Aave DIVA Wrapper

Summary

The function redeemPositionToken() allows users to pass type (uint256).max as the positionTokenAmount, meaning "redeem all available tokens." However, the contract does not verify if the sender has sufficient balance or allowance, which can cause unintended behaviour or fund misallocation.

Vulnerability Details

. The contract assigns positionTokenAmoumtToRedeem = _userBalance if type(uint256).max is used.

. However, ERC20's transferFrom() does not revert if allowance is lower than the required amount-- it transfers as much possible instead

. This results in partial transfers, leading to incorrect calculations in downstream functions

.Setup:

.Alice has 500 positionToken.

. Alice sets allowance to only 400

. She calls _redeemPositionToken(positionToken, type(uint256).max, Bob).

.Exploit:

. The contract thinks Alice has 500 and assigns _positionTokenAmountToRedeem = 500.

. However, transferFrom() only allows 400 due to the lower allowance

. Now, the contract believes 500 was redeemed but actually processed 400, leading to unexpected reductions

Consequences

. Bob receives incorrect funds

. The system state becomes inconsistent due to miscalculation balances

Code location of Concern

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L277

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L278

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L321

https://github.com/Cyfrin/2025-01-diva/blob/1b6543768c341c2334cdff87b6dd627ee2f62c89/contracts/src/AaveDIVAWrapperCore.sol#L322

Impact

. If users balance is modified between reading and execution, the transaction may fail or be executed with outdated values

Tools Used

Manual review

Recommendations

. Use a two-step redemption process: Requires users to lock their balance first before executing the redemption

. Allow user-specified maximum slippage: Provide an optional parameter where users can specify the maximum allowable in balance