Aave DIVA Wrapper

Summary

The AaveDIVAWrapperCore contract hardcodes the Aave V3 pool address using an immutable variable, violating Aave's recommended practice of using their PoolAddressProvider system for dynamic address resolution.

Vulnerability Details

The contract initializes and stores the Aave pool address as an immutable variable in the constructor:

This implementation directly contradicts Aave's documentation which states:

"The LendingPoolAddressesProvider is the core registry of the Aave protocol... we recommended you fetch the correct address from the LendingPoolAddressesProvider"

Impact

• Protocol Breakage Risk: If Aave migrates to a new pool contract, all deployed instances would become permanently broken

• Upgrade Inability: Requires full redeployment rather than simple configuration update

• Loss of Yield: Existing positions would be frozen with no migration path

Tools Used

• Manual code review

• Aave protocol documentation analysis

Recommendations

• Follow AAVE's recommendation and use LendingPoolAddressesProvider.getLendingPool() to retrieve the latest pool address before calling it.