Aave DIVA Wrapper

Summary

The _redeemPositionToken function in AaveDiva does not verify whether the provided _positionToken is a valid long or short position token for the specified pool. If an invalid token is used, the function proceeds to redeem it via DIVA, potentially returning collateral tokens of another pool instead of wTokens. Since the contract expects wTokens for withdrawal from Aave, the received collateral tokens will remain stuck in the contract.

Vulnerability Details

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L271

Issues

• The function does not validate if _positionToken belongs to the pool’s long or short position tokens.

• If an invalid token is provided, DIVA will return collateral tokens instead of wTokens.

• The contract assumes wTokens were received and attempts to withdraw from Aave, which fails.

• As a result, the collateral tokens remain trapped in the contract.

Impact

• Transaction Reversion on Zero Withdrawal: If no wTokens are received, the subsequent Aave withdrawal will revert.

• Potential Frontrunning Attack: A malicious user can monitor for calls to:

  IDIVA(_diva).redeemPositionToken(_positionToken, _positionTokenAmountToRedeem);

  Then, by donating 1 unit of wToken before the function executes, they can manipulate the balance calculation, causing the Aave withdrawal call not to revert, while the collateral remains stuck in the contract. The contracts are not upgradable, so there is no way to recover these potential funds

Tools Used

Manual review

Recommendations

Validate _positionToken Before Redeeming

Ensure _positionToken is either _pool.shortToken or _pool.longToken before calling redeemPositionToken.