Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Owner cannot register `USDT` on ETH mainnet

avci

Summary

Owner of the contract cannot register USDT token on ETH mainnet.

Vulnerability Details

As we can see protocol need to support all tokens that Aave V3 supports, mainly USDT and USDC:

Any ERC20 token supported by Aave V3, but mainly stablecoins like USDC, USDT are expected to be used for DIVA Donate.

and contracts will be deployed on:

  • Ethereum Mainnet

  • Polygon

  • Arbitrum One

  • Gnosis Chain

  • Ethereum Sepolia (Testnet)

The owner of the contract have to call registerCollateralToken() function to register token. then this function will call _registerCollateralToken() in AaveDIVAWrapperCore, then this function approves max amount of collateral token to the Aave V3 pool:

_collateralTokenContract.approve(_aaveV3Pool, type(uint256).max);

The issue is above call will be revert on ETH mainnet for USDT token.

Impact

DOS of registerCollateralToken() function for USDT token in ETH mainnet.

POC

  • install foundry for hardhat with pnpm

  • pnpm add --save-dev @nomicfoundation/hardhat-foundry

  • run test with: forge test --fork-url ``ETH-MAINNET-RPC`` --mt test_poc

​
// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
​
import {Test} from "forge-std/Test.sol";
import {AaveDIVAWrapper} from "../contracts/src/AaveDIVAWrapper.sol";
​
contract AaveDIVAWrapperTest is Test {
AaveDIVAWrapper public aaveDIVAWrapper;
​
address owner = makeAddr("owner");
​
address USDT = 0xdAC17F958D2ee523a2206206994597C13D831ec7;
address DIVA = 0x2C9c47E7d254e493f02acfB410864b9a86c28e1D;
address AaveV3 = 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2;
​
function setUp() public {
aaveDIVAWrapper = new AaveDIVAWrapper(
DIVA,
AaveV3,
owner
);
}
​
function test_poc() public {
vm.prank(owner);
aaveDIVAWrapper.registerCollateralToken(USDT);
}
​
}

as we can see test will revert:

Ran 1 test for test/Poc.t.sol:AaveDIVAWrapperTest
[FAIL: EvmError: Revert] test_poc() (gas: 856894)

Tools Used

Manual Review

Recommendations

Consider using forceApprove() of OpenZeppelin.

Updates

Lead Judging Commences

bube Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.