Aave DIVA Wrapper

Summary

The _removeLiquidity function in the AaveDIVAWrapperCore.sol lacks a critical validation check for the recipient address (_recipient). If _recipient == address(0), liquidity tokens may be permanently burned, leading to irreversible fund loss. This issue poses a high-severity risk as it can result in significant financial losses for users and protocol stakeholders.

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L198-L251

Vulnerability Details

· Function Affected: _removeLiquidity

· Root Cause: No validation for _recipient, allowing users to send tokens to address(0).

· Impact: If _recipient == address(0), the removed liquidity tokens are burned and permanently lost.

Impact

Tokens sent to address(0) are permanently burned and cannot be recovered. Tokens are permanently lost, leading to significant financial damage

Tools Used

Manual

Recommendations

To mitigate this risk, implement the following validation within _removeLiquidity:

require _recipient != address(0), "Invalid recipient");