Aave DIVA Wrapper

Summary

The contract heavily depends _getWToken() to map collateral tokens to wrapped tokens(wTokens). If this mapping is accidentally or maliciously modified ( e.g., unset or changed), the contract's core logic will fail, potentially causing user funds to become irretrievable

Vulnerability Details

The contract relies on getWToken to retrieve the corresponding wToken for a collateralToken. If _collateralTokenToWToken mapping is manipulated (e.g., unset or changed), the entire contract's logic could fail or lead to fund loss

Exploitation:

1. Setup

   . Register wToken for a collateralToken

   . Deposit and receive wToken

2. Exploits

   . The contract owner( or a compromised function) updates __collateralTokenToWToken[ __collateralToken ] = address (0)

   .Now any function relying on _getWToken() will break, failing to process redemptions

3. Code locations of Concern

   https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L267

   https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L268

   https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L440

   https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L462

   https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L394

   https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L395

Impact

. If the _wTokenToCollateralToken mapping is incorrect, funds could be trapped or misallocated.

. If a wToken's minting or burning mechanism fails, the contract may not function as intended.

. If collateralTokenToToken [ _collateralToken ] is misconfigured, redemptions will not work properly.

Tools Used

Manual review

Recommendations

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L394

Fix

function safeGetWToken(address collateralToken) internal view returns (address) { address wToken = collateralTokenToToken[ collateralToken];

If (wToken == address (0) ) {

revert CollateralTokenNotRegistered();

}
return wToken;

}