Unwind Missing Validation of _asset vs unwindParams.debtToken

Description

• The flash loan callback receives _asset (the flash-loaned token) and decodes unwindParams containing debtToken.

• The contract never checks that _asset == unwindParams.debtToken. If params are mis-encoded or the wrong flash loan is initiated, the logic could use mismatched tokens.

• While _asset is used for repay and flash loan repayment (correct), unwindParams.collateralToken is used for withdraw and swap. A mismatch could lead to incorrect behavior or confusing failures.

Risk

Likelihood (low):

• The contract encodes params when initiating the flash loan; encoding bugs are rare.

• Only the owner can call unwindPosition.

Impact (medium):

• Mis-encoded params could cause wrong token flows, failed swaps, or incorrect accounting.

Severity (low):

Proof of Concept

The mismatch can occur if the owner passes inconsistent arguments to unwindPosition, or if a bug in the encoding layer produces params that do not match the flash loan. For example, a script or frontend might swap the order of _collateralToken and _debtToken, or the UnwindParams struct could be built from stale or wrong data.

The validation ensures that the token we receive from the flash loan (_asset) is the same token we expect to repay and that we encoded in params (unwindParams.debtToken). Without it, a mismatch produces confusing reverts (e.g. from the swap or from insufficient return amount) instead of an explicit "Asset mismatch" error at the start of the callback.

Recommended Mitigation

Add an explicit check immediately after decoding params. This provides defense-in-depth: even though unwindPosition uses _debtToken for both the flash loan and the params, the callback cannot assume they match—e.g. if the encoding logic changes, or if executeOperation is ever invoked through a different path. The check costs minimal gas and yields a clear, early failure with a descriptive message.

Rationale: _asset is the token Aave flash-loaned to the contract; it must be the debt token we intend to repay. unwindParams.debtToken is what the owner encoded when calling unwindPosition. Requiring them to match ensures we are operating on the intended token pair and prevents silent misuse or confusing downstream failures.