Aave Starknet Bridge

Nethermind Security12 Sep 2022Code version: not recorded (see the report)

Nethermind Security reviewed Aave (Aave Starknet Bridge) on 12 Sep 2022: 11 findings, 2 critical; 8 marked fixed, 3 acknowledged.

2 critical findings, fixed

Open the report Open Aave’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings29

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	2
High	0	0	0
Medium	0	3	0
Low	0	0	6

Marked Info or Best Practices by the firm. Not counted as findings.

InfoInconsistent L1 to L2 message input validationAcknowledged

The report gives no description here.

Best PracticesComment does not accurately reflect logicFixed

The report gives no description here.

Best PracticesConstant name spelling errorFixed

The report gives no description here.

Best PracticesConstant with zero valueFixed

The report gives no description here.

Best PracticesGetter functions with @external visibilityFixed

The report gives no description here.

Best PracticesInconsistent variable naming across functionsFixed

The report gives no description here.

Best PracticesIncorrect function orderingFixed

The report gives no description here.

Best PracticesMisleading function name bridge.only_l1_handler(...)Fixed

The report gives no description here.

InfoMissing event emissionsFixed

The report gives no description here.

InfoMissing input validation in proxy.constructor(...)Fixed

The report gives no description here.

Show 8 more

Best PracticesMissing use of the Cairo boolean libraryFixed

The report gives no description here.

Best PracticesRemove unused importsFixed

The report gives no description here.

InfoStorage variable l1_bridge cannot be changed once assigned.Fixed

The report gives no description here.

Best PracticesTypo in commentFixed

The report gives no description here.

Best PracticesUnnecessary alloc_locals in bridge.set_reward_token(...)Fixed

The report gives no description here.

InfoUnnecessary initialization logic in proxy.initialize_proxy(...)Fixed

The report gives no description here.

Best PracticesUnused variable naming across functionsFixed

The report gives no description here.

Best PracticesUse of unofficial OpenZeppelin contract packageFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Aave’s security record

Aave

Audits36 audits by 14 firmsLast audit Jun 2026, by Certora.

Critical findingsNo open critical findingsAcross the 36 reports, 8 critical findings were reported. Each is marked fixed by the firm that reported it.

IncidentIncident 27 Aug 2024Source: De.Fi incident database.

Open Aave’s security record

Security firm

Nethermind Security

79 projects reviewed · 145 reports · latest Oct 2026

See Nethermind Security’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.