Aave Protocol V2

Off-Chain (Private)

Audited on 2020/08/31

No active critical issues

Summary

Executive Summary This report presents the results of our engagement with Aave review version 2 of the Aave protocol. The review was conducted over 4 weeks, from September 8th, 2020 to October 9th 2020 by Bernhard Mueller and Sergii Kravchenko. A total of 35 person-days were spent. Scope Our review focused on the commit hash f756f44a8d6a328cd545335e46e7128939db88c4. The list of files in scope can be found in the Appendix. The auditor focused specifically on the changes and new features introduced with version 2 of the protocol.

Project

Aave

Multi-Chain

Issues (9)

	Low	Medium	High	Critical	Total
Not fixed	5	3	-	-	8
Fixed	-	1	-	-	1
Total	5	4	0	0	9

Contracts (42)

#	File Name
21	contracts/libraries/openzeppelin-upgradeability/Initializable.sol
22	contracts/libraries/helpers/Helpers.sol
23	contracts/lendingpool/LendingPoolCollateralManager.sol
24	contracts/lendingpool/LendingPoolConfigurator.sol
25	contracts/libraries/logic/ReserveLogic.sol
26	contracts/libraries/math/PercentageMath.sol
27	contracts/lendingpool/LendingPool.sol
28	contracts/libraries/logic/GenericLogic.sol
29	contracts/libraries/openzeppelin-upgradeability/UpgradeabilityProxy.sol
30	contracts/libraries/math/WadRayMath.sol

#	File Name
21	contracts/libraries/openzeppelin-upgradeability/Initializable.sol
22	contracts/libraries/helpers/Helpers.sol
23	contracts/lendingpool/LendingPoolCollateralManager.sol
24	contracts/lendingpool/LendingPoolConfigurator.sol
25	contracts/libraries/logic/ReserveLogic.sol
26	contracts/libraries/math/PercentageMath.sol
27	contracts/lendingpool/LendingPool.sol
28	contracts/libraries/logic/GenericLogic.sol
29	contracts/libraries/openzeppelin-upgradeability/UpgradeabilityProxy.sol
30	contracts/libraries/math/WadRayMath.sol

Aave Protocol V2

Summary

Issues (9)

Griefing attack by taking flash loan on behalf of usernot_fixed/medium

Interest rates are updated incorrectlynot_fixed/medium

Unhandled return values of transfer and transferFromnot_fixed/medium

Attacker can front-run delegator when changing allowancenot_fixed/low

Code quality could be improvednot_fixed/low

Contracts (42)