Aave DIVA Wrapper

Summary

The _removeLiquidity function in the contract does not account for slippage during the removal of liquidity and subsequent redemption of collateral tokens. As a result, users may receive fewer collateral tokens than expected due to protocol fees, violatility, or liquidity conditions, leading to potential loss of funds or dissatisfaction.

Vulnerability Details

Affected code:

• The exact amount of collateral tokens received (_amountReturned) may be lower than anticipated because

1. IDIVA(_diva).removeLiquidity may return fewer wTokens than expected due to protocol fees or deductions.

2. _redeemWToikenPrivate may return fewer collateral tokens after redeeming wTokens due to slippage, fees or conversion rate changes in external protocols like Aave.

• No mechanism exists to ensure that the user receives a minimum acceptable amount of collateral tokens.

• This leaves users vulnerable to losses without their consents.

Impact

• User Losses:
  Users may receive fewer tokens than expected, leading ton a financial loss.

• User Trust:
  Lack of protection could leads to distrust in the system.

• Protocol Risk:
  If not fixed, this issue could result in a poor user experience, especially during volatile market conditions.

Tools Used

Manual Review

Recommendations

Add a slippage protection mechanism by introducing a _minCollateralAmount parameter that allows users to define the minimum acceptable amount of collateral tokens they are willing to receive. If the actual amount received (_amountReturned) is less than _minCollateralAmount, the transaction should revert.