Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 17.
- Audits since
- 11, the latest dated 30 Jun 2026.
Aave security record
As of 24 Oct 2026, Aave has 28 audit reports by 11 security firms on Trustblock; the latest is by Certora, dated 30 Jun 2026. Those reports list no open critical findings. It also holds 1 incident (latest 27 Aug 2024).
Critical findings
No open critical findings
Across the 28 reports, 6 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings
Incident
Incident 27 Aug 2024
Source: De.Fi incident database. 11 audits have been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits28
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Aave StableVault | Security firm: Certora | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V4 Tokenization Spoke | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Aave V4 Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Aave security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave CowSwap Adapters | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Immutable aToken Vault | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Vault Revenue Splitter | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Aave Umbrella | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V3.2 audit | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave v3.2 Liquid eModes | Security firm: OXORIO | Date: | Scope: Files named in the report | No open critical findings | Open · audits.oxor.io |
| Aave StataTokenV2 audit | Security firm: Certora | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V3.1 competition | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Aave V3.0.2 audit | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave GHO audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave Safetymodule security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Aave V3.0.1 audit | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V3.0.1 audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| bridge executors | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Aave V3 audit | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave V3 audit | Security firm: PeckShield | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave ParaSwap Adapter audit | Security firm: ABDK Consulting | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Aave Protocol V2 | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave Safety Module | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave Balancer and Uniswap v2 Price Providers | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Aave Governance Dao | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
Findings269
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 3 | 5 | 13 |
| Medium | 8 | 9 | 18 |
| Low | 53 | 98 | 56 |
Marked Info, Warning or Informational by the firms. Not counted as findings.
InfoPermit error handlingAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Acknowledged
The report gives no description here.
Open the reportInfoThe same suffix is used for name and symbolAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Acknowledged
The report gives no description here.
Open the reportInformationalSlashing Does Not Impact Rewards CalculationAave Safetymodule security review · Sigma Prime · 1 Feb 2023Acknowledged
The report gives no description here.
Open the reportInformationalConfigurator Decimals Are Parameters Rather than FetchedAave V3 audit · Sigma Prime · 27 Jan 2022Acknowledged
The report gives no description here.
Open the reportInformationalEvent MintUnbacked Field user is Always Set to BridgeAave V3 audit · Sigma Prime · 27 Jan 2022Acknowledged
The report gives no description here.
Open the reportWarningInconsistent usage of _msgSender() over msg.senderAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Fixed
The report gives no description here.
Open the reportWarningMissing validation of the upper bound in validateTargetLiquidityAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Fixed
The report gives no description here.
Open the reportInfoTyposAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Fixed
The report gives no description here.
Open the reportInfoUnused using-for directiveAave Umbrella · Ackee Blockchain Security · 3 Mar 2025Fixed
The report gives no description here.
Open the reportInformationalMint Event Is Emitted When Zero Value Is MintedAave V3.0.2 audit · Sigma Prime · 19 Apr 2023Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalMiscellaneous General CommentsAave V3.0.2 audit · Sigma Prime · 19 Apr 2023Fixed
The report gives no description here.
Open the reportInformationalInitialisers Should be Disabled in the ConstructorAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportInformationalMiscellaneous General CommentsAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportInformationalpermit() May Fail SilentlyAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportInformationalPotential Abuse of returnFunds() to Add Snapshots & Disrupt VotingAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportInformationalUnusable Functions Cause Deployment InefficiencyAave Safetymodule security review · Sigma Prime · 1 Feb 2023Fixed
The report gives no description here.
Open the reportInformationalMint Event Is Emitted When Zero Value Is MintedAave V3.0.1 audit · Sigma Prime · 23 Dec 2022Fixed
The report gives no description here.
Open the reportInformationalMiscellaneous General CommentsAave V3.0.1 audit · Sigma Prime · 23 Dec 2022Fixed
The report gives no description here.
Open the reportInformationalImproved Logic of LiquidationLogic::executeLiquidationCall()Aave V3.0.1 audit · PeckShield · 22 Dec 2022Fixed
The report gives no description here.
Open the reportInformationalGas Optimisation - Reduce Ternary OperatorsAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportShow 7 more
InformationalMiscellaneous General CommentsAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportInformationalNo Getter For _stableRateExcessOffsetAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportInformationalRepeated Arguments Passed in validateRebalanceStableBorrowRate()Aave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportInformationalUnnecessary Storage Reads When Fetch DebtAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportInformationalUnused Struct Variables and ErrorsAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportInformationalVerification POOL Matches the ConfiguratorAave V3 audit · Sigma Prime · 27 Jan 2022Fixed
The report gives no description here.
Open the reportInformationalSuggested immutable For Gas Efficiency Coding PracticeAave V3 audit · PeckShield · 10 Jan 2022Fixed
The report gives no description here.
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="aave"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us