Aave DIVA Wrapper

Summary

Function _registerCollateralToken is using abi.encodePacked , it returns a string. The use of abi.encodePacked() is a potential issue this can lead to hash collisions.

Vulnerability Details

In the code:

The abi.encodePacked("w", _collateralTokenContract.symbol()) concatenates the bytes of "w" and the symbol string.

If someone creates a token with a specially crafted symbol, it might cause unintended collisions or ambiguous behavior when interacting with the wToken.

Impact

Hash Collision Risk:

If the concatenated value is later hashed (e.g., with keccak256), a malicious actor could craft inputs to create collisions.

For example, abi.encodePacked(0x123, 0x456) could result in the same bytes as abi.encodePacked(0x1, 0x23456).

Tools Used

Manual review

Recommendations

Use abi.encode() instead of abi.encodePacked(). This approach ensures that each argument is properly padded to 32 bytes, avoiding collisions.

Replace with: