Aave DIVA Wrapper

Summary

The _claimYield function in the AaveDIVAWrapperCore contract enables the immediate withdrawal of accrued yield by owner without any restrictions or safeguards. This creates a potential vulnerability where the owner can extract yield at inopportune times, possibly exploiting user trust.

Vulnerability Details

• Functionality: The _claimYield function allows the owner or an inheriting contract to withdraw all accrued yield for a specific collateral token.

  function _claimYield(address _collateralToken, address _recipient) internal returns (uint256) {

  // Confirm that the collateral token is registered

  if (_collateralTokenToWToken[_collateralToken] == address(0)) {

  revert CollateralTokenNotRegistered();

  }

  ​

  if (_recipient == address(0)) revert ZeroAddress();

  ​

  // Redeem aToken for collateral token at Aave Protocol and send collateral token to recipient.

  uint256 _amountReturned = IAave(_aaveV3Pool).withdraw(

  _collateralToken, // Address of the underlying asset (e.g., USDT), not the aToken.

  _getAccruedYieldPrivate(_collateralToken), // Amount to withdraw.

  _recipient // Address that will receive the underlying asset.

  );

  ​

  emit YieldClaimed(owner(), _recipient, _collateralToken, _amountReturned);

  ​

  return _amountReturned;

  }

• Concerns:

  • The function is marked internal, but its invocation by owner can pose risks.

  • There are no timelocks, governance mechanisms, or user notifications involved when claiming the yield.

  • Owner can front-run transactions or withdraw significant accrued yield just before other users benefit.

Impact

1. Yield Extraction: The owner can drain all accrued yield, reducing the benefits to protocol users.

2. Front-Running Risk: If the owner observes a large pending transaction that generates a significant yield, they can withdraw the yield before the transaction is executed.

3. Trust Issues: Centralization of power and lack of safeguards may harm the protocol’s reputation and user trust.

Tools Used

• Code review and static analysis of the _claimYield function and related logic.

• Search for invocations of _claimYield to assess accessibility and privilege levels.

Recommendations

1. Introduce Timelocks: Add a timelock mechanism to delay yield withdrawals, ensuring fairness.

2. Governance Oversight: Require approvals from a decentralized governance process before the owner can call _claimYield.

3. Rate Limiting: Implement limits on how frequently the owner can withdraw yield to mitigate extraction risks.