pre-vetting, enabling potential registration of malicious or compromised tokens as collateral.

The current collateral token registration system in _registerCollateralToken() only checks if:

  1. The token is not already registered

  2. The token has an associated aToken in Aave

This is insufficient as it lacks a proper whitelisting mechanism for pre-vetting tokens, creating security risks.

Current vulnerable code:

https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/AaveDIVAWrapperCore.sol#L71

function _registerCollateralToken(address _collateralToken) internal returns (address) {
if (_collateralTokenToWToken[_collateralToken] != address(0)) {
revert CollateralTokenAlreadyRegistered();
}
address _aToken = _getAToken(_collateralToken);
if (_aToken == address(0)) {
revert UnsupportedCollateralToken();
}
// ... continues token registration
}

Scenario

  1. A malicious token gets listed on Aave

  2. The token can be immediately registered in this contract through _registerCollateralToken()

  3. The token becomes usable as collateral without any vetting process

Recommendation

Implement a whitelist system to protect against malicious tokens:

mapping(address => bool) public whitelistedCollateral;
​
function _registerCollateralToken(address _collateralToken) internal returns (address) {
if (_collateralTokenToWToken[_collateralToken] != address(0)) {
revert CollateralTokenAlreadyRegistered();
}
if (!whitelistedCollateral[_collateralToken]) {
revert TokenNotWhitelisted();
}
address _aToken = _getAToken(_collateralToken);
if (_aToken == address(0)) {
revert UnsupportedCollateralToken();
}
// ... continue with registration
}

This ensures tokens must be explicitly approved before they can be registered as collateral.

Updates

Lead Judging Commences

bube Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.