Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Parameter Ordering Mismatch in AaveDIVAWrapper Constructor

olugbenga

Summary

The constructor parameters of the AaveDIVAWrapper contract are ordered differently from its parent contract AaveDIVAWrapperCore.

Vulnerability Details

AaveDIVAWrapper contract inherits from AaveDIVAWrapperCore. The constructor arguments from AaveDIVAWrapper are passed to AaveDIVAWrapperCore and are used to initialize the contract. However, there's a mismatch between the parameters of the two contracts as shown below

AaveDIVAWrapper.sol#L7-L12

contract AaveDIVAWrapper is AaveDIVAWrapperCore, ReentrancyGuard {
/*//////////////////////////////////////////////////////////////
CONSTRUCTOR
//////////////////////////////////////////////////////////////*/
​
constructor(address _aaveV3Pool, address _diva, address _owner) AaveDIVAWrapperCore(_aaveV3Pool, _diva, _owner) {}

AaveDIVAWrapperCore.sol#L52-L62

constructor(address diva_, address aaveV3Pool_, address owner_) Ownable(owner_) {
// Validate that none of the input addresses is zero to prevent unintended initialization with default addresses.
// Zero address check on `owner_` is performed in the OpenZeppelin's `Ownable` contract.
if (diva_ == address(0) || aaveV3Pool_ == address(0)) {
revert ZeroAddress();
}
​
// Store the addresses of DIVA Protocol and Aave V3 in storage.
_diva = diva_;
_aaveV3Pool = aaveV3Pool_;
}

As shown above, the order of diva_ and aaveV3Pool_ has been switched in AaveDIVAWrapper.

Impact

  • Results in: DIVA address stored as Aave V3 pool address and Aave V3 pool address stored as DIVA address

  • All transactions that involve interactions with either protocol will revert.

  • The contract will need to be redeployed with the correct parameter ordering.

Tools Used

Manual

Recommendations

The constructor parameters of AaveDIVAWrapper should be reordered to match the parent contract's expected

Updates

Lead Judging Commences

bube Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Constructor arguments mismatch

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.