Vulnerability: Aave/Geist Interface declaration mismatch and unchecked return values
Severity: medium

Description:
The two lending providers, Geist & Aave, do not seem to be directly affiliated even though one is a fork of the other. However, the interfaces may likely diverge in the future. Using the same interface declaration for both protocols might become problematic with future upgrades to either protocol. The interface declaration does not seem to come from the original upstream project. The interface `IAaveLendingPool` does not declare any return values while some of the functions called in Geist or Aave return them.\\nNote: that we have not verified all interfaces for correctness. However, we urge the client to only use official interface declarations from the upstream projects and verify that all other interfaces match.\\nThe `ILendingPool` configured in `ProviderAave` (0xB53C1a33016B2DC2fF3653530bfF1848a515c8c5 -> implementation: 0xc6845a5c768bf8d7681249f8927877efda425baf)\\n```\\nfunction \\_getAaveProvider() internal pure returns (IAaveLendingPoolProvider) {\\n return IAaveLendingPoolProvider(0xB53C1a33016B2DC2fF3653530bfF1848a515c8c5);\\n}\\n```\\n\\nThe `IAaveLendingPool` does not declare return values for any function, while upstream does.\\n```\\n// SPDX-License-Identifier: MIT\\n\\npragma solidity ^0.8.0;\\n\\ninterface IAaveLendingPool {\\n function flashLoan(\\n address receiverAddress,\\n address[] calldata assets,\\n uint256[] calldata amounts,\\n uint256[] calldata modes,\\n address onBehalfOf,\\n bytes calldata params,\\n uint16 referralCode\\n ) external;\\n\\n function deposit(\\n address \\_asset,\\n uint256 \\_amount,\\n address \\_onBehalfOf,\\n uint16 \\_referralCode\\n ) external;\\n\\n function withdraw(\\n address \\_asset,\\n uint256 \\_amount,\\n address \\_to\\n ) external;\\n\\n function borrow(\\n address \\_asset,\\n uint256 \\_amount,\\n uint256 \\_interestRateMode,\\n uint16 \\_referralCode,\\n address \\_onBehalfOf\\n ) external;\\n\\n function repay(\\n address \\_asset,\\n uint256 \\_amount,\\n uint256 \\_rateMode,\\n address \\_onBehalfOf\\n ) external;\\n\\n function setUserUseReserveAsCollateral(address \\_asset, bool \\_useAsCollateral) external;\\n}\\n```\\n\\nMethods: `withdraw()`, `repay()` return `uint256` in the original implementation for Aave, see:\\nhttps://etherscan.io/address/0xc6845a5c768bf8d7681249f8927877efda425baf#code\\nThe `ILendingPool` configured for Geist:\\nMethods `withdraw()`, `repay()` return `uint256` in the original implementation for Geist, see:\\nhttps://ftmscan.com/address/0x3104ad2aadb6fe9df166948a5e3a547004862f90#code\\nNote: that the actual `amount` withdrawn does not necessarily need to match the `amount` provided with the function argument. Here's an excerpt of the upstream LendingProvider.withdraw():\\n```\\n// rest of code\\n if (amount == type(uint256).max) {\\n amountToWithdraw = userBalance;\\n }\\n// rest of code\\n return amountToWithdraw;\\n```\\n\\nAnd here's the code in Fuji that calls that method. This will break the `withdrawAll` functionality of `LendingProvider` if token `isFTM`.\\n```\\nfunction withdraw(address \\_asset, uint256 \\_amount) external payable override {\\n IAaveLendingPool aave = IAaveLendingPool(\\_getAaveProvider().getLendingPool());\\n\\n bool isFtm = \\_asset == \\_getFtmAddr();\\n address \\_tokenAddr = isFtm ? \\_getWftmAddr() : \\_asset;\\n\\n aave.withdraw(\\_tokenAddr, \\_amount, address(this));\\n\\n // convert WFTM to FTM\\n if (isFtm) {\\n address unwrapper = \\_getUnwrapper();\\n IERC20(\\_tokenAddr).univTransfer(payable(unwrapper), \\_amount);\\n IUnwrapper(unwrapper).withdraw(\\_amount);\\n }\\n}\\n```\\n\\nSimilar for `repay()`, which returns the actual amount repaid.

Impact:

Recommended mitigation:
Always use the original interface unless only a minimal subset of functions is used.\\nUse the original upstream interfaces of the corresponding project (link via the respective npm packages if available).\\nAvoid omitting parts of the function declaration! Especially when it comes to return values.\\nCheck return values. Use the value returned from `withdraw()` AND `repay()`