Submission Details
Severity:
Unrestricted Collateral Token Registration
Summary
Owner can register malicious ERC20 tokens, leading to fund loss
Vulnerability Details
registerCollateralToken lacks validation (e.g., checking if the token is whitelisted on Aave V3). A malicious owner could register a fake token, causing deposits to fail or lock funds
Impact
Users deposit into unsupported tokens, resulting in irrecoverable funds
Tools Used
Manual review of AaveDIVAWrapper.sol registration logic
Recommendations
Cross-check tokens against Aave’s official pool addresses
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
51929 USDC / LOC
14,000
1,000
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.