Aave V3 audit

PeckShieldCode version: not recorded (see the report)

Audit · firm’s term: smart contract audit

PeckShield reviewed Aave (Aave V3 audit) on 10 Jan 2022: 10 findings, 0 critical; 9 marked fixed, 1 acknowledged.

No open critical findings
Open the reportOpen Aave’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High002
Medium003
Low014
HighPotential Reentrancy Risk in flashLoanSimple()Fixed

The report gives no description here.

HighProper Asset Price in GenericLogic::calculateUserAccountData()Fixed

The report gives no description here.

MediumImproved Logic of Pool::_addReserveToList()Fixed

The report gives no description here.

MediumProper And Consistent Collateral EnablingFixed

The report gives no description here.

MediumProper EMode Category Use in Pool::borrow()Fixed

The report gives no description here.

LowConsistent Reserve Cache Use in rebalanceStableBorrowRate()Fixed

The report gives no description here.

LowHealth Validation in EModeLogic::executeSetUserEMode()Fixed

The report gives no description here.

LowImprovement on UserConfiguration::_getFirstAssetAsCollateralId()Fixed

The report gives no description here.

LowRedundant State/Code RemovalFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Aave’s security record

Aave
Audits28 audits by 11 firmsLast audit Jun 2026, by Certora.
Critical findingsNo open critical findingsAcross the 28 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it.
IncidentIncident 27 Aug 2024Source: De.Fi incident database.
Open Aave’s security record

Security firm

PeckShield

181 projects reviewed · 247 reports · latest Apr 2026

See PeckShield’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us