Aave Protocol V2

Off-Chain (Private)

Audited on 2020/08/31

No active critical issues

Summary

Executive Summary This report presents the results of our engagement with Aave review version 2 of the Aave protocol. The review was conducted over 4 weeks, from September 8th, 2020 to October 9th 2020 by Bernhard Mueller and Sergii Kravchenko. A total of 35 person-days were spent. Scope Our review focused on the commit hash f756f44a8d6a328cd545335e46e7128939db88c4. The list of files in scope can be found in the Appendix. The auditor focused specifically on the changes and new features introduced with version 2 of the protocol.

Project

Aave

Multi-Chain

Issues (9)

	Low	Medium	High	Critical	Total
Not fixed	5	3	-	-	8
Fixed	-	1	-	-	1
Total	5	4	0	0	9

Contracts (42)

#	File Name
31	contracts/lendingpool/LendingPoolStorage.sol
32	contracts/libraries/openzeppelin-upgradeability/BaseAdminUpgradeabilityProxy.sol
33	contracts/libraries/logic/ValidationLogic.sol
34	contracts/libraries/openzeppelin-upgradeability/VersionedInitializable.sol
35	contracts/libraries/openzeppelin-upgradeability/AdminUpgradeabilityProxy.sol
36	contracts/misc/Context.sol
37	contracts/misc/SafeERC20.sol
38	contracts/misc/Address.sol
39	contracts/libraries/openzeppelin-upgradeability/BaseUpgradeabilityProxy.sol
40	contracts/libraries/configuration/UserConfiguration.sol

#	File Name
31	contracts/lendingpool/LendingPoolStorage.sol
32	contracts/libraries/openzeppelin-upgradeability/BaseAdminUpgradeabilityProxy.sol
33	contracts/libraries/logic/ValidationLogic.sol
34	contracts/libraries/openzeppelin-upgradeability/VersionedInitializable.sol
35	contracts/libraries/openzeppelin-upgradeability/AdminUpgradeabilityProxy.sol
36	contracts/misc/Context.sol
37	contracts/misc/SafeERC20.sol
38	contracts/misc/Address.sol
39	contracts/libraries/openzeppelin-upgradeability/BaseUpgradeabilityProxy.sol
40	contracts/libraries/configuration/UserConfiguration.sol

Aave Protocol V2

Summary

Issues (9)

Griefing attack by taking flash loan on behalf of usernot_fixed/medium

Interest rates are updated incorrectlynot_fixed/medium

Unhandled return values of transfer and transferFromnot_fixed/medium

Attacker can front-run delegator when changing allowancenot_fixed/low

Code quality could be improvednot_fixed/low

Contracts (42)