---
# System prepended metadata

title: Aave Audit

---

# Aave Audit



### Note:
1. Ray is 10 ** 27 - Check on potential underflows or overflows in its implementation.

### bridge.cairo


### There is no input validation when setting the reward token

The `set_reward_token` function is used to set the reward token as shown below
``` <
@external
func set_reward_token{syscall_ptr : felt*, pedersen_ptr : HashBuiltin*, range_check_ptr}(
        reward_token : felt):
    alloc_locals

    only_governor()

    rewAAVE.write(reward_token)
    return ()
end
```
However, there is no input validation ensuring that the right address is set and also preventing setting the address to 0 or the same address as the token address. 


### Implementation of `only_l1_handler ()` is insecure

If the `get_l1_bridge ()` is not initialized on the `only_l1_handler ()` then it means that the its `address == 0`.
```<
func only_l1_handler{syscall_ptr : felt*, pedersen_ptr : HashBuiltin*, range_check_ptr}(
        from_address_ : felt):
    let (expected_from_address) = get_l1_bridge()
    with_attr error_message("Expected deposit from l1_bridge: {expected_from_address}"):
        assert from_address_ = expected_from_address
    end
    return ()
end
```
This will potentially raise issues. 
**Recommendation**
Consider, initializing the `get_l1_bridge ()`.
