Aave DIVA Wrapper

Summary

The claimYield function miscalculates available yield, allowing attackers to drain funds.

Vulnerability Details

The contract tracks yield as aToken.balanceOf(address(this)) - totalWTokenSupply. However, if aToken balances increase due to Aave interest before totalWTokenSupply is updated (e.g., via a flash loan), the yield calculation becomes inflated.

Impact

Malicious users could exploit timing mismatches to steal unclaimed yield.

Tools Used

Manual review of AaveDIVAWrapperCore.sol yield logic.

Recommendations

Track yield via a cumulative yieldPerShare variable, similar to staking vaults.