Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 17.
- Audits since
- 11, the latest dated 30 Jun 2026.
Aave security record
As of 24 Oct 2026, Aave has 28 audit reports by 11 security firms on Trustblock; the latest is by Certora, dated 30 Jun 2026. Those reports list no open critical findings. It also holds 1 incident (latest 27 Aug 2024).
Critical findings
No open critical findings
Across the 28 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings
Incident
Incident 27 Aug 2024
Source: De.Fi incident database. 11 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits28
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Aave Token | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave CPM Price Provider | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 5 critical findings, fixed | Open · blog.openzeppelin.com |
Findings269
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 3 | 5 | 13 |
| Medium | 8 | 9 | 18 |
| Low | 53 | 98 | 56 |
HighA new reserve upon initialization may unintentionally be included in an emode category in EModeConfigurationAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Acknowledged
The report gives no description here.
Open the reportHighProcedural in ERC20.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportHighSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportHighUnclear behavior in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportHighUnclear behavior in IERC20Mintable.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportMediumPossible shares inflationAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Acknowledged
The report gives no description here.
Open the reportMediumPossibility to modify the bitmap for non-existent emode categories in PoolConfiguratorAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Acknowledged
The report gives no description here.
Open the reportMedium_pendingltv[asset] will be set to 0 if 2 consecutive calls to setreservefreeze(asset, true) are executed Submitted by r0bert, also found by StErMi, krikolkk, zigtur, lukaprini, Chad0 and 99CritsAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportMediumOverflow/Underflow in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportMediumSuboptimal in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
MediumSuboptimal in GhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportMediumSuboptimal in IGhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportMediumUnclear behavior in GhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportMediumUnclear behavior in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowFrequent claiming of rewards can lead to lossesAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Acknowledged
The report gives no description here.
Open the reportLowEmode category id cast to uint256 in PoolAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Acknowledged
The report gives no description here.
Open the reportLowMagic number used as the maximum number of emode categories in UiPoolDataProviderV3Aave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Acknowledged
The report gives no description here.
Open the reportLowMisleading Comment Regarding missCounter in getEModes functionAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Acknowledged
The report gives no description here.
Open the reportLowRedunant import of EmodeEngine in ListingEngineAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Acknowledged
The report gives no description here.
Open the reportLowSame error description for different errors within the setEModeCategory function in PoolConfiguratorAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowConsider documenting explicitly that virtual accounting is a requirement for "normal" reserves Submitted by JCNAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowConsider optimizing poolconfigurator::_checknosuppliers internal function Submitted by JCNAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowConsider optimizing the poolconfigurator::setreserveinterestrate... functions Submitted by JCNAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowDecimals mismatching during reserve initialization will break calculations Submitted by zigturAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowexecutedropreserve() doesn't clean interest rates from defaultreserveinterestratestrategyv2 upon dropping a reserve Submitted by alix40Aave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowexecuteswapborrowratemode miss the natspec documentation of the new user parameter Submitted by StErMiAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowIf the asset is frozen, collateralconfigurationchanged event will use the wrong ltv value Submitted by StErMiAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowInsufficient check in validateflashloan still allows to borrow/flashloan more assets than the atoken's totalsupply Submitted by krikolkk, also found by nmirchev8, Bauchibred and r0bertAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowliquidationgraceperiod cannot be disabled anymore once configured Submitted by StErMiAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowPast or current grace period can be setup : conflicting the natspec of new reservedata struct Submitted by 0xumarkhatabAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
Lowpoolrevisionfourinitialize.initialize is not initializing the new "pending ltv" logic for already frozen assets Submitted by StErMiAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowsetreservefreeze pass the wrong ltv value to the pendingltvchanged event Submitted by StErMiAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowsetreservefreeze should trigger the collateralconfigurationchanged event if ltv is changed in the config Submitted by StErMiAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowSetting emode category params can potentially set emode ltv to a lower value than the pending ltv of a frozen asset Submitted by krikolkk, also found by zigturAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowState changing function doesn't emit events in executesetliquidationgraceperiod() Submitted by ladboy233Aave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowswaptovariable natspec is incorrect Submitted by StErMiAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowThe function swaptovariable() is missing in l2pool Submitted by ladboy233Aave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowUndocumented function parameters Submitted by 99Crits, also found by Mansa11Aave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowUnnecessary storage read during pool::borrow calls Submitted by JCNAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportLowvirtual_acc_active name is not coherent with the other masks defined in reserveconfiguration Submitted by StErMiAave V3.1 competition · Cantina · 2 Jun 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in GhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in GhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoFacilitator.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad datatype in IGhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad datatype in IGhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in ERC20.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in GhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBad naming in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in IGhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in IGhoFacilitator.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in IGhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in IGhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowBad naming in IGhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowOverflow/Underflow in GhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in ERC20.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in ERC20.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in ERC20.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowProcedural in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in GhoDiscountRateStrategy.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in GhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in GhoInterestRateStrategy.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in GhoOracle.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in GhoOracle.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowProcedural in GhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowReadability in GhoDiscountRateStrategy.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in ERC20.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in IGhoFacilitator.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in IGhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in IGhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowSuboptimal in IGhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in IGhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowSuboptimal in IGhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in ERC20.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in GhoFlashMinter.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowUnclear behavior in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Acknowledged
The report gives no description here.
Open the reportLowCompromised Guardian Can Block the Executorbridge executors · ChainSecurity · 26 Jul 2022Acknowledged
The report gives no description here.
Open the reportLowDangerous Delegatecallsbridge executors · ChainSecurity · 26 Jul 2022Acknowledged
The report gives no description here.
Open the reportLowFunction Signature as String, Unicode Charsetbridge executors · ChainSecurity · 26 Jul 2022Acknowledged
The report gives no description here.
Open the reportShow 2 more
LowPotential Reentrancy on executebridge executors · ChainSecurity · 26 Jul 2022Acknowledged
The report gives no description here.
Open the reportLowPossible Underflow Avoidance in BorrowLogic And UserConfigurationAave V3 audit · PeckShield · 10 Jan 2022Acknowledged
The report gives no description here.
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="aave"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us