Summary

The AaveDIVAWrapperCore contract does not account for the possibility of Aave reserves being frozen by Aave governance. If a collateral token (e.g., USDC) is frozen, users will be unable to withdraw their funds from Aave, leading to indefinite lockup of user funds.

Impact

Funds Locked Indefinitely: Users cannot access their collateral until the reserve is unfrozen, which could take an indefinite amount of time.

Proof of concept

Let's consider the following scenario :

1. A user deposits 100 USDC into the contract, which supplies it to Aave and mints 100 wUSDC.

2. Aave governance freezes the USDC reserve due to a security vulnerability.

3. The user attempts to redeem their 100 wUSDC for USDC.

4. The contract calls Aave's withdraw function, which reverts because the USDC reserve is frozen.

5. The user’s funds are locked indefinitely.

Recommendations

Check Reserve Status Before Withdrawals: Before attempting to withdraw collateral from Aave, check if the reserve is frozen using Aave's getReserveData function.