Aave DIVA Wrapper

Summary

The _addLiquidity function in the contract does not check if the pool has expired (_pool.expiryTime) before allowing liquidity to be added. This could result in donors or contributors unknowingly adding funds to an expired pool, potentially leading to a loss of funds.

Vulnerability Details

The vulnerability exists in the _addLiquidity function:

https://github.com/Cyfrin/2025-01-diva/blob/main/contracts/src/AaveDIVAWrapperCore.sol#L167C1-L193C6

The function does not validate whether the current block timestamp (block.timestamp) exceeds the pool's expiry time (_pool.expiryTime). Without this validation, users can add liquidity to an expired pool, which may no longer operate as intended. This opens up the possibility of irrecoverable funds or unintended pool behavior.

Steps to Reproduce

1. Create a pool with a defined expiry time (_pool.expiryTime).

2. Wait for the expiry time to pass.

3. Call _addLiquidity for the expired pool.

4. Observe that the function allows the addition of liquidity without reverting.

Impact

Contributors can add liquidity to an expired pool, which might lead to the inability to recover funds or use the pool as intended.

Integrity Risk: Adding liquidity to expired pools could disrupt the expected functionality of the contract and harm user trust.

Tools Used

Manual review

Recommendations

Add a validation check to ensure the pool has not expired before allowing liquidity to be added. Update the _addLiquidity function as follows:

This goes for the batchAddLiquidity function also.