Aave DIVA Wrapper

Summary

The vulnerability allows a user to exploit the _redeemPositionToken function by repeatedly removing and adding liquidity to manipulate their position, ultimately gaining more rewards in a long position at the expense of others. By repeatedly selling the losing position (e.g., the short position), the attacker can accumulate more of the winning position (long), leading to an unfair advantage when the market expires.

Vulnerability Details

The issue arises from the logic in _redeemPositionToken() where the function removes positionToken from the position we choose

Here’s how the exploit works:

1. The attacker calls _redeemPositionToken() to remove their short position (since it's smaller than the long position).

2. The attacker then calls addLiquidity() to add liquidity back into the pool, which will split the liquidity between both the long and short positions.

3. The attacker can repeat this process multiple times, consistently removing the short position and adding liquidity back, effectively increasing their long position and reducing their short position.

4. By the time the market expires, the attacker will have a significantly larger long position (with no short position), resulting in them winning more rewards when the long position wins.

This cycle can be repeated as often as the attacker wants, giving them an unfair advantage over other users.

Impact

Medium

Tools Used

Manual Review

Recommendations