F-2025-0012·missing-functionality

Aave module lacks reward-claiming functionality

Fixedvaultetfstrategyd2-contracts
TL;DR

Aave_Module lacks an IncentivesController integration. While the strategy successfully borrows and lends on Aave, any rewards accrued from those positions are permanently locked at the Aave incentives contract.

Severity
LOW
Impact
MEDIUM
Likelihood
LOW
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

D2's Aave integration in Aave_Module.sol exposes lending and borrowing functions but does not include any code path for claiming rewards. Aave deployments emit reward tokens (historically stkAAVE, currently per-market reward tokens through IncentivesController) for both suppliers and borrowers on supported markets.

The contract is missing both the interface definition for IncentivesController and the implementation that invokes it (claimRewards, claimAllRewards). Any rewards earned by the strategy's deposits or borrow positions therefore accumulate at the incentives controller and remain unclaimable from D2's side.

03Section · Impact

Impact

The absence of reward-claiming functionality has two consequences:

  1. Permanent Loss of Value

    • All rewards earned from lending and borrowing activities are effectively locked in the Aave protocol.
    • These rewards accumulate but remain inaccessible to both users and the protocol.
    • The value is permanently stranded unless reward-claiming functionality is added.
  2. Reduced Protocol Revenue

    • The protocol misses out on potential revenue streams from reward tokens.
    • Lost opportunity for treasury diversification through reward tokens.
04Section · Recommendation

Recommendation

To address this, consider implementing:

  1. Integration with Aave's IncentivesController to enable reward claiming.
  2. A reward distribution system that fairly allocates claimed rewards between users and the protocol.
  3. Regular automated claiming mechanisms to optimize reward collection.
05Section · Resolution

Resolution

D2: Fixed in d3f76bb.

Cyfrin: Verified.

Status
Fixed
Fix commit
d3f76bb
F-2025-0012