Aave DIVA Wrapper
DIVA
HardhatDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

AaveDIVAWrapper can't receive permissioned long and short tokens

pontifex

Summary

The AaveDIVAWrapper can create a Contingent Pool with such long and short tokens which can be transferred only to _poolParams.permissionedERC721Token holders. It means that the long and short tokens can't be redeemed via the removeLiquidity and redeemPositionToken functions.

Vulnerability Details

The _poolParams.permissionedERC721Token can be non zero and there is no check that the AaveDIVAWrapper owns a permissionedERC721Token. At the same time if the recipients own the permissionedERC721Token the call will be successful.

function _createContingentPool(PoolParams calldata _poolParams) internal returns (bytes32) {
address _wToken = _collateralTokenToWToken[_poolParams.collateralToken];
// Confirm that the provided collateral token is registered. This check is performed early
// to ensure an immediate and graceful revert rather than allowing execution to continue until the `mint`
// operation at the end of the `_handleTokenOperations` function, which would then fail when attempting to call
// the `mint` function on address(0).
if (_wToken == address(0)) {
revert CollateralTokenNotRegistered();
}
​
// Transfer collateral token from caller to this contract, supply to Aave, and mint wTokens.
// Requires prior approval by the caller to transfer the collateral token to the AaveDIVAWrapper contract.
_handleTokenOperations(_poolParams.collateralToken, _poolParams.collateralAmount, _wToken);
​
// Create pool on DIVA Protocol using the wToken as collateral.
bytes32 _poolId = IDIVA(_diva).createContingentPool(
IDIVA.PoolParams({
referenceAsset: _poolParams.referenceAsset,
expiryTime: _poolParams.expiryTime,
floor: _poolParams.floor,
inflection: _poolParams.inflection,
cap: _poolParams.cap,
gradient: _poolParams.gradient,
collateralAmount: _poolParams.collateralAmount,
collateralToken: _collateralTokenToWToken[_poolParams.collateralToken], // Using the address of the wToken here
dataProvider: _poolParams.dataProvider,
capacity: _poolParams.capacity,
longRecipient: _poolParams.longRecipient,
shortRecipient: _poolParams.shortRecipient,
>> permissionedERC721Token: _poolParams.permissionedERC721Token
})
);
​
emit PoolIssued(_poolId);
​
return _poolId;
}

The long and short tokens holders can't redeem via the removeLiquidity and redeemPositionToken functions because they need to transfer the tokens to the AaveDIVAWrapper contract.

// Transfer short and long tokens from user to this contract. Requires prior user approval on both tokens.
// No need to use `safeTransferFrom` here as short and long tokens in DIVA Protocol are standard ERC20 tokens
// using OpenZeppelin's ERC20 implementation.
_shortTokenContract.transferFrom(msg.sender /** from */, address(this) /** to */, _positionTokenAmountToRemove);
_longTokenContract.transferFrom(msg.sender /** from */, address(this) /** to */, _positionTokenAmountToRemove);

But it is possible only when the receiver owns the permissionedERC721Token:
contracts/PermissionedPositionToken.sol:

function _beforeTokenTransfer(
address from,
address to,
uint256 amount
) internal virtual override {
super._beforeTokenTransfer(from, to, amount);
​
if (to != address(0)) {
require(
from == address(0) || _validHolder(from),
"PositionToken: invalid sender"
);
// 0 address is passed during burn and should be allowed as recipient
>> require(_validHolder(to), "PositionToken: invalid recipient");
}
}
​
function _validHolder(address _holder) private view returns (bool) {
return IERC721(_permissionedERC721Token).balanceOf(_holder) > 0;
}

The permissionedERC721Token can avoid sending their tokens to the protocol contract because it is impossible to return them back.

Impact

The contract functionality can be unavailable for particular cases or controlled by the permissionedERC721Token contract owner.

Tools used

Manual Review

Recommendations

Consider checking if the protocol owns a permissionedERC721Token before Contingent Pool creation or always using address zero.

Updates

Lead Judging Commences

bube Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

pontifex Submitter
5 months ago
bube Lead Judge
4 months ago
bube Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

PermissionedERC721Tokens are not supported

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.