# Protocol doesn’t properly handle Aave Pool changes

setAavePool updates the pool address without re-approving tokens, so supply/withdraw on existing Aave-strategy pools revert, locking funds.

- Payout: Contest reward
- Severity: medium
- Program: Morpheus
- Credited: ZanyBonzy
- Disclosed: 2025-09-11
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-morpheus#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-morpheus%3AM-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:misconfiguration

**Target:** Distributor.sol capital-protocol contract (Aave strategy deposit pools)
**Root cause:** Token approvals to the Aave pool are set only once in addDepositPool; setAavePool changes aavePool without revoking old approvals or granting new ones, and isDepositTokenAdded blocks re-adding to re-approve.
**Steps:**
1. Deploy Distributor, add Aave-strategy deposit pool via `addDepositPool` (approves old aavePool max).
2. User calls `supply` — succeeds, aTokens minted.
3. Owner calls `setAavePool(newPool)`.
4. User calls `supply` again — reverts `ERC20: insufficient allowance` since newPool has 0 allowance.
5. User calls `withdraw` — also reverts; funds stuck.
**How found:** Code review of setAavePool and addDepositPool: noticed approvals only granted at pool-add time and never refreshed on pool change; confirmed via Foundry/Hardhat test showing revert after setAavePool.
**Exploitation:** Not an attacker-driven exploit; operational failure. After a legitimate Aave pool migration, all supply/withdraw/withdrawYield calls on existing Aave-strategy pools revert due to missing approvals to the new pool, while old pool retains max allowance. Funds locked until owner intervention.
**Insight:** When a contract caches an external protocol address that can be swapped by admin, audit every place that granted per-address allowances or cached per-address state — approvals and mappings keyed to the old address silently break after the swap.