Aave DIVA Wrapper

Summary

In the AaveDIVAWrapperCore::_removeLiquidity function, the _positionTokenAmount parameter can be set to type(uint256).max, which signals the intent to remove the maximum possible liquidity. However, the logic used to determine the amount of liquidity to remove automatically selects the smaller of the user's short and long token balances.

Vulnerability Details

User Provides type(uint256).max

In the _removeLiquidity function, when the user passes type(uint256).max as the _positionTokenAmount, it signals the intent to remove the maximum possible liquidity from the pool. The logic then determines the smaller of the user's short and long token balances and proceeds to remove that amount of each token.

Consider the following case:

• Bob's token balances:

  • 100 short tokens

  • 50 long tokens

• Bob's action: He wants to remove the maximum amount of liquidity, i.e., he provides type(uint256).max as the _positionTokenAmount.

The logic in the function:

• Since _userBalanceShort = 100 and _userBalanceLong = 50, the system determines that the minimum of these two balances is 50 (the long token balance).

• The system will then proceed to remove 50 long tokens and 50 short tokens.

Logical Flow:

1. Bob holds 100 short tokens and 50 long tokens.

2. Bob requests to remove the maximum liquidity by passing type(uint256).max as the _positionTokenAmount.

3. The system checks if _positionTokenAmount == type(uint256).max. Since it is true, it calculates _positionTokenAmountToRemove by taking the minimum of the user's short and long balances:

   • _userBalanceShort = 100

   • _userBalanceLong = 50

4. The system proceeds to remove 50 long tokens and 50 short tokens.

5. Bob intended to remove all his liquidity, but because the system picks the smaller balance (long tokens), only 50 long tokens and 50 short tokens are removed. As a result, Bob will still have 50 short tokens left behind.

Impact

User may expect to remove all liquidity, but because of the logic that selects the smaller balance, he is unable to remove the full amount.

Tools Used

Manual code review

Recommendations

allow the user to fully remove their liquidity, ensuring that both short and long token balances are fully drained.