Aave DIVA Wrapper

Summary

A reentrancy vulnerability was identified in functions that perform external calls to protocols (DIVA, Aave) or tokens before emitting events. These events rely on values returned from those external calls, creating the possibility for improper repetition of internal logic.

Vulnerability Details

AaveDIVAWrapperCore::_createContingentPool

AaveDIVAWrapperCore::_claimYield

AaveDIVAWrapperCore::_redeemWTokenPrivate

AaveDIVAWrapperCore::_registerCollateralToken

The code contains instances where functions like _claimYield, _createContingentPool, _redeemWTokenPrivate, and _registerCollateralToken execute external interactions (e.g., asset withdrawals, pool creation) before emitting events that depend on the results of those interactions. If external contracts or tokens implement callbacks, these functions could be reentered before the contract’s internal state is finalized, leading to inconsistent event logging.

This occurs due to the following sequence:

1. External interaction (e.g., call Aave::withdraw or DIVA::createContingentPool).

2. State update (e.g., adjusting balances based on the interaction).

3. Event emission (e.g., logging the finalized value).

By performing external calls before finalizing state and emitting events, the code violates the CEI pattern, exposing it to reentrancy risks.

Impact

This flaw could lead to event data being altered during reentrant calls, incorrectly reporting transaction details to off-chain systems (e.g., dashboards, bridges). While existing safeguards prevent direct fund loss, inconsistent event logs risk undermining trust in the protocol's reliability. Future support for less-secure assets or contracts may introduce potential exploits.

Tools Used

Manual review.

Recommendations

It is recommended to use the nonReentrant modifier to prevent reentrancy. Only on the public/external functions in the AaveDIVAWrapper, not on internal functions in the core AaveDIVAWrapperCore. The CEI pattern is not viable here without compromising event data, but it should still be considered.