Aave V3 is a non-custodial, overcollateralized DeFi lending protocol deployed across 16+ chains, scoring 98/100 (green band) with 92/100 data confidence.
Security: Extensively audited by Trail of Bits, OpenZeppelin, PeckShield, Certora (formal verification), Sigma Prime, ABDK, MixBytes, Pashov, Enigma, Sherlock, and others across V3.0–V3.7; active Immunefi bug bounty up to $5M; core repository archived October 2025, increasing version-governance risk; findings/fix status for many reports not verifiable as of October 2026.
Incidents: April 2026 rsETH LayerZero bridge exploit created ~$123.7M bad debt (alternative estimates $177–280M) and triggered $8.45B withdrawal run; March 2026 CAPO oracle misconfiguration caused ~$862k liquidations (reimbursed); March 2023 USDC depeg ~$260–360k bad debt (resolved); June 2022 Harmony bridge ~$751k bad debt (unresolved); August 2024 Paraswap periphery ~$95k loss (resolved, no user impact).
Governance & custody: Real DAO governance via ARFC → Snapshot → on-chain AIP → timelock (1-day Short, 7-day Long Executor); 4-of-7 Protocol Emergency Guardian can pause/freeze (identities undisclosed); 5-of-9 Governance Guardian can cancel proposals; non-custodial user withdrawals subject to liquidity and health factor ≥1; no single-key drain path verified.
Top risks: Smart-contract exploit (despite audits), oracle/valuation error (demonstrated March 2026), bridge failure (demonstrated April 2026 rsETH), liquidation-driven bad debt under correlated collateral stress, cross-chain control failure, governance/privileged-role misuse; current chain-level exposure and TVL distribution not verifiable (Dune unavailable).
Strengths: Multi-year operational history since March 2022 (V3 launch), broad multi-chain footprint, formalized risk framework with continuous monitoring and stewards, governance-controlled upgrades limiting unilateral admin power, Portal cross-chain liquidity design, mature documentation and open-source codebase.
Unverified: Audit findings/fix status for most reports; deployed-code bytecode match for all chains; current per-chain exposure, largest collateral, borrower concentration, and Umbrella coverage; complete emissions curve and unlock schedule; final rsETH bad-debt allocation and user reimbursement status; regulatory classification (no binding determination found).
Recommended exposure: Conservative position sizing (≤5–10% of portfolio) given material unresolved bad debt, demonstrated bridge/oracle vulnerabilities, and incomplete on-chain verification; favor Ethereum Core over newer/smaller chains; monitor health factor >2, avoid recursive leverage, exclude subsidized APR from yield assumptions; verify reserve liquidity before large deposits; treat April 2026 incident as evidence of systemic bridge/collateral risk requiring ongoing due diligence.
Open questions: Verify current per-chain TVL, bad-debt status, and Umbrella coverage via independent on-chain query; confirm bytecode match for all in-scope deployments; review latest audit reports for unresolved critical/high findings; assess rsETH final loss allocation and DAO treasury adequacy; evaluate bridge-route compliance with post-incident framework (≥3 DVNs, timelocks, rate limits); confirm governance Guardian signer identities and operational security; stress-test largest borrower insolvency and correlated collateral scenarios per chain.
Score
Component
Weight
Raw
Points
Reason
Security
20%
100
20.0
47 audit(s); fresh audit bonus; active bug bounty bonus
Audits
20%
100
20.0
full audit within 365 days (latest 2026-03-31)
Incidents
20%
100
20.0
2 open incident(s), $124,459,727 at risk = 2.3% of TVL (threshold 10%)
Governance
20%
90
18.0
DAO governance; no single party can withdraw funds
TVL
20%
100
20.0
TVL $5,521,982,199 = 100% of reference ($5,521,982,199)
Launch: initial V3 deployment in March 2022 across six networks; Ethereum Core deployment on 27 January 2023.
Native/governance token:AAVE. V3 has no separate chain-native protocol token; GHO is a related Aave stablecoin, not the governance token.
Chains in the requested scope: Aptos, Arbitrum, Avalanche, BSC, Base, Celo, Ethereum, Gnosis, Linea, Mantle, MegaETH, Monad, OP Mainnet, Plasma, Polygon and Xlayer. The current official deployment page confirms several of these, but does not list every supplied chain; therefore the complete scope mapping is Not verifiable as of 4 October 2026. Contracts and verification The canonical Ethereum V3 addresses are:
Pool proxy:0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2 Both are cross-referenced by the Aave Address Book, Aave governance documentation and Etherscan; Etherscan reports exact-match verified source code for both. Full per-chain address verification with the required Dune cross-check: Not verifiable as of 4 October 2026 (Dune MCP unavailable; no on-chain claim is inferred). Fork lineage Aave V3 is not an unaffiliated fork; it is Aave’s independently developed successor to V2, using a separate, non-compatible contract set. Major changes include Efficiency Mode, Isolation Mode, supply/borrow caps, Portal cross-chain liquidity movement, and L2-specific functionality. Aptos required a substantial Move-language rewrite rather than an EVM code copy. The V3 codebase and subsequent upgrades were subjected to audits and formal verification by OpenZeppelin, Trail of Bits, PeckShield, ABDK, Sigma Prime and Certora, among others. Evidence of malicious modifications in comparable Aave forks: Not verifiable as of 4 October 2026.
maturity
unverified
Aave V3 appears to be a real, mature product rather than a landing page. The app is live and shows active market surfaces, including explicit market pages such as Ethereum and Base, and the main app advertises deposits, loans, market size, and available liquidity rather than placeholder metrics. The product UX is functional enough to support deposit/withdraw flows, and the FAQ states withdrawals are executed through the V3 interface or directly via protocol smart contracts.
The documentation is also substantial and product-grade: it includes Aave v3 getting-started guides, market data hooks, and developer surfaces for React, TypeScript, and GraphQL. The docs explicitly say the protocol exposes a GraphQL API at api.v3.aave.com/graphql, which works as a playground and supports querying market data, user positions, and transaction-related actions. That is a clear open API surface, not just static marketing content.
The official GitHub organization is active and lists the Aave SDK and interface repositories, which is consistent with an operating software product rather than a template site. The app disclosures also describe the Aave App as software and explain deposit/withdraw mechanics for supported stablecoins, reinforcing that the portal is intended for real usage. No obvious broken-link or fake-metrics evidence was surfaced in the retrieved pages.
Not verifiable as of 2026-10-04 for a comprehensive broken-link audit.
Security
bug bounty
unverified
Aave V3 has an active bug bounty program. The core Aave V3 bounty is hosted on Immunefi and was live since 2023-10-18. Publicly stated parameters include: Critical up to $1,000,000 historically, later updated on Aave’s security page to up to $5,000,000; High $10,000 to $75,000; Medium $10,000; Low $1,000.
The scope covers Aave V3 among other Aave systems, and rewards are paid in AAVE and stablecoins. Disclosed results are not clearly enumerated in the retrieved sources, so results are Not verifiable as of 2026-10-04.
Active
Yes
Platform
Immunefi
Max payout
$5.0M
Since
2023-10-18
counterparty risks
unverified
Assessment date: October 5, 2026. Dune MCP was unavailable; therefore all current on-chain exposure, TVL, chain allocation, and percentage calculations are Not verifiable as of October 5, 2026. Dependency risk: High and multi-layered. Aave V3 depends on Chainlink and asset-specific/internal exchange-rate oracles; LST/LRT, stablecoin, and vault-token risks include stale, manipulated, or incorrect redemption/exchange-rate data. V3 mitigants include supply/borrow caps, isolation/siloed mode, conservative LTVs, freezes, and emergency governance controls, but these remain configuration-dependent. Bridges: Material risk was demonstrated by the April 18, 2026 rsETH incident.
A LayerZero route using a 1-of-1 DVN accepted a forged message, releasing 116,500 rsETH without a corresponding source-side burn. Aave reported 89,567 rsETH supplied against approximately $193 million of borrowing across Ethereum and Arbitrum attacker positions. Aave froze rsETH/wrsETH markets across multiple deployments.
Aave’s subsequent framework now requires route disclosure, at least three independent verifiers, timelocks, pause paths, and rate limits; this is a proposed/operational framework, not proof that every listed asset currently satisfies it. External counterparties and recovery: The rsETH shortfall depended on Kelp, LayerZero, the Arbitrum Security Council, Aave/Compound liquidations, ecosystem donors, and Mantle credit. The April 24 recovery proposal reported approximately 75,081 ETH of residual funding need and requested a 25,000 ETH Aave DAO treasury contribution; recoveries were partly illiquid and dependent on third parties. Current resolution status is Not verifiable as of October 5, 2026. Stablecoin/LST/restaking exposure: USDe borrowing/carry activity was present across Ethereum Core, Avalanche, Mantle, Monad, and Plasma; August 2026 parameter changes raised USDe base rates from 0% to 1%, indicating active monitoring but not elimination of depeg or Ethena-related risk. Custodians, CEX/MM exposure, RWA issuer/SPV exposure: Not verifiable as of October 5, 2026. > Contradiction / limitation: Protocol risk controls and framework requirements do not establish actual current exposure.
The on-chain figures and maximum exposure percentage cannot be independently confirmed in this run. dependency_failure_active: null max_exposure_pct: null
crypto custody
unverified
Aave V3 is organized as a non-custodial protocol: users supply assets from their own wallets, receive aTokens representing the supplied position, and withdraw by redeeming those aTokens for the underlying asset to themselves or a chosen receiver; the protocol documentation says withdrawals burn the equivalent aTokens and transfer the underlying asset out. The FAQ also states that no central entity can freeze or alter individual user positions, while the EmergencyAdmin role can only pause specific reserves for risk management at the reserve level, not seize or directly manage user funds. Withdrawal is therefore not paused at the protocol level in the general sense; it is subject to reserve liquidity and collateral constraints, not a centralized custody freeze.
Withdrawal paused
No
Segregated assets
No
key management
unverified
Key-management organization — Aave V3 (verified/rechecked October 4, 2026)
Primary authority: Aave DAO governance. Governance V3 is Ethereum-anchored: proposal validation and voting power are handled on the Core Network, while approved payloads are delivered to separate Execution Networks for each supported chain. Payload execution is permissionless after the execution-network timelock; an operator key is not required to press the final execution transaction.
Per-market role segregation. Each V3 deployment uses PoolAddressesProvider plus ACLManager. The ACL defines DEFAULT_ADMIN, POOL_ADMIN, EMERGENCY_ADMIN, RISK_ADMIN, FLASH_BORROWER, BRIDGE, and ASSET_LISTING_ADMIN. Pool configuration functions enforce these roles separately, limiting routine parameter changes, emergency actions, risk changes, and listings to distinct authorities.
Governance execution keys. Governance Executors control high-impact administration, including governance, payload-controller, cross-chain, and upgrade-related permissions. Governance Guardians provide a separate veto/cancellation backstop for malicious or erroneous proposals and payloads. The latest governance process documentation describes both Protocol and Governance Guardians as 5-of-9 multisigs; an August 2026 signer-rotation proposal states that the Governance Emergency Guardian retained its 5-of-9 threshold and Safe addresses.
Emergency and operational access. Protocol Guardians hold emergency-admin powers and can pause or otherwise protect markets; Governance Guardians can cancel proposals. Some bounded operational authority is delegated to stewards or service providers, but these permissions are constrained by the relevant contracts and governance-approved scope. > Correction to the prior finding: Governance V3’s core-side queue is not itself timelocked; the documented delay is enforced by each Execution Network’s PayloadsController. Execution remains permissionless after that delay. On-chain verification gap: Current role holders, Safe signer sets, thresholds, and upgrade authorities for every listed chain are Not verifiable as of October 4, 2026 because Dune MCP was unavailable in this run. The permissions-book outputs are indexed analytics, not raw on-chain verification.
smart-contract
unverified
Assessment (as of October 5, 2026): Medium–High upgrade/freeze/oracle risk; low direct-rug risk.Addresses / verification. Ethereum anchors remain PoolAddressesProvider 0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e, Pool 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2, PoolConfigurator 0x64b761D848206f447Fe2dd461b0c635Ec39EbB27, Oracle 0x54586bE62E3c3580375aE3723C145253060Ca0C2, and ACL admin 0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A. The maintained address book also lists current Ethereum implementations. For Aptos, Arbitrum, Avalanche, BSC, Base, Celo, Ethereum, Gnosis, Linea, Mantle, MegaETH, Monad, OP Mainnet, Plasma, Polygon and Xlayer: Not verifiable as of October 5, 2026 for complete live address, explorer-verification, role-membership and implementation status. Architecture / upgradeability. Pool and PoolConfigurator are proxies controlled through the owner of PoolAddressesProvider.
Its owner can replace implementations, oracle, ACL manager/admin, sentinel and data-provider addresses. The proxy’s admin is effectively the PoolAddressesProvider, not a separately identified transparent ProxyAdmin. The permissions book identifies Ethereum governance Executor L1 as the controlling owner and lists Pool/Configurator upgrades as Governance actions. ``text AAVE DAO vote ↓ governance timelock / Executor L1 (and L2 for stricter actions) PoolAddressesProvider (owner) ├─ Pool proxy → Pool implementation ├─ PoolConfigurator proxy → configuration/pause logic ├─ AaveOracle / Sentinel └─ ACLManager → Pool/Risk/Asset-listing/Emergency roles `` Roles and controls. Pool/Risk/Asset-listing admins can change reserve parameters, caps, collateral settings, interest-rate strategies and oracle sources; Emergency Admin can pause reserves/pool.
These controls can freeze borrowing, withdrawals or liquidations in selected conditions, but do not directly transfer user balances. ACL roles are not renounced in the canonical design. Users can normally exit by withdrawing/repaying while markets remain solvent and unpaused. Timelock. Aave documents 1-day standard and 7-day governance timelocks; exact per-chain delay measured from decoded on-chain events: Not verifiable as of October 5, 2026. Worst case. Compromise of governance Executor/timelock authority could upgrade Pool/Configurator or replace oracle/ACL components, enabling theft through malicious logic, insolvency via oracle manipulation, or broad freezes.
A compromised emergency role is primarily a freeze risk. Contradiction callout: Protocol marketing says governance is required for changes; source code confirms the practical authority is the Provider owner/Executor. No contradictory on-chain metric can be checked because Dune is unavailable. Fields: admin_can_drain=false; audited_deployment=true; upgradeable=true; unresolved_critical=null; unresolved_high=null.
Aave V3 is the current iteration of a real, long-running DeFi lending ecosystem, not a web-only front. Its identifiable founder is Stani Kulechov, who founded ETHLend in 2017 and led its 2020 relaunch as Aave. He remains the public CEO and principal spokesperson of Aave Labs.
Founder and prior outcomes: Kulechov is Finnish and legally trained. ETHLend conducted an ICO of approximately $16–17 million, after which the project moved from peer-to-peer lending to pooled liquidity and migrated LEND into AAVE. Aave Labs also developed or contributed to GHO and Lens, although those are separate products from Aave V3.
Team visibility: Kulechov is public; the broader operating team is not fully anonymous. Publicly identified senior personnel include finance, legal/compliance, engineering, marketing, and strategy executives. Earlier reporting described an approximately 20-person London-based team with development and research/support functions.
Credibility: The strongest credibility indicators are longevity since 2017, sustained public leadership, substantial external attention, open governance, repeated independent security work, and continued operation across multiple chains. These establish an identifiable operator and meaningful execution history, but do not eliminate smart-contract, oracle, governance, or market risks.
Security history: Aave has experienced material incidents, including the 2022 CRV-related attack involving Avi Eisenberg and earlier oracle-related issues. Public secondary reporting describes approximately $1.6 million of bad debt in the CRV incident and subsequent containment/reimbursement measures. Incident details and loss figures should not be treated as on-chain verified here.
Office and jurisdiction: Public company information identifies a London presence, including an Aave Labs location at 9 Pembridge Road, London. A UK Companies House record also lists an active AAVE LIMITED and Kulechov-related directorship information. This supports a real operating footprint, but does not prove that every protocol contributor or DAO asset is held by that entity.
Onshore/offshore: Aave Labs has a UK/London operating footprint. Separately, an October 2026 governance proposal reportedly seeks a Cayman Islands foundation company to hold Aave-related intellectual property for the DAO; this is a proposed legal structure, not evidence that Aave V3 itself is an offshore company. Reality-check limitations: On-chain verification, exact current personnel, beneficial ownership, treasury figures, and the precise legal relationship between Aave Labs, AAVE LIMITED, the DAO, and any proposed Cayman foundation are Not verifiable as of 2026-10-04. Claims sourced only from Aave’s own materials are treated as unverified marketing claims.
general reputation
two sources
Reputation assessment: materially mixed and recently impaired. Aave remains one of DeFi’s most extensively reviewed lending protocols, with audits and formal-verification work attributed to Trail of Bits, PeckShield, Certora, Oxorio, Spearbit and others, plus an Immunefi bug bounty. However, audit coverage is not evidence that deployed contracts or every listed market are risk-free. Security and incident record
Independent reporting describes an April 2026 KelpDAO/LayerZero exploit that created unbacked collateral, drained genuine wETH through Aave markets, and left estimated Aave bad debt of roughly $123.7 million; other reports put exposure between $177 million and $280 million, so the final loss figure is inconsistent across sources.
The same event reportedly triggered an $8.45 billion withdrawal run and required an emergency response involving DAO assets and a founder contribution. This indicates meaningful contagion, oracle/listing, liquidity and governance risks even if Aave core contracts were not directly exploited.
A separate report describes approximately $305,000 drained from two Safe multisig wallets through a third-party adapter, while reporting that Aave V3 itself was not impacted.
A March 2026 oracle incident reportedly caused about $27 million in abnormal liquidations, while a separate CAPO configuration incident involved approximately $862,000, reportedly returned. These figures are from secondary reporting and were not independently verifiable on-chain in this review. Governance, management and sentiment
Criticism has focused on centralization, governance friction, financial transparency and accountability. Secondary reporting says BGD Labs and Aave Chan Initiative participants left or criticized the ecosystem, while Marc Zeller alleged that Aave Labs mishandled or spent $5.5 million without proper governance approval; these allegations are not established facts.
Aave’s own security materials report no confirmed critical or high-severity findings from a stated AI review, but this is a protocol-origin claim and should be treated as an unverified marketing claim, not independent validation. Legal, regulatory, sanctions and insolvency allegations
Fraud, rug-pull, sanctions or criminal/regulatory enforcement findings were Not verifiable as of October 10, 2026 from the reviewed sources.
Insolvency allegations are contradicted by the reporting that Aave survived the 2026 crisis, but the alleged bad debt and emergency support represent an unresolved credit-loss and governance concern. Scope limitation: Dune/on-chain verification was unavailable; therefore chain-by-chain exposure, current TVL, deployment-specific audit status and all quantitative incident figures are Not verifiable as of October 10, 2026. The search also did not independently establish a complete investor roster or verify every named auditor against original reports.
Economy
TVL: $5.4B
model
two sources
Strategy / assets in-out. Aave V3 is non-custodial, overcollateralized lending: users supply supported assets and receive interest-bearing aTokens; borrowers post collateral and receive other supported assets or stablecoins. Supplier yield is primarily organic borrower interest, net of the reserve factor—not trading, staking, or external investment returns. Incentive programs can add subsidized APR and should be excluded from organic yield. Exposure. Supplier exposure is generally asset-specific and not fully market-neutral because token prices and liquidity affect USD value and withdrawal capacity.
Borrowers may be directional. Aave does not inherently loop, restake, or lever assets, but users can recursively supply/borrow, use E-Mode, or employ flash loans to create leverage. E-Mode and isolation/siloed borrowing create additional concentration and correlation risks. Lock-ups / withdrawals / limits. No protocol lock-up; withdrawals are permissionless subject to available unborrowed liquidity and maintaining Health Factor ≥1.
Governance-defined supply caps, borrow caps, LTVs, liquidation thresholds, debt ceilings, reserve factors, pauses, and asset-specific restrictions apply. Liquidation is permissionless when Health Factor falls below 1. Fees / revenue. Main protocol revenue is the reserve factor on borrower interest, plus portions of liquidation, flash-loan, and other configured fees. DeFiLlama currently reports Aave V3 TVL of $18.412B, active loans of $12.641B, 30-day fees of $36.27M, and protocol revenue of $4.64M; Ethereum represents 84.4% of TVL.
TVL is reported up 6.7% over 30 days. Chain-level split (stale, crawled ~3 weeks ago): Ethereum $14.55B, Base $511.6M, Plasma $491.5M, Arbitrum $487.1M, Monad $333.1M, Avalanche $259.6M, BSC $186.7M, Polygon $137.1M, with the remainder across smaller deployments. APY sustainability. DeFiLlama shows average supply APY of 1.72% across 182 pools; rates are utilization-driven and therefore volatile. Historical APY volatility and a defensible organic-yield percentage are Not verifiable as of October 5, 2026.
Dune/on-chain TVL reconciliation is Not verifiable as of October 5, 2026. Structured fields: organic_yield_pct = null; leverage_ratio = null.
reserves
unverified
As of October 6, 2026: Scope. Aave V3 Pool reserves are user-supplied lending assets, not DAO treasury assets. Reserve-factor income is accrued to chain-specific Collector contracts and periodically managed through governance-controlled treasury infrastructure. Exact on-chain balances and chain-by-chain exposure via Dune: Not verifiable as of October 6, 2026. Size and composition. Aave Insights/TokenLogic currently reports $269.03M gross treasury assets, excluding liabilities: $39.32M stablecoins, $53.50M ETH/BTC, $166.52M AAVE, and $9.69M other assets.
This is a dashboard/service-provider disclosure, not an independent attestation. The February 2026 DAO funding disclosure separately reported >$100M non-AAVE assets, >$50M stablecoins, and approximately $39.9M ETH-correlated assets; figures are not directly comparable because of timing, valuation, and scope differences. Addresses and custody. The June 2026 treasury architecture identifies budget/asset-holding SAFEs including APE 0xAA43203167317DeeF8288095C44b84a686918d2E, ALC 0xA1c93D2687f7014Aaf588c764E3Ce80aF016229b, AHAB 0xAA2461f0f0A3dE5fEAF3273eAe16DEF861cf594e, AFC 0x22740deBa78d5a0c24C58C740e3715ec29de1bFa, Aave Rewards 0x66Ac7223048037826e12cef9a848199e31AEFabE, CEX Earn 0xAA12BAd4a501d45A5b771e49C2Fd415BA8BFc79d, and Aave v4 Security 0xAAf400e4Bbc38B5E2136C1a36946Bf841A357307. The proposal describes seven active asset-holding SAFEs, each using 2-of-3 organisation-controlled nested SAFEs; operational wallets receive capped, just-in-time allowances and are not intended to hold idle treasury.
Individual organisational signer identities are intentionally undisclosed. Control and policy. The AFC SAFE administers Snapshot and operates as a 2-of-3 organisation-controlled multisig. Finance Stewards execute pre-approved swaps, pool exposure, and budget transfers within whitelists, spending caps, slippage controls, and minimum reserve floors; governance retains ownership and revocation authority. Risk documentation describes reserve factors as asset-risk calibrated; the referenced framework indicates roughly 10%–35% ranges. Attestations. No independent DAO treasury proof-of-reserves or custody attestation was located. Not verifiable as of October 6, 2026. Aave reports SOC 2 Type II and says the attestation letter is available on demand, but this is not a treasury-reserve attestation. Contradiction / data-quality callout: The current dashboard’s $39.32M stablecoin figure is below the February disclosure’s “>$50M”; the discrepancy is unresolved because no underlying wallet-level reconciliation or Dune snapshot is available.
Liquid reserves usd
$269.0M
tokenomics
one source
AAVE tokenomics — as of October 4, 2026
Native token: Aave (AAVE). Canonical Ethereum ERC-20: 0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9. AAVE representations exist on other listed chains; a complete chain-by-chain address inventory is Not verifiable as of October 4, 2026.
Supply/valuation: Maximum and stated total supply are 16,000,000 AAVE. CoinGecko currently reports approximately 15.435M circulating, $2.784B market cap, and $2.885B FDV; these are aggregator figures, not on-chain verified.
Utility/governance: AAVE, stkAAVE and aAAVE balances confer voting power in Aave governance. Governance controls protocol parameters, deployments, treasury actions and Umbrella configuration.
Revenue share/buybacks/burns: Protocol revenue accrues to the DAO treasury rather than automatically to AAVE holders. Aavenomics authorized treasury-funded secondary-market buybacks and redistribution to the ecosystem reserve; buybacks were formally paused from April 19, 2026 after the rsETH bridge incident. No permanent automatic burn or holder revenue share was verified.
Staking/rewards: Legacy Safety Module supports AAVE staking, with slashing risk. The newer Umbrella primarily stakes aTokens and GHO; rewards may be configured in AAVE, GHO, USDC or other tokens.
Emissions/unlocks: Governance has reduced legacy AAVE safety-module emissions, while Umbrella emissions are governance-configured. A complete current emissions curve, allocation table, vesting schedule, and confirmation that every announced unlock occurred on-chain are Not verifiable as of October 4, 2026.
Allocations: Team, investor, treasury and community allocation percentages are Not verifiable as of October 4, 2026 from sufficiently independent current evidence.
Concentration/insiders: Top-holder concentration, identifiable insider wallets and chain-by-chain exposure are Not verifiable as of October 4, 2026 because Dune/on-chain execution was unavailable.
Contract controls: Mint, blacklist, fee-switch and administrative-control status are Not verifiable as of October 4, 2026 without direct contract-state/on-chain verification.
DEX liquidity/listings: Main venues include Uniswap and major centralized exchanges, but current DEX depth and slippage by venue are Not verifiable as of October 4, 2026. Contradiction: The prior September 4, 2026 snapshot recorded lower market cap/FDV; current CoinGecko data is higher. The current aggregator reading supersedes the stale snapshot, but remains non-on-chain evidence.
A Bitcoin price collapse below $10,000 would create severe liquidation and bad-debt risk for Aave V3 positions using BTC-linked collateral, but the protocol-wide loss cannot be quantified from the available evidence. On-chain verification of BTC-linked collateral, debt, liquidation exposure, and per-chain TVL is Not verifiable as of October 10, 2026 because on-chain data access was unavailable. Stress transmission
Falling BTC collateral reduces borrowers’ health factors; positions become liquidatable when the health factor falls below 1. Liquidators repay debt and receive collateral at a discount.
If BTC falls faster than liquidators can execute, or market liquidity is insufficient, collateral may not cover debt and bad debt can result.
Aave V3’s variable close factor permits up to full liquidation when health factor is at or below 0.95, increasing the speed at which distressed positions can be resolved but potentially intensifying market selling.
BTC-linked assets are explicitly treated as volatile collateral in Aave’s risk methodology; liquidation thresholds and loan-to-value limits are the primary buffers. Material risk channels
Direct collateral loss: WBTC, BTC-related tokens, and any native-Bitcoin integration would lose value sharply.
Correlated collateral: BTC, ETH, and other crypto collateral could decline together, reducing liquidation proceeds and worsening bad-debt risk.
Liquidity and oracle stress: A discontinuous crash could produce slippage, oracle delays, or insufficient liquidator liquidity, undermining orderly liquidations.
Cross-chain fragmentation: Exposure must be assessed separately for Aptos, Arbitrum, Avalanche, BSC, Base, Celo, Ethereum, Gnosis, Linea, Mantle, MegaETH, Monad, OP Mainnet, Plasma, Polygon, and Xlayer. Chain-by-chain BTC collateral and debt shares are Not verifiable as of October 10, 2026. > Contradiction / data gap: No independently verified on-chain exposure figure was available. Any claimed protocol-wide BTC exposure, TVL, or potential loss should therefore be treated as unverified rather than used in the stress estimate. The appropriate institutional conclusion is a tail-risk event with uncertain magnitude: Aave’s liquidation design provides procedural protection, but it does not eliminate bad debt during an extreme, rapid BTC repricing.
stress scenario - largest collateral depegs 20%,
two sources
Stress conclusion: A 20% fall in the largest collateral asset on each Aave V3 deployment would reduce that asset’s USD collateral value and users’ health factors, potentially triggering liquidations. Positions with health factor below 1 become liquidatable; liquidators repay debt and receive collateral at a liquidation bonus. The exact exposure, largest collateral by chain, liquidation volume, bad-debt impact, and each chain’s share of total exposure are Not verifiable as of 2026-10-05 because on-chain verification was unavailable in this run.
Aave’s health factor is determined by collateral value, weighted liquidation thresholds, and debt value. A 20% collateral shock does not imply a uniform 20% health-factor decline: the effect depends on the collateral asset’s share of each account, other collateral, debt denomination, and applicable risk parameters. Transmission and containment mechanisms
Liquidations may impose liquidation bonuses and realize losses if collateral liquidity is insufficient or prices gap further.
Aave V3 supports variable close factors, allowing more aggressive liquidation as a position approaches insolvency; on L2s, the price-oracle sentinel can temporarily restrict liquidations after oracle or sequencer disruption.
Oracle failure or incorrect valuation is a material residual risk. Aave relies on third-party feeds, principally decentralized oracle infrastructure, while governance can adjust LTVs, liquidation thresholds, and other parameters.
A 20% shock can create bad debt where collateral liquidation proceeds—including the liquidation bonus and slippage—are insufficient to cover outstanding debt. The amount is Not verifiable as of 2026-10-05. Chain coverage: The requested deployments are Aptos, Arbitrum, Avalanche, BSC, Base, Celo, Ethereum, Gnosis, Linea, Mantle, MegaETH, Monad, OP Mainnet, Plasma, Polygon, and Xlayer. Largest collateral, TVL/exposure by chain, and percentage allocation are Not verifiable as of 2026-10-05. DeFiLlama identifies Ethereum and Plasma as substantial Aave V3 deployments, but its available data is an analytics-platform snapshot rather than raw on-chain collateral composition. > Contradiction / evidence gap: No independently verifiable on-chain figures were available to compare against previously recorded exposure assumptions. Therefore, no claimed collateral ranking or stress-loss estimate is adopted.
stress scenario - top counterparty insolvent — each with expected loss path, who absorbs it, compensation, and the impact path through the smart contracts;
two sources
## Stress scenario: top borrower/counterparty becomes insolvent Scope limitation. Chain-by-chain identification of the largest borrower, exposure, and current Umbrella coverage is Not verifiable as of October 4, 2026. Dune was unavailable, so no on-chain query or execution IDs can be provided. Do not assume identical protection across Aptos, Arbitrum, Avalanche, BSC, Base, Celo, Ethereum, Gnosis, Linea, Mantle, MegaETH, Monad, OP Mainnet, Plasma, Polygon, and Xlayer. ### Expected loss path 1. Health-factor breach: collateral prices fall, debt rises, or an oracle/market event makes the account’s health factor <1.
A liquidator calls Pool.liquidationCall, repays eligible debt, and receives collateral at the liquidation bonus. 2. Residual bad debt: if all collateral is exhausted but debt remains, Aave V3.3 burns the remaining variable-debt tokens and records the unpaid amount as the reserve’s deficit; interest no longer accrues on that liability. 3. Backstop activation: Umbrella monitors the affected asset–pool–network reserve.
Its corresponding StakeToken can be slashed, transferring coverage assets to the Collector; a separate authorized transaction then covers/eliminates the reserve deficit. Coverage is not cross-network. 4. Residual loss: if the deficit exceeds available reserve-specific Umbrella stake, the remainder stays uncovered.
The economic loss is then borne by liquidity providers through impaired backing/redemption of the affected reserve’s aTokens; there is no guaranteed supplier indemnity. ### Who absorbs it / compensation
First: liquidator absorbs execution and market risk but receives the liquidation bonus.
Next: configured deficit offset/DAO-funded amount, where applicable; parameters are reserve- and network-specific.
Then: Umbrella stakers absorb losses through slashing, in exchange for safety incentives and continuing underlying yield until slashed.
Final layer: uncovered loss remains with suppliers; the Treasury may act as a secondary reserve, but this is not an automatic, universal guarantee. Contract impact:liquidationCall transfers/burns collateral and burns debt; bad-debt cleanup increments ReserveData.deficit; Umbrella slashing and eliminateReserveDeficit reduce that deficit by burning/disposing of matching aTokens or underlying assets.
stress scenario - committed fraud by the DAO or owners
two sources
Assessment: no verified finding that the Aave DAO or its owners committed fraud. The available search results show allegations and disputes, but no identified regulator or court finding establishing fraud by the DAO, Aave Labs, or founder Stani Kulechov. On-chain verification is unavailable in this run; therefore, ownership, fee-routing, voting-power, and treasury claims are not independently verified. Not verifiable as of October 10, 2026. A February 2026 governance dispute alleged that Aave Labs redirected approximately 15–25 basis points of partner-fee revenue to a Labs-controlled address without a governance vote, and questioned proposed transfers of $42.5 million and 75,000 AAVE. These are allegations in a governance conflict, not an adjudicated fraud finding.
A separate report described allegations that a developer misappropriated $5.5 million without proper governance approval. The search result does not establish the allegation’s evidentiary basis, legal status, or that the conduct constituted fraud. The April 2026 rsETH incident was reported as an external bridge exploit in which attackers used unbacked collateral on Aave, creating bad debt.
The available evidence characterizes Aave as a downstream victim or risk-exposure point, not as the perpetrator of the exploit. A prior SEC investigation was reported as closed without enforcement in December 2025; this is secondary reporting and was not independently confirmed here. Stress conclusion: treat DAO/Labs governance, conflicts-of-interest, fee-routing, and treasury-allocation allegations as an unresolved governance and control risk—not as committed fraud. No regulator, court, audit, or independent forensic source located in this check substantiates fraud by Aave’s DAO or owners. Not verifiable as of October 10, 2026.
Finding — primary yield source negative over 30 days: Not verifiable as of 2026-10-04. On-chain verification was unavailable for this run, so no query ID or execution ID exists; no negative 30-day yield should be inferred. Available independent analytics do not establish a protocol-wide negative result:
DeFiLlama reports 212 tracked Aave V3 pools and a positive average APY of 1.3%; its result does not provide a protocol-wide 30-day yield series.
Aavescan displays reserve-level lending rates and 30-day borrow-rate sparklines, but the surfaced result does not establish a negative 30-day supply/yield outcome across Aave V3.
StablecoinBeat reports positive current rates for sampled Aave V3 markets: approximately 3.05%–3.72% for selected Arbitrum and Ethereum pools.
De.Fi shows mixed reserve-level 30-day results, including approximately 0% for a cbBTC pool and positive results for WETH and USDe; these are not sufficient to define the primary yield source for the entire protocol. Risk interpretation: The prior unresolved finding remains unchanged. A negative 30-day primary yield signal is not demonstrated by the available evidence. Reserve-level yields can be zero or vary materially by chain and asset, but chain-by-chain exposure and the protocol-wide primary yield cannot be verified without reproducible on-chain data. Contradiction check: No verified protocol claim of a negative 30-day yield was found. Positive aggregator snapshots conflict with any generalized negative-yield interpretation, but they are analytics-platform data rather than raw on-chain verification.
Governance & Legal
governance
unverified
Assessment as of October 13, 2026: Aave V3 has real, operational DAO governance, not merely symbolic control. Aave Labs controls core development, growth, documentation, and the canonical frontend as a service provider, but its Terms state that it does not own, operate, or control the on-chain protocol. Proposal process: forum ARFC and service-provider risk/technical review → Snapshot where required → on-chain AIP vote → cross-chain delivery/queueing → executor timelock → permissionless execution. Governance Framework v2 states that the Short Executor generally handles routine parameters and treasury operations with a 1-day timelock; the Long Executor handles governance/token/executor changes with a 7-day timelock.
Stewards may make narrowly bounded, revocable operational changes without a full vote. Control and emergency powers: the Protocol Emergency Guardian is a 4-of-7 multisig with EMERGENCY_ADMIN powers to pause markets/freeze reserves across deployments; signer identities are intentionally undisclosed. The Governance Emergency Guardian is 5-of-9 and may cancel malicious or erroneous proposals. These are genuine emergency bypasses, but they do not provide an identified single-key withdrawal path for user deposits.
Treasury SAFEs are generally 2-of-3, with each signer an independent organisation-controlled nested SAFE; operational wallets have capped spending limits. This permits bounded movement of DAO treasury funds, not unrestricted draining of user funds. Voting concentration/top holders: Not verifiable as of October 13, 2026. Dune MCP was unavailable, so no on-chain holder or delegation concentration figure is asserted. Company/legal control: Aave Labs is the contractual provider for the frontend and developer services; the Terms use Cayman Islands law, but the entity’s jurisdiction of incorporation, registration number, and directors are Not verifiable as of October 13, 2026. Contradiction/update: the previously recorded 1-day/7-day timelock split and 4-of-7 emergency configuration remain consistent with the 2026 governance materials; governance v2 additionally documents bounded Steward authority and the 5-of-9 Governance Emergency Guardian.
Timelock
Yes
Timelock delay hours
24
Multisig threshold
4
Multisig owners
7
Admin can drain
No
Emergency bypass
Yes
Dao governance
Yes
legal & regulatory
two sources
As of October 4, 2026.Legal structure / jurisdiction. Aave V3 is decentralized, non-custodial smart-contract infrastructure—not a company or legal person. Aave Labs states it develops interfaces, tools and documentation but does not operate or control the protocol. The contractual interface counterparty is identified as Aave Labs; prior interface terms identified Aave Interfaces Ltd. The governing law and arbitration seat are the Cayman Islands. ToS, restrictions and KYC/AML. The Terms prohibit unlawful use, money laundering, terrorist financing, sanctions evasion and dealings with sanctioned parties.
They restrict sanctioned persons and comprehensively sanctioned jurisdictions and permit technical blocking or suspension. Users bear responsibility for licensing, AML/sanctions, tax and reporting compliance. The Terms do not establish protocol-wide customer onboarding or KYC.
The Privacy Policy states that Aave Labs does not have information about all permissionless protocol users beyond public blockchain data; therefore, AML controls at the smart-contract layer are limited, while interface/API controls may differ. Classification. No binding regulator or court determination was identified classifying Aave V3 or AAVE as a security, lending institution, money transmitter or AML-regulated financial intermediary. A U.S. SEC filing records a sponsor’s view that AAVE is not a security and describes AAVE as a CFTC “commodity,” but expressly says those are non-binding, fact-dependent judgments. Warnings, enforcement, sanctions and litigation. No active regulator enforcement action against Aave V3, Aave Labs or Aave Interfaces Ltd. was identified in the reviewed SEC materials as of October 4, 2026.
No sanctions designation of those entities was identified; contractual sanctions screening is not itself a sanctions designation. A May 8, 2026 New York federal order permitted transfer of immobilized assets to a wallet controlled by Aave LLC and required Aave LLC to follow the restraining notice; this was procedural and not a liability finding against Aave. Data protection / actual risk. The Privacy Policy invokes Cayman data-protection law, permits international transfers, and provides access, correction, restriction, deletion and complaint rights. The principal legal risk is structural: contractual protections attach to the interface entity, while protocol governance, deployed code, DAO participants, developers, front ends and users may face different jurisdiction-specific theories of liability.
Protocol-wide legal-person status, comprehensive KYC/AML coverage and uniform regulatory treatment are Not verifiable as of October 4, 2026.
Active enforcement
No
Sanctioned
No
Entity
Aave Labs / Aave Interfaces Ltd.; Aave V3 itself is decentralized software with no legal personality
Jurisdiction
Cayman Islands
legal registries
two sources
Legal entity per GLEIF: AAVE LABS LTD. (LEI 635400TRMDMOYGUYRZ27; jurisdiction KY; registration ACTIVE). OFAC SDN screening of 'Aave Labs', 'Aave Interfaces Ltd', 'AAVE V3': no match. SEC litigation and administrative release feeds: no mention.
Screened names
Aave Labs
Aave Interfaces Ltd
AAVE V3
Entity
AAVE LABS LTD.
LEI
635400TRMDMOYGUYRZ27
Jurisdiction
KY
Entity status
ACTIVE
Sanctioned
No
Stability
stability
unverified
Aave V3 does issue its own stablecoin, GHO, and the available evidence documents at least one depeg event. The documented depeg occurred on 2023-10-26, when GHO fell from $0.962 to $0.946, implying a maximum observed depeg of about 5.4% below $1.00 during that event. A complete protocol-wide depeg count and the true last depeg date are not verifiable from the gathered evidence, so those fields remain null.
Own stablecoin
Yes
Stable
No
Max depeg pct
5.4%
Stablecoin ids
GHO
Risks & Strengths
risks
one source
Aave V3’s highest material risks remain smart-contract failure, oracle or valuation error, liquidation-driven bad debt, cross-chain control failure, and governance or privileged-role misuse. Current chain-level exposure, TVL concentration, and bad-debt status are Not verifiable as of October 5, 2026 because on-chain verification is unavailable; the repository archival finding is confirmed and increases version-governance risk.
Risk
Impact
Severity
Probability
Mitigation in place
Residual risk
Smart-contract exploit
A defect in pool, tokenization, liquidation, upgrade, or ancillary contracts could permit asset theft or insolvency. The core repository was archived on October 21, 2025, so deployment and version governance remain important controls. Audits and formal verification reduce but cannot eliminate zero-day or implementation-divergence risk.
High-impact zero-day, dependency, or deployment-specific failure remains possible; losses could be permanent.
Oracle and valuation failure
Stale, manipulated, unavailable, or misconfigured prices could misvalue collateral and debt, causing under-collateralized borrowing or unfair liquidations. Thin-liquidity, long-tail, issuer-dependent, and cross-chain assets are more exposed.
High
Medium
Chainlink feeds where available, oracle-sentinel mechanisms, asset-specific risk reviews, supply and borrow caps, isolation or siloed mode, and governance-controlled parameters.
Sharp collateral declines, stablecoin depegs, congestion, thin market liquidity, or liquidation slippage can leave debt exceeding recoverable collateral and transmit losses to suppliers.
High
Medium
Overcollateralization, health factors, liquidation incentives and close-factor rules, caps, isolation mode, risk monitoring, and Umbrella automated deficit coverage.
Coverage capacity and liquidation execution may be insufficient during correlated, discontinuous stress; current bad-debt status is Not verifiable as of October 5, 2026.
Cross-chain messaging failure
A bridge, message-delivery, replay, validation, or configuration failure could execute incorrect governance payloads or leave markets with inconsistent parameters across the listed chains.
Aggregate attack and coordination surface grows with every chain, bridge, oracle path, and deployment; chain-level exposure is Not verifiable as of October 5, 2026.
Governance and privileged roles
Concentrated voting power, compromised delegates, rushed proposals, or misuse of risk administrators, guardians, or listing roles could change listings, caps, rates, pauses, or permissions before users can exit.
High
Medium
On-chain governance, proposal review, scoped permissioned roles, timelocks, cancellation or guardian functions, risk-provider monitoring, and authority-queue surveillance.
Key compromise, voter apathy, social coordination failure, and parameter mistakes remain material tail risks.
strengths
one source
Aave V3’s top strengths are: 1) a strong security posture, supported by multiple independent audits and formal verification; 2) governance-controlled upgrades and risk settings, which limit unilateral admin power; 3) cross-chain design via Portal/approved bridges, enabling liquidity movement across markets under permissioning; 4) a broad multi-chain footprint that expands distribution and liquidity access; and 5) a formalized risk framework with continuous monitoring, risk stewards, and freeze/response mechanisms. The strongest evidence for these points is Aave’s published security page, governance risk framework, and Portal documentation, which together show a mature, process-heavy protocol design rather than ad hoc controls.
Methodology & Limitations
On-chain metrics: not verifiable — Dune phase 2 is not enabled.
0 of 25 fact categories not yet collected.
Fact verifiability: 11 two independent sources, 67 one source, 21 unverified.