RewardsController Emission Manager Can Authorize Users to Claim on Behalf of the AaveV3YieldSource Contract and Siphon Yield

Lines of code Vulnerability details Impact The AaveV3YieldSource contract allows the manager or owner of the contract to claim rewards from Aave's rewards controller. However, there is an external dependency on this periphery Aave contract such that the emission manager of the RewardsController...

Contract Can Be Bricked by Transferring a Large Amount of aTokens

Lines of code Vulnerability details Impact The supplyTokenTo function is executed when a yield source prize pool deposits tokens into Aave to generate yield. This contract uses an internal function called tokenToShares to calculate how many shares to mint on behalf of the to account. Because this...

An attacker can make users' funds get "locked" in the contract (the owner can get them out and transfer them back to the users)

Lines of code Vulnerability details Impact If a user manages to be the first user to deposit into the contract, he will be minted shares and he can steal all the other users' deposits. Proof of Concept 1. The attacker deposits 1 token into the contract and 1 share is minted to him totalSupply and...

Frontrun attack to steal first depositor money

Lines of code Vulnerability details Impact Frontrun attack to steal first depositor money Proof of Concept The flow is as following: 1. The first depositor wants to deposit X. 2. We detect it and frontrun 2 operations: 1. We deposit 1 of the underlying to the system. In exchange we receive 1 shar...

Yield source does not correctly calculate share conversions

Lines of code Vulnerability details The aTokens’ value is pegged to the value of the corresponding supplied asset at a 1:1 ratio and can be safely stored, transferred or traded. All yield collected by the aTokens' reserves are distributed to aToken holders directly by continuously increasing thei...

Missing support for ERC20 with fee

Lines of code Vulnerability details Impact Contract AaveV3YieldSource allows depositing tokens via supplyTokenTo function. Amount of tokens to transfer is based on passed argument depositAmount and is missing support for tokens with built-in fees. One of the popular tokens that implements such a...

Yield source cannot deposit fee-on-transfer tokens

Lines of code Vulnerability details Some ERC20 tokens, such as USDT, allow for charging a fee any time transfer or transferFrom is called. If a contract does not allow for amounts to change after transfers, subsequent transfer operations based on the original amount will revert due to the contrac...

User fund lose and DOS attack when totalSupply() is zero

Lines of code Vulnerability details Impact Hacker can do this two action: Perform a DOS attack and continuously deny users from supplying their tokens to YeildSource deposits less than a high amount will be rejected and attacker can control this amount, for example set it to 10K and every deposit...

Early Depositor can DOS Deposits

Lines of code Vulnerability details Impact A malicious, but generous, early depositor can DOS all future deposits. This is accomplished by directly sending aTokens to the AaveV3YieldSource.sol contract after making their first deposit. The amount of aTokens sent to the contract will manipulate th...

Lack of require in redeemToken could produce token loses

Lines of code Vulnerability details Impact Lack of require in redeemToken could produce token loses. Proof of Concept In the method redeemToken the user set the expected redeemAmount, it will compute the expected shares to burn, and after it, it will transfer the amout according the redeemAmount...