Aave

Aave is a decentralised lending protocol. Users supply crypto assets to shared pools to earn interest, and borrow from those pools against collateral worth more than the loan; positions whose health factor falls below 1 can be liquidated.¹ It grew out of ETHLend, a peer-to-peer lending platform founded by Stani Kulechov, and is governed by the Aave DAO, whose members vote with the AAVE token.²³⁴

HistoryReport an error

ETHLend

Stani Kulechov holds a Master of Laws degree from the University of Helsinki.⁵ He founded ETHLend, which by late 2017 let borrowers lock ERC-20 tokens as collateral and borrow Ether from individual lenders. Its LEND token was sold in a presale that reached a 2,000 ETH cap in September 2017 and a public sale that began on 25 November 2017; Finance Magnates reported that the public sale raised US$10 million in its first half-hour.³

In September 2018 Aave was established as the parent company of ETHLend. When the Aave Protocol launched, ETHLend stopped taking new loans and stayed open only so that existing users could close their positions.²

Aave Protocol v1 and flash loans

The Aave Protocol launched on Ethereum on 9 January 2020. Instead of matching individual lenders and borrowers, it pooled deposits into reserves that borrowers drew from. It also offered flash loans, which need no collateral.² A flash loan must be repaid, with a fee, before the transaction ends; otherwise the whole transaction is reverted.⁶

Token migration and V2

On 2 October 2020 LEND holders began migrating to a new token, AAVE, at 100 LEND per AAVE. The total supply of AAVE was set at 16 million: 13 million for the migration and 3 million for an Aave Ecosystem Reserve controlled by governance.⁷ The migration contract stayed open until the 2025 Aavenomics proposal moved to close it, reclaiming about 320,000 unclaimed AAVE.⁸

Version 2 launched in early December 2020. It represented debts as tokens, which allowed native credit delegation (lending one's borrowing power to another address), and let users trade collateral or repay loans with it. It added batch flash loans and a reserve factor that directs part of borrowers' interest to the DAO. A planned flash-loan-based tool was to let users move from V1 to V2 without closing positions.⁹

V3

The Aave Companies launched V3 on 16 March 2022 on six networks, with Ethereum to follow later. Its main additions were Portals, efficiency mode and isolation mode (see Technology).¹⁰

On 5 January 2022 Aave had launched Aave Arc, a permissioned version of the protocol for institutions. Fireblocks was the first "whitelister", vetting participants under know-your-customer checks, and approved 30 institutions at launch.¹¹

Lens Protocol

On 18 May 2022 Aave launched Lens Protocol, a social graph on Polygon in which profiles and content are held as NFTs in users' wallets, so that any app can build on them.¹² On 20 January 2026 Lens announced that Mask Network would take over its stewardship.¹³

GHO

GHO, a US dollar stablecoin, went live on Ethereum on 15 July 2023 after a DAO vote. Users mint it by borrowing against collateral they have supplied to Aave, and the interest it earns goes to the DAO treasury.¹⁴ Contracts approved by governance, called facilitators, can mint and burn GHO up to a cap that governance sets for each one.¹⁵

Horizon

Aave Labs launched Horizon on 26 August 2025. It is a separate, licensed instance of the protocol, forked from V3.3, in which qualified institutions borrow stablecoins against tokenised real-world assets. Only holders approved by the issuers of those assets can supply them, but anyone can supply the USDC, RLUSD and GHO that is lent out. Launch collateral came from Superstate and Centrifuge.¹⁶¹⁷

Aavenomics and buybacks

In March 2025 Marc Zeller of the Aave Chan Initiative (ACI), a governance service provider, proposed "Aavenomics". Its main parts were weekly AAVE buybacks run by a new Aave Finance Committee, a new bad-debt backstop called Umbrella, and directing some GHO revenue to AAVE stakers.⁸ On 9 April 2025 token holders approved a first US$4 million of buybacks, with over 99% in favour.¹⁸ Aave's documentation describes the later programme as having a US$50 million annual budget. The tokens it buys go to the Ecosystem Reserve rather than being burned.¹⁹ TokenLogic proposed on 22 April 2026 to pause the buybacks, which had stopped on 19 April after the rsETH incident (see below).²⁰

V4

Aave V4 went live on Ethereum on 30 March 2026 after an Aave Labs proposal passed a Snapshot vote and an on-chain AIP. It launched with three liquidity hubs (Core, Prime and Plus), conservative caps, and a Protocol Security Council able to pause and freeze markets while the code hardened. Audits were by Trail of Bits, Blackthorn and ChainSecurity.²¹ Aave Labs reported more than US$100 million in V4 deposits by May 2026.²²

Deployments

Aave runs as separate instances on many networks. When the protocol froze markets on 29 October 2026, the freeze covered V3 reserves on 16 networks and V4 reserves on four.²³ Some smaller instances have been retired, such as V3 on Scroll in April 2026.²⁴ The AAVE token itself is bridged to Arbitrum, Base, Optimism and Polygon.¹⁹

TechnologyReport an error

In V3, suppliers receive aTokens, interest-bearing tokens whose balance grows as borrowers pay interest. Borrowers' debts are tracked with debt tokens. Interest rates follow utilisation, the share of a pool that is lent out: they rise slowly up to an optimal point and steeply above it. A position whose health factor (collateral value against debt) falls below 1 can be partly repaid by a liquidator, who receives collateral at a discount.¹ V3 sets the flash loan fee at 0.05% at deployment, adjustable by governance.⁶

V3 introduced three features:

• Efficiency mode (eMode) gives a higher loan-to-value ratio when collateral and debt are in the same category of correlated assets, such as dollar stablecoins.¹ CoinDesk reported loan-to-value ratios of up to 98% in some cases at launch.¹⁰
• Isolation mode let governance list riskier assets as collateral under a debt ceiling and limited what could be borrowed against them. V3.7 removed it, replacing it with isolated eMode categories, in which only that category's collateral counts.¹
• Portals let approved bridges burn aTokens on one network and mint them on another.¹⁰

V4 replaces separate pools with a hub-and-spoke design. Liquidity hubs hold shared liquidity and give each spoke a limit for borrowing and supplying. Spokes are the modules users deal with; each sets its own risk parameters and can be added or removed without moving liquidity. Borrowers pay a risk premium based on the quality of their collateral. Liquidators repay only enough debt to bring a position back to a target health factor, and their bonus grows as the health factor falls.²⁵

Safety Module and Umbrella

By mid-October 2020, AAVE holders could stake in the Safety Module and earn AAVE rewards. Once the module was activated, up to 30% of the staked assets could be used to cover a shortfall in the protocol.⁷ Umbrella, proposed by BGD Labs in March 2025, lets users stake aTokens and GHO instead. If a pool has bad debt in an asset, stakes in that asset are burned automatically to cover it, without a governance vote.²⁶²⁷ Umbrella is live on Ethereum for USDC, USDT, WETH and GHO and is gradually replacing the Safety Module. Staked AAVE stays active during the transition, and its slashing is to be disabled once Umbrella is large enough.²⁷

GovernanceReport an error

Holders of AAVE, staked AAVE (stkAAVE) and supplied AAVE (aAAVE) can vote or delegate. Ethereum holds voting power, but voting can take place on lower-cost networks such as Polygon and Avalanche. In the standard process, a proposal is discussed on the forum as an Aave Request for Comments (ARFC), passes a binding Snapshot vote, and is then submitted on-chain as an Aave Improvement Proposal (AIP). Most AIPs use a short executor with a 1-day timelock. Changes to the token or to governance itself use a long executor with a 10-day vote and a 7-day timelock.⁴

Routine changes are made by stewards: service providers given limited powers to adjust parameters such as caps and interest rates without a full vote.⁴ Separate guardian multisigs can freeze markets in emergencies.²³

Much of the DAO's work is done by paid service providers. Gauntlet managed risk from 2020 until February 2024, when its co-founder John Morrow said it could no longer work with the DAO because of "inconsistent guidelines and unwritten objectives" among large stakeholders. Zeller said the ACI still supported having two risk providers, and argued that Gauntlet was using the dispute to justify seeking other business.²⁸ Chaos Labs, a risk manager since November 2022,²⁹ announced on 6 April 2026 that it was leaving. It cited departing contributors, V4's wider risk scope, and three years of running the engagement at a loss. Kulechov replied that the DAO had declined Chaos Labs' requests to be the sole risk provider and to expand its oracle role, though it had been willing to roughly double the budget.³⁰ As of October 2026 Aave's documentation names LlamaRisk as the risk service provider and Aave Labs as the technical service provider.⁴

Incidents and controversiesReport an error

• CRV short attempt (November 2022). Avraham Eisenberg, who had earlier exploited Mango Markets, borrowed tens of millions of CRV on Aave against USDC collateral. Blockchain analysts read this as an attempt to short the token. CRV's price then rose sharply, and his position was liquidated, leaving Aave with about US$1.6 million of bad debt.³¹³² Llama and Gauntlet proposed covering it from Gauntlet's insolvency fund and the treasury.³³
• wstETH oracle error (March 2026). On 10 March 2026 a mismatch between two settings in the CAPO oracle, which caps the price reported for wstETH, priced it about 2.85% below the market rate. About 10,938 wstETH across 34 accounts on Ethereum Core and Prime was wrongly liquidated. Chaos Labs, which wrote the post-mortem, said no bad debt arose.³⁴ An AIP to refund users from the treasury was executed in late March.³⁵
• rsETH exploit (April 2026). On 18 April 2026 an attacker forged a message on Kelp's LayerZero bridge, releasing 116,500 unbacked rsETH. The attacker deposited 89,567 rsETH on Aave and borrowed against it. Aave's contracts were not compromised. Guardians froze rsETH and then WETH on several markets, and service providers modelled bad debt of about US$124 million to US$230 million.³⁶ TokenLogic proposed that the treasury contribute 25,000 ETH, alongside donations and a credit facility from Mantle, in a "DeFi United" recovery effort.³⁷ The attacker's positions were liquidated on 6 May 2026. By 10 May WETH had been unfrozen on all active markets, with rsETH still frozen as a precaution.³⁸²²
• Binance hot wallet hack (October 2026). Binance said a hack on 29 October 2026 affected about US$6.3 billion in assets.³⁹ A wallet linked to the attacker supplied 60 million USDT to Aave and borrowed 19,762 WETH. Guardian multisigs then froze 175 V3 reserves on 16 networks and 117 V4 reserves on four networks; Horizon stayed open. LlamaRisk said the position was over-collateralised and did not put suppliers at risk.²³ As supplier withdrawals pushed the largest stablecoin pools to 92–100% utilisation, LlamaRisk proposed temporary cuts to their Slope2 interest-rate parameter⁴⁰ and lower borrow and draw caps ahead of a staged unfreeze.⁴¹ As of 30 October 2026 the markets remain frozen.²³
• Aave Labs and the DAO (2025–2026). In December 2025 a delegate found that fees from a new CoW Swap integration in Aave Labs' interface went to Aave Labs rather than the DAO. Zeller said Aave Labs, "in the pursuit of their own monetization", had redirected Aave user volume to competitors. Aave Labs said the interface it operated sat entirely outside the protocol the DAO stewards, and that the DAO governed the protocol's smart contracts.⁴²⁴³ Aave Labs then put to a Snapshot vote a proposal, written by Ernesto Boado of BGD Labs, to move the brand's domains, social accounts and code repositories under DAO control. Boado said it had been submitted without his knowledge; Aave Labs said the rules did not require his permission.⁴⁴ The vote failed, with over 55% against and over 41% abstaining.⁴⁵
• Funding dispute and departures (2026). In February 2026 Aave Labs proposed the "Aave Will Win" framework. It would send all revenue from Aave-branded products to the DAO, make V4 the core of the protocol, create a foundation to hold the trademarks, and fund Aave Labs. The temperature check passed on 1 March with 52.58% in favour. Zeller argued that without votes from addresses linked to Aave Labs it would have failed.⁴⁶ On 12 April 2026 the DAO approved US$25 million and 75,000 AAVE for Aave Labs, with about 75% support.⁴⁷ BGD Labs, which had maintained V3, left on 1 April 2026, objecting to plans to deprecate V3.⁴⁸ The ACI said on 3 March 2026 that it would wind down over four months, arguing that Labs-linked addresses had voted on their own budget.⁴⁹

TimelineReport an error

See alsoReport an error

• Ethereum
• Arbitrum, whose Security Council froze ETH from the rsETH exploit
• Uniswap
• Lido, issuer of the wstETH involved in the March 2026 oracle error
• USDC and Tether

ReferencesReport an error