Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The Aave pool is hardcoded

avci

Summary

The Aave pool is hardcoded and its not recommended by aave doc.

Vulnerability Details

The owner of protocol needs to provide Aave pool address when deploying AaveDIVAWrapper contract in its constructor().

we can see this aave pool address is stored in immutable variable in AaveDIVAWrapperCore contract.

address private immutable _aaveV3Pool; // Pool contract address
​
/**
* @dev Initializes the AaveDIVAWrapper contract with the addresses of DIVA Protocol, Aave V3's Pool
* contract and the owner of the contract.
* @param diva_ Address of the DIVA Protocol contract.
* @param aaveV3Pool_ Address of the Aave V3 Pool contract.
* @param owner_ Address of the owner for the contract, who will be entitled to claim the yield.
* Retrievable via Ownable's `owner()` function or this contract's `getContractDetails` functions.
*/
constructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_) {
// Validate that none of the input addresses is zero to prevent unintended initialization with default addresses.
// Zero address check on `owner_` is performed in the OpenZeppelin's `Ownable` contract.
if (diva_ == address(0) || aaveV3Pool_ == address(0)) {
revert ZeroAddress();
}
​
// Store the addresses of DIVA Protocol and Aave V3 in storage.
_diva = diva_;
_aaveV3Pool = aaveV3Pool_;
}

However the Aave doc mentions that PoolAddressProvider contract should be queried everytime to provide the current pool address. Because if the pool contract were migrated to a new address, it would disrupt the core logic of this protocol.
https://aave.com/docs/developers/smart-contracts/pool-addresses-provider

instance of this issue in other contest:
https://github.com/hats-finance/Origami-0x998f1b716a5022be026ca6b919c0ddf45ca31abd/issues/58

Impact

Breaking of core logic and every calls to Aave pool can be revert

Tools Used

Manual Review

Recommendations

Consider using PoolAddressProvider contract.

Updates

Lead Judging Commences

bube Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Immutable Aave pool address

Appeal created

wellbyt3 Auditor
6 months ago
bube Lead Judge
6 months ago
bube Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Immutable Aave pool address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.