---
# System prepended metadata

title: aave findings Dan

---

# aave findings Dan




#### 1. Riskless leverage during the grace period

##### Description

The grace period was designed to give users some time to increase their health. 
- https://github.com/bgd-labs/aave-v3-factory/blob/07570f656ea4bd272c11823a309015e4bdb7b253/src/core/contracts/protocol/libraries/logic/ValidationLogic.sol#L526-L530

But also it can be abused as protection from liquidations - the whole grace period can be used as riskless time for more leverage, without the risk of being liquidated.

##### Recommendation

We recommend disallowing actions that decrease the health (new borrowings and withdrawals) during the asset grace period.

##### Status
**NEW**

##### Client's commentary
> Comment here






#### 2. No sanity checks on the grace period setup

##### Description

The grace period can be set to any value without validation:
- https://github.com/bgd-labs/aave-v3-factory/blob/07570f656ea4bd272c11823a309015e4bdb7b253/src/core/contracts/protocol/libraries/logic/PoolLogic.sol#L137

A longer grace period setup will leave markets with more bad debt risk. So, the hardcoded limits will allow managing that risk.

##### Recommendation

We recommend having an upper limit, e.g. 1 week from the current timestamp. 

##### Status
**NEW**

##### Client's commentary
> Comment here






#### 3. Frontrun griefing of isolated mode users.

##### Description

Imagine the following attack vector:

- STEP 1) UserA supplies an asset that is Isolated - CRV. UserA expects that this check will pass.
CRV will not automatically be used as collateral, so UserA will have to additionally call `Pool.setUserUseReserveAsCollateral()` later (STEP 3)

- STEP 2) FrontrunnerB supplies a small amount on behalf of userA. The asset is not among Isolated assets - e.g. WETH. This transaction is confirmed before supplying CRV by userA. So WETH will automatically used as collateral.
This check will return true for supplying WETH.
https://github.com/bgd-labs/aave-v3-factory/blob/07570f656ea4bd272c11823a309015e4bdb7b253/src/core/contracts/protocol/libraries/logic/ValidationLogic.sol#L718-L732

- STEP 3) UserA calls `Pool.setUserUseReserveAsCollateral()` for CRV.
But the call will fail and CRV will not be used as collateral as `validateUseAsCollateral()`:
https://github.com/bgd-labs/aave-v3-factory/blob/07570f656ea4bd272c11823a309015e4bdb7b253/src/core/contracts/protocol/libraries/logic/SupplyLogic.sol#L271-L277

As a result, UserA will not be able to use CRV as collateral. UserA will have to manually either get rid of aWETH or disable WETH as collateral. It is easy for EOAs, and less easy for smart-contracts that may not expect such problems.

##### Recommendation

We recommend automatically disabling previous collateralized assets if a user supplies an asset for the Isolated Mode so that this new asset is the only asset used as collateral (the requirement for the Isolated Mode).

##### Status
**NEW**

##### Client's commentary
> Comment here






#### 4. Setting isVirtualBalanceActive to false

##### Description

`setVirtualAccActive()` accepts both true and false as input.
- https://github.com/bgd-labs/aave-v3-factory/blob/07570f656ea4bd272c11823a309015e4bdb7b253/src/core/contracts/protocol/libraries/configuration/ReserveConfiguration.sol#L554

It is designed to switch only to `true`, because Pool and InterestRateStrategy logics work with virtual balances.
Setting to false will freeze virtual balances on current value and they will not change further, that was not designed.

##### Recommendation

We recommend disallowing setting `setVirtualAccActive` to `false`.

##### Status
**NEW**

##### Client's commentary
> Comment here

