Aave DIVA Wrapper

Summary

The function _approveCollateralTokenForAave incorrectly uses OpenZeppelin’s safeIncreaseAllowance method to approve allowances for tokens like USDT on Ethereum. This method does not reset allowances to zero before setting a new value, violating the security requirements of non-compliant ERC20 tokens such as legacy USDT, which will cause transactions to revert.

Vulnerability Details

Affected Code:

Root Cause:

• Non-Compliant Token Behavior: Tokens like legacy USDT enforce a security check that reverts transactions if the allowance is modified from a non-zero value without first resetting it to zero.

• safeIncreaseAllowance Mechanism: The method reads the current allowance, increments it, and calls approve with the new total. It does not reset to zero first, making it incompatible with non-standard tokens.

Impact

• Critical Protocol Failure: Transactions involving non-compliant tokens (e.g., USDT) will revert, preventing the protocol from approving allowances for Aave V3 interactions.

• Operational Disruption: Users cannot deposit or manage collateral tokens that follow this non-standard behavior, degrading protocol functionality.

Tools Used

Manual Code Review

Recommendations