Aave DIVA Wrapper

Summary

The contract uses approve for ERC20 tokens during collateral registration, which fails for tokens like USDT that require allowances to be reset to zero before approval. This breaks the registration process for critical assets.

Vulnerability Details

• In _registerCollateralToken, the contract calls:

  _collateralTokenContract.approve(_aaveV3Pool, type(uint256).max);

• USDT on Ethereum reverts on approve if the current allowance is non-zero. This causes the entire transaction to fail.

Impact

Collateral tokens requiring allowance reset (e.g., USDT) cannot be registered, rendering the protocol unusable for major stablecoins.

Tools Used

Manual review

Recommendations

Use safeIncreaseAllowance to handle allowance resets: