Aave DIVA Wrapper

Summary

A Denial-of-Service (DoS) vulnerability exists in the approveCollateralTokenForAave function due to improper handling of token allowances. An attacker can front-run transactions to reset the allowance, causing subsequent transactions to revert if the required allowance exceeds the remaining allowance.

Vulnerability Details

The AaveDIVAWrapperCore.approveCollateralTokenForAave function uses OpenZeppelin's safeIncreaseAllowance to set the allowance for a collateral token to Aave. The function calculates the new allowance as type(uint256).max - currentAllowance. However, if the current allowance is already close to type(uint256).max, the new allowance may be significantly reduced, causing transactions to revert if the required allowance exceeds the remaining allowance.

Steps to Reproduce:

• An admin registers a collateral token, setting the allowance to type(uint256).max.

• The user deposits collateral, reducing the allowance to type(uint256).max - y, where y is the deposited amount with addLiquidity

• An attacker front-runs the next user's transaction and calls approveCollateralTokenForAave, setting the allowance to type(uint256).max - (type(uint256).max - y) = y.

The user's transaction reverts if the required allowance exceeds y.

The external function that is to be called is not restricted

Impact

Medium impact due to Denial of Service. Legitimate users may be unable to deposit collateral or interact with Aave, as their transactions may revert due to insufficient allowance.

Tools Used

Manual Review

Recommendations

Restrict the approveCollateralTokenForAave function to trusted users or the contract owner to prevent malicious actors from front-running transactions
or do IERC20Metadata(_collateralToken).safeIncreaseAllowance(_aaveV3Pool, type(uint256).max);