---
# System prepended metadata

title: AAVE FINDINGS

---

# AAVE FINDINGS


### 2.1 Critical

Not Found

### 2.2 High

Not Found

### 2.3 Medium

Not Found

### 2.4 Low

#### 1. Lost functions on update

##### Description

##### Recommendation

Some functions will not exist in new implementations:
delegateBySig()
delegateByTypeBySig()

But they existed in the previous implementations:
- https://etherscan.io/address/0x96f68837877fd0414b55050c9e794aecdbcfca59#writeContract
- https://github.com/bgd-labs/aave-stk-gov-v3/blob/1c67133ca44bf592fb3f2767ab9ce605493180b3/src/flattened/CurrentStakedAaveV3Flattened.sol#L1882

##### Recommendation

We recommend keeping these functions in order to stay backward compatible. These old function can use new delegation logic.


#### 2. getPowerCurrent() does not account for rebasing and slashing 

##### Description

`getPowerCurrent()` only returns the balance stored in `_userState[user].balance`
- https://github.com/bgd-labs/aave-a-token-with-delegation/blob/71e9c4ecf7bac1f3c4f42124e464786f498916cf/src/contracts/ATokenWithDelegation.sol#L39-L41

**For Aave token** - that is ok.

**For stkAave** - slashing can give a significant power boost for users who stake after slashing (`exchangeRate` will be a multiplier)
The adjustment is made externally in contracts not in the scope:
https://github.com/bgd-labs/aave-governance-v3/blob/1ee39df6de712d193c02dc7f0ac1e55bcff13048/src/contracts/voting/VotingStrategy.sol#L76-L78

**For aToken** - no adjustment is made for rebasing.
As a result, only a deposited amount is used for delegation, excluding returns. Users must withdraw and deposit again so that to increase their `_userState[user].balance`.
We suspect that it was made intentionally because it is hard to incorporate a rebase effect into `delegatedPropositionBalance` and `delegatedVotingBalance`

For now, `getPowerCurrent()` does not return the actual power now and should only be used as the argument in the following calculations.

##### Recommendation

We recommend having a function within token contracts that returns the actual power with no requirements for external calculations.



#### 3. Different nonce logic for two types of permit

##### Description

For permits in approvals, a current nonce should be used:
- https://github.com/bgd-labs/aave-token-v3/blob/ec80c6d41f7ef1e43f31dbcf4eca59e8c6bceb87/src/BaseAaveTokenV2.sol#L49-L72
But for permits in delegations, an incremented value from a current nonce is used:
https://github.com/bgd-labs/aave-token-v3/blob/ec80c6d41f7ef1e43f31dbcf4eca59e8c6bceb87/src/BaseDelegation.sol#L162

##### Recommendation

This is an inconsistent logic, and it is better when only one logic for permits is used





