Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 17.
- Audits since
- 11, the latest dated 30 Jun 2026.
Aave security record
As of 24 Oct 2026, Aave has 28 audit reports by 11 security firms on Trustblock; the latest is by Certora, dated 30 Jun 2026. Those reports list no open critical findings. It also holds 1 incident (latest 27 Aug 2024).
Critical findings
No open critical findings
Across the 28 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings
Incident
Incident 27 Aug 2024
Source: De.Fi incident database. 11 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits28
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Aave Token | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave CPM Price Provider | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave Protocol Audit | Security firm: OpenZeppelin | Date: | Scope: Files named in the report | 5 critical findings, fixed | Open · blog.openzeppelin.com |
Findings269
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 3 | 5 | 13 |
| Medium | 8 | 9 | 18 |
| Low | 53 | 98 | 56 |
CriticalAttacker May Steals Stake in stakeWithPermit()Aave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportCritical[C01] Users can steal fundsAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportCritical[C02] Borrowers can avoid liquidationAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportCritical[C03] Deposits not marked as collateral can still be liquidatedAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportCritical[C04] Rogue borrower can manipulate other account’s borrow balanceAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportCritical[C05] Loans of Ether cannot be repaidAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportHighMissing validation for the existence of asset in PoolConfiguratorAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Fixed
The report gives no description here.
Open the reportHighOverflow/Underflow in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportHighUnclear behavior in IGhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportHighPotential Reentrancy Risk in flashLoanSimple()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportShow 10 more
HighProper Asset Price in GenericLogic::calculateUserAccountData()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportHighVotingMachine - tryToMoveToValidating can lock up proposalsAave Governance Dao · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportHighVotingMachine - verifyNonce should only allow the next nonceAave Governance Dao · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportHigh[H01] Lack of access controlsAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportHigh[H02] Anyone can disable the flash loan featureAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportHigh[H03] Deactivated collateral reserve can be used in liquidationAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportHigh[H04] Liquidators cannot reclaim underlying asset when there is enough liquidityAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportHigh[H06] It is impossible to rebalance another account’s fixed borrow rateAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportHigh[H09] Fixed-rate loans can be repeatedly rebalancedAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportMedium2 Wei Rounding Can Trigger Liquidations and Create Additional DebtAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
MediumLiquidation Revert Due to Unrelated Paused Asset in HubAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportMediumShare Price Can Decrease Because of Fee RoundingAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportMediumAToken Distribution Can FailVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect Split of RevenueVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportMediumSuboptimal in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportMediumReturning Funds when totalShares is Zero May Lead to Denial of Ser- vice & Lock FundsAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportMediumImproved Logic of Pool::_addReserveToList()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportMediumProper And Consistent Collateral EnablingAave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportMediumProper EMode Category Use in Pool::borrow()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportMediumAttacker can abuse swapLiquidity function to drain users’ fundsAave Protocol V2 · Consensys · 1 Sep 2020Fixed
The report gives no description here.
Open the reportShow 10 more
MediumUnhandled return values of transfer and transferFromAave Safety Module · Consensys · 1 Sep 2020Fixed
The report gives no description here.
Open the reportMedium[M01] Fee-less loansAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportMedium[M03] Incorrect refund address during repayAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportMedium[M04] Borrower cannot partially repay interest of a loanAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportMedium[M06] Successful redeem of aTokens may not pay assets in exchangeAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportMedium[M07] Lack of event emission after rebalancing fixed borrow rateAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportMedium[M11] Miscalculation of requested borrow amount in ETHAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLowmaxDeposit() Overestimates Deposit CapacityAave V4 Tokenization Spoke · ChainSecurity · 24 Feb 2026Fixed
The report gives no description here.
Open the reportLowArray.sort() Can Revert Due to EVM Stack LimitAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowFees Can Be Minimized by Accruing OftenAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowLiquidation With Deficit Reverts Due to Paused AssetsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowLiquidations Can Fail Due to Low LiquidityAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowMissing EventsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowOverflow in Config Key Makes It Possible to Update CF to 0Aave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowProfitable Multi-Step LiquidationsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowSlippage in LiquidationsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowSpokes Do Not Return Minted/Burned Share AmountsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowMissing event emission for change in pending LTVAave security review · Pashov Audit Group · 3 Dec 2025Fixed
The report gives no description here.
Open the reportLowConditional Event EmissionVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowDuplicates in the Recipients Array Break _splitRevenueVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowFee Accrual and Fee WithdrawalVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowInput Validation Can Be ImprovedVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowReward Tokens With Hooks Allow Recipients to Block SplitVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowThe latestAnswer function reverts after slashing configuration removalAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Fixed
The report gives no description here.
Open the reportLowsetUserEMode should check if categoryId is the same to avoid unnecessary validationAave V3.2 audit · Pashov Audit Group · 15 Sep 2024Fixed
The report gives no description here.
Open the reportLowRedundant casting to uint8 in PoolConfigurator, UiPoolDataProviderV3Aave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Fixed
The report gives no description here.
Open the reportLowUnused field eModeAssetCategory in GenericLogicAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Fixed
The report gives no description here.
Open the reportLowtotalAssets() returns the wrong result by querying the wrong tokenAave StataTokenV2 audit · Certora · 11 Sep 2024Fixed
The report gives no description here.
Open the reportLowDocumentation in GhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowProcedural in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowProcedural in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowProcedural in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowReadability in GhoDiscountRateStrategy.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowIncorrect Input of configureAssets() May Increase Users’ RewardsAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportLowSlashing Potentially Causes Rounding ErrorAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportLowImproved Event Generation in ScaledBalanceTokenBase::_transfer()Aave V3.0.1 audit · PeckShield · 22 Dec 2022Fixed
The report gives no description here.
Open the reportLowDivision by Zero Returns ZeroAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportLowsetEModeCategory() Invalid ParametersAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportLowUser’s Borrowing Status is not Updated When Their Entire Debt is Liq- uidatedAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportLowConsistent Reserve Cache Use in rebalanceStableBorrowRate()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowHealth Validation in EModeLogic::executeSetUserEMode()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportLowImprovement on UserConfiguration::_getFirstAssetAsCollateralId()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportLowRedundant State/Code RemovalAave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportLowMinor code quality issuesAave Safety Module · Consensys · 1 Sep 2020Fixed
The report gives no description here.
Open the reportLowStaking cooldown can be avoided for a part of the fundsAave Safety Module · Consensys · 1 Sep 2020Fixed
The report gives no description here.
Open the reportLowCode readability - Rename priceDeviation to maxPriceDeviation ✓Aave Balancer and Uniswap v2 Price Providers · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportLowImprove Input Validation ✓Aave Balancer and Uniswap v2 Price Providers · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportLowUse SafeMath consistently ✓Aave Balancer and Uniswap v2 Price Providers · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportLowVoteMachine - Cancelling vote does not increase the nonceAave Governance Dao · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportLowCPM token price is susceptible to manipulationAave CPM Price Provider · Consensys · 1 May 2020Fixed
The report gives no description here.
Open the reportShow 10 more
LowUnderflow if TOKEN_DECIMALS are greater than 18Aave CPM Price Provider · Consensys · 1 May 2020Fixed
The report gives no description here.
Open the reportLow[L01] Minimum interest can be within one blockAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L02] Truncation when casting Ray to WadAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L03] Conversion to aToken units implicitly assumes 18 decimalsAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L05] Fixed-rate borrow can be rebalanced in inactive reserveAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L07] Potential division by zeroAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L08] Erroneous data logged in LiquidationCall eventAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L09] Erroneous data logged in Repay eventAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L10] Redundant BurnOnRedeem eventAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L11] MintOnDeposit event logs amount of underlying assetAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportShow 3 more
Low[L12] Unfulfillable conditionAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L13] Inconsistent validationsAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportLow[L16] Erroneous docstrings and commentsAave Protocol Audit · OpenZeppelin · 15 Jan 2020Fixed
The report gives no description here.
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="aave"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us