Aave DIVA Wrapper

Summary

The function _redeemPositionToken in the smart contract contains a potential vulnerability related to the balance check before and after the redemption process. Specifically, the variable _wTokenBalanceBeforeRedeem is assumed to always be less than or equal to the post-redeem balance. However, there are scenarios where this assumption may not hold, leading to potential inconsistencies or unexpected behaviors.

Vulnerability Details

If DIVA Protocol fees or penalties reduce the redeemable amount, or a contract bug/malicious external action occurs, the balance might actually decrease:

Impact

If _wTokenBalanceBeforeRedeem is greater than the post-redeem balance, it implies:

• Possible underflow issues.

• Misalignment with expected contract logic.

• Potential loss of collateral tokens.

Tools Used

Manual Review

Recommendations