Aave DIVA Wrapper

Summary

The function _getAccruedYield returns 0 in two distinct scenarios:

1. When the collateral token is not registered (_collateralTokenToWToken[_collateralToken] == address(0)).

2. When there are no accrued yields (_getAccruedYieldPrivate(_collateralToken) returns 0).

This behavior can lead to ambiguity in interpreting the return value, as the same output (0) is used to represent two different states.

Vulnerability Details

```_getAccruedYield``` returns zero when a collateral token has not been registered

The function ```_getAccruedYieldPrivate``` also returns zero when there haven't been any accrued yields in the contract

Impact

However, it can cause confusion for developers or external systems relying on this function, as they cannot distinguish between an unregistered collateral token and a registered token with no accrued yields.

If the return value of 0 is used to make decisions (e.g., skipping further processing or triggering specific logic), it may lead to unintended behavior if the caller assumes the wrong state (e.g., assuming no yields when the token is unregistered).

Tools Used

Manual review

Recommendations

Use a revert statement or a custom error to explicitly indicate when a collateral token is not registered. This ensures that the caller is aware of the specific reason for the failure.