Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 17.
- Audits since
- 11, the latest dated 30 Jun 2026.
Aave security record
As of 24 Oct 2026, Aave has 28 audit reports by 11 security firms on Trustblock; the latest is by Certora, dated 30 Jun 2026. Those reports list no open critical findings. It also holds 1 incident (latest 27 Aug 2024).
Critical findings
No open critical findings
Across the 28 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings
Incident
Incident 27 Aug 2024
Source: De.Fi incident database. 11 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits28
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Aave StableVault | Security firm: Certora | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V4 Tokenization Spoke | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Aave V4 Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Aave security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave CowSwap Adapters | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Immutable aToken Vault | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Vault Revenue Splitter | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Aave Umbrella | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V3.2 audit | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave v3.2 Liquid eModes | Security firm: OXORIO | Date: | Scope: Files named in the report | No open critical findings | Open · audits.oxor.io |
| Aave StataTokenV2 audit | Security firm: Certora | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V3.1 competition | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Aave V3.0.2 audit | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave GHO audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave Safetymodule security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Aave V3.0.1 audit | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V3.0.1 audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| bridge executors | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Aave V3 audit | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V3 audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave ParaSwap Adapter audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave Protocol V2 | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave Safety Module | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave Balancer and Uniswap v2 Price Providers | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave Governance Dao | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
Findings269
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 3 | 5 | 13 |
| Medium | 8 | 9 | 18 |
| Low | 53 | 98 | 56 |
CriticalAttacker May Steals Stake in stakeWithPermit()Aave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportCritical[C01] Users can steal fundsFixed
The report gives no description here.
Critical[C02] Borrowers can avoid liquidationFixed
The report gives no description here.
Critical[C03] Deposits not marked as collateral can still be liquidatedFixed
The report gives no description here.
Critical[C04] Rogue borrower can manipulate other account’s borrow balanceFixed
The report gives no description here.
Critical[C05] Loans of Ether cannot be repaidFixed
The report gives no description here.
HighMissing validation for the existence of asset in PoolConfiguratorAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Fixed
The report gives no description here.
Open the reportHighOverflow/Underflow in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportHighUnclear behavior in IGhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportHighPotential Reentrancy Risk in flashLoanSimple()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportShow 10 more
HighProper Asset Price in GenericLogic::calculateUserAccountData()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportHighVotingMachine - tryToMoveToValidating can lock up proposalsAave Governance Dao · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportHighVotingMachine - verifyNonce should only allow the next nonceAave Governance Dao · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportHigh[H01] Lack of access controlsFixed
The report gives no description here.
High[H02] Anyone can disable the flash loan featureFixed
The report gives no description here.
High[H03] Deactivated collateral reserve can be used in liquidationFixed
The report gives no description here.
High[H04] Liquidators cannot reclaim underlying asset when there is enough liquidityFixed
The report gives no description here.
High[H06] It is impossible to rebalance another account’s fixed borrow rateFixed
The report gives no description here.
High[H09] Fixed-rate loans can be repeatedly rebalancedFixed
The report gives no description here.
Medium2 Wei Rounding Can Trigger Liquidations and Create Additional DebtAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
MediumLiquidation Revert Due to Unrelated Paused Asset in HubAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportMediumShare Price Can Decrease Because of Fee RoundingAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportMediumAToken Distribution Can FailVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect Split of RevenueVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportMediumSuboptimal in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportMediumReturning Funds when totalShares is Zero May Lead to Denial of Ser- vice & Lock FundsAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportMediumImproved Logic of Pool::_addReserveToList()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportMediumProper And Consistent Collateral EnablingAave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportMediumProper EMode Category Use in Pool::borrow()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportMediumAttacker can abuse swapLiquidity function to drain users’ fundsAave Protocol V2 · Consensys · 1 Sep 2020Fixed
The report gives no description here.
Open the reportShow 10 more
MediumUnhandled return values of transfer and transferFromAave Safety Module · Consensys · 1 Sep 2020Fixed
The report gives no description here.
Open the reportMedium[M01] Fee-less loansFixed
The report gives no description here.
Medium[M03] Incorrect refund address during repayFixed
The report gives no description here.
Medium[M04] Borrower cannot partially repay interest of a loanFixed
The report gives no description here.
Medium[M06] Successful redeem of aTokens may not pay assets in exchangeFixed
The report gives no description here.
Medium[M07] Lack of event emission after rebalancing fixed borrow rateFixed
The report gives no description here.
Medium[M11] Miscalculation of requested borrow amount in ETHFixed
The report gives no description here.
LowmaxDeposit() Overestimates Deposit CapacityAave V4 Tokenization Spoke · ChainSecurity · 24 Feb 2026Fixed
The report gives no description here.
Open the reportLowArray.sort() Can Revert Due to EVM Stack LimitAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowFees Can Be Minimized by Accruing OftenAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowLiquidation With Deficit Reverts Due to Paused AssetsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowLiquidations Can Fail Due to Low LiquidityAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowMissing EventsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowOverflow in Config Key Makes It Possible to Update CF to 0Aave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowProfitable Multi-Step LiquidationsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowSlippage in LiquidationsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowSpokes Do Not Return Minted/Burned Share AmountsAave V4 Smart Contracts · ChainSecurity · 19 Feb 2026Fixed
The report gives no description here.
Open the reportLowMissing event emission for change in pending LTVAave security review · Pashov Audit Group · 3 Dec 2025Fixed
The report gives no description here.
Open the reportLowConditional Event EmissionVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowDuplicates in the Recipients Array Break _splitRevenueVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowFee Accrual and Fee WithdrawalVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowInput Validation Can Be ImprovedVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowReward Tokens With Hooks Allow Recipients to Block SplitVault Revenue Splitter · ChainSecurity · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowThe latestAnswer function reverts after slashing configuration removalAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Fixed
The report gives no description here.
Open the reportLowsetUserEMode should check if categoryId is the same to avoid unnecessary validationAave V3.2 audit · Pashov Audit Group · 15 Sep 2024Fixed
The report gives no description here.
Open the reportLowRedundant casting to uint8 in PoolConfigurator, UiPoolDataProviderV3Aave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Fixed
The report gives no description here.
Open the reportLowUnused field eModeAssetCategory in GenericLogicAave v3.2 Liquid eModes · OXORIO · 12 Sep 2024Fixed
The report gives no description here.
Open the reportLowtotalAssets() returns the wrong result by querying the wrong tokenAave StataTokenV2 audit · Certora · 11 Sep 2024Fixed
The report gives no description here.
Open the reportLowDocumentation in GhoToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowProcedural in GhoAToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowProcedural in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowProcedural in GhoVariableDebtToken.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowReadability in GhoDiscountRateStrategy.solAave GHO audit · ABDK Consulting · 1 Mar 2023Fixed
The report gives no description here.
Open the reportLowIncorrect Input of configureAssets() May Increase Users’ RewardsAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportLowSlashing Potentially Causes Rounding ErrorAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportLowImproved Event Generation in ScaledBalanceTokenBase::_transfer()Aave V3.0.1 audit · PeckShield · 22 Dec 2022Fixed
The report gives no description here.
Open the reportLowDivision by Zero Returns ZeroAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportLowsetEModeCategory() Invalid ParametersAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportLowUser’s Borrowing Status is not Updated When Their Entire Debt is Liq- uidatedAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportLowConsistent Reserve Cache Use in rebalanceStableBorrowRate()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportShow 10 more
LowHealth Validation in EModeLogic::executeSetUserEMode()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportLowImprovement on UserConfiguration::_getFirstAssetAsCollateralId()Aave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportLowRedundant State/Code RemovalAave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportLowMinor code quality issuesAave Safety Module · Consensys · 1 Sep 2020Fixed
The report gives no description here.
Open the reportLowStaking cooldown can be avoided for a part of the fundsAave Safety Module · Consensys · 1 Sep 2020Fixed
The report gives no description here.
Open the reportLowCode readability - Rename priceDeviation to maxPriceDeviation ✓Aave Balancer and Uniswap v2 Price Providers · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportLowImprove Input Validation ✓Aave Balancer and Uniswap v2 Price Providers · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportLowUse SafeMath consistently ✓Aave Balancer and Uniswap v2 Price Providers · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportLowVoteMachine - Cancelling vote does not increase the nonceAave Governance Dao · Consensys · 1 Aug 2020Fixed
The report gives no description here.
Open the reportLow[L01] Minimum interest can be within one blockFixed
The report gives no description here.
Show 10 more
Low[L02] Truncation when casting Ray to WadFixed
The report gives no description here.
Low[L03] Conversion to aToken units implicitly assumes 18 decimalsFixed
The report gives no description here.
Low[L05] Fixed-rate borrow can be rebalanced in inactive reserveFixed
The report gives no description here.
Low[L07] Potential division by zeroFixed
The report gives no description here.
Low[L08] Erroneous data logged in LiquidationCall eventFixed
The report gives no description here.
Low[L09] Erroneous data logged in Repay eventFixed
The report gives no description here.
Low[L10] Redundant BurnOnRedeem eventFixed
The report gives no description here.
Low[L11] MintOnDeposit event logs amount of underlying assetFixed
The report gives no description here.
Low[L12] Unfulfillable conditionFixed
The report gives no description here.
Low[L13] Inconsistent validationsFixed
The report gives no description here.
Show 3 more
Low[L16] Erroneous docstrings and commentsFixed
The report gives no description here.
LowCPM token price is susceptible to manipulationFixed
The report gives no description here.
LowUnderflow if TOKEN_DECIMALS are greater than 18Fixed
The report gives no description here.
Incidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="aave"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us