Aave V3.1 competition
Cantina reviewed Aave (Aave V3.1 competition) on 2 Jun 2024: 21 findings, 0 critical; all acknowledged, none fixed.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 1 | 0 |
| Low | 0 | 20 | 0 |
Medium_pendingltv[asset] will be set to 0 if 2 consecutive calls to setreservefreeze(asset, true) are executed Submitted by r0bert, also found by StErMi, krikolkk, zigtur, lukaprini, Chad0 and 99CritsAcknowledged
The report gives no description here.
LowConsider documenting explicitly that virtual accounting is a requirement for "normal" reserves Submitted by JCNAcknowledged
The report gives no description here.
LowConsider optimizing poolconfigurator::_checknosuppliers internal function Submitted by JCNAcknowledged
The report gives no description here.
LowConsider optimizing the poolconfigurator::setreserveinterestrate... functions Submitted by JCNAcknowledged
The report gives no description here.
LowDecimals mismatching during reserve initialization will break calculations Submitted by zigturAcknowledged
The report gives no description here.
Lowexecutedropreserve() doesn't clean interest rates from defaultreserveinterestratestrategyv2 upon dropping a reserve Submitted by alix40Acknowledged
The report gives no description here.
Lowexecuteswapborrowratemode miss the natspec documentation of the new user parameter Submitted by StErMiAcknowledged
The report gives no description here.
LowIf the asset is frozen, collateralconfigurationchanged event will use the wrong ltv value Submitted by StErMiAcknowledged
The report gives no description here.
LowInsufficient check in validateflashloan still allows to borrow/flashloan more assets than the atoken's totalsupply Submitted by krikolkk, also found by nmirchev8, Bauchibred and r0bertAcknowledged
The report gives no description here.
Lowliquidationgraceperiod cannot be disabled anymore once configured Submitted by StErMiAcknowledged
The report gives no description here.
Show 10 more
LowPast or current grace period can be setup : conflicting the natspec of new reservedata struct Submitted by 0xumarkhatabAcknowledged
The report gives no description here.
Lowpoolrevisionfourinitialize.initialize is not initializing the new "pending ltv" logic for already frozen assets Submitted by StErMiAcknowledged
The report gives no description here.
Lowsetreservefreeze pass the wrong ltv value to the pendingltvchanged event Submitted by StErMiAcknowledged
The report gives no description here.
Lowsetreservefreeze should trigger the collateralconfigurationchanged event if ltv is changed in the config Submitted by StErMiAcknowledged
The report gives no description here.
LowSetting emode category params can potentially set emode ltv to a lower value than the pending ltv of a frozen asset Submitted by krikolkk, also found by zigturAcknowledged
The report gives no description here.
LowState changing function doesn't emit events in executesetliquidationgraceperiod() Submitted by ladboy233Acknowledged
The report gives no description here.
Lowswaptovariable natspec is incorrect Submitted by StErMiAcknowledged
The report gives no description here.
LowThe function swaptovariable() is missing in l2pool Submitted by ladboy233Acknowledged
The report gives no description here.
LowUndocumented function parameters Submitted by 99Crits, also found by Mansa11Acknowledged
The report gives no description here.
LowUnnecessary storage read during pool::borrow calls Submitted by JCNAcknowledged
The report gives no description here.
Show 1 more
Lowvirtual_acc_active name is not coherent with the other masks defined in reserveconfiguration Submitted by StErMiAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Aave’s security record
AaveSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us