QA Report

[code423n4]

Low

Rounding-error can be redeemed for free

If the _redeemAmount is > 0 but less than the value of 1 share, 0 share will be burned while the user can withdraw non-zero amount.
https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L255

    uint256 _shares = _tokenToShares(_redeemAmount);

IERC20 is re-used

        - IERC20 (node_modules/@aave/core-v3/contracts/dependencies/openzeppelin/contracts/IERC20.sol#7-80)
        - IERC20 (node_modules/@openzeppelin/contracts/token/ERC20/IERC20.sol#9-82)

Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#name-reused

Non-Critical

Upgrade Solidity Version

Consider to pin Solidity version to latest 0.8.12

Use custom errors

Solidity ^0.8.4 allow the use of custom errors to optimize gas usage.
https://blog.soliditylang.org/2021/04/21/custom-errors/

Duplicated code

L337 can reuse _requireNotAToken in L348
https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L337
https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L348

Remove safeMath library

Solidity > 0.8.0 have safe math by default
https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L26

  using SafeMath for uint256;

[PierrickGT]

Rounding-error can be redeemed for free

Duplicate of #44

IERC20 is re-used

We prefer to use the one coming from the OpenZeppelin package.

Upgrade Solidity Version

Not possible since Aave V3 uses 0.8.10

Use custom errors

Duplicate of #13

Duplicated code

Duplicate of #4

Remove safeMath library

Duplicate of #11