Aave Umbrella

Aave Umbrella is a modular, onchain risk management system that automates bad debt coverage for Aave V3 pools. Umbrella introduces a more capital-efficient and automated way to protect the protocol without requiring governance intervention.

Umbrella allows users to stake two types of assets: aTokens (supplied tokens such as aUSDC, aUSDT, and aWETH) and GHO (Aave’s native stablecoin). By staking these protocol assets, users actively contribute to risk management while earning rewards.

Umbrella enhances the resilience of the Aave Protocol by replacing the existing Safety Module with an automated staking system. If a deficit occurs in a given asset, Umbrella enables the corresponding staked assets to be burned and offset the bad debt, removing the need for governance decisions or manual intervention. This creates a more efficient, responsive, and predictable safety mechanism for the protocol and its users.

Umbrella can be interacted with using the Aave Labs Interface.

Key Benefits

Automated Coverage: Eliminates reliance on governance for bad debt resolution by responding directly to measurable, onchain deficit data.

aToken Staking: Allows users to stake aTokens they already hold within Aave, continuing to earn underlying yield while participating in risk management. This empowers suppliers who aren’t borrowing to participate in risk management while earning rewards, creating broader participation in protocol security and aligning incentives with protocol health.

Increased Efficiency: aTokens are the most capital-efficient assets to cover deficits. For example, burning aUSDT directly covers USDT bad debt without requiring market sales.

Enhanced Security: Creates a more resilient protocol by tying coverage directly to the borrow assets through an automated mechanism.

Rewards and Safety Incentives

With Umbrella, users who stake their aTokens continue earning yield on their supplied assets while gaining additional rewards for helping secure the protocol. For aToken staking (USDC, USDT, WETH), you earn dual yield streams. The underlying aToken yield continues accruing automatically in your staked position, while additional Safety Incentives compensate you for assuming slashing risk.

For GHO staking, you earn Safety Incentives directly since GHO doesn’t generate underlying yield like aTokens. These rewards can be paid in various tokens like AAVE, GHO, or USDC, depending on governance configuration. Unlike automatic aToken yield, Safety Incentives must be actively claimed through blockchain transactions.

The rewards system uses a mathematically modeled Emission Curve that targets optimal staking levels. Total emission peaks when total staked assets reach the target. Below the target, fewer stakers share the emission, so APY per staker is higher; above the target, emission decreases to discourage over-staking.

This creates a natural balancing mechanism that prevents extreme APY fluctuations. As a general rule, the maximum APY when minimal assets are staked is double the APY at target liquidity, but the curve avoids misleading triple-digit scenarios that disappear with increased participation.

Slashing Risk and Deficit Protection

In return for earning rewards, stakers accept the possibility of slashing if a deficit arises on the specific pool and asset they have staked. Staking risk is isolated to the specific asset and network where the aTokens are staked. For example, staking aUSDC helps cover bad debt in USDC only.

The system includes crucial deficit offset mechanisms that provide first-loss protection. For example, USDT staking has a 100,000 USDT offset, meaning the Aave DAO covers the first 100,000 USDT of bad debt before any staker assets are affected. While the protocol design allows for slashing up to the full staked amount in extreme scenarios, the offset mechanisms significantly reduce the likelihood of any slashing for typical deficit scenarios.

Network Coverage and Initial Activation

Umbrella is active on Ethereum for USDC, USDT, WETH and GHO. Activation parameters, including reward rates and target liquidity levels, are set by the Aave DAO, with ongoing management delegated to the Aave Finance Committee.

Each Umbrella deployment protects only the specific asset and network where it’s staked, providing precise risk isolation. The system maintains a 20-day cooldown period and 2-day withdrawal window, consistent with the previous Safety Module.

Transition from the Legacy Safety Module

Umbrella will gradually replace the legacy Safety Module. Current participants have different migration paths depending on their staked assets.

stkAAVE and stkABPT will remain active during the transition, with slashing disabled once Umbrella reaches sufficient scale. No immediate action is required for these positions.

Staked GHO (stkGHO) is being transitioned to the new savings GHO (sGHO), a native ERC-4626 vault that earns a fixed APR via an onchain yield index with no cooldown period, no slashing risk, and no rehypothecation. Users should withdraw GHO from the legacy stkGHO contract and deposit into the new sGHO vault. See the sGHO guide for integration details. For higher rewards with slashing risk, users can instead migrate to Umbrella stkGHO by activating cooldown on legacy stkGHO, unstaking their GHO, then staking in the new Umbrella system.

See the Umbrella FAQ for more common questions.

Architecture

Umbrella is built from four main contract types:

• UmbrellaCore: Orchestrates deficit monitoring, slashing, and asset coverage for each Aave V3 pool.
• StakeToken: ERC-4626 vault per asset and network that handles staking, cooldown, slashing, and integrates with the rewards controller.
• RewardsController: Manages multi-token rewards, emission curves, and user reward accounting.
• UmbrellaBatchHelper: Periphery contract enabling multiple actions to be batched into a single transaction.

Staking

To participate, users deposit supported assets (wrapped aTokens or GHO) into the appropriate StakeToken contract. This action mints shares representing their position. The StakeToken uses an exchange rate that starts at 1:1 and only decreases if slashing occurs.

StakeTokens hold wrapped aTokens (stataTokens). UmbrellaBatchHelper wraps plain aTokens and stakes them in one transaction.

Staking can be performed with a standard ERC-20 approve and deposit, or with EIP-2612 permit signature using depositWithPermit. Users may also set a cooldown operator to manage their cooldowns.

IERC20 underlying = IERC20(stakeToken.asset());
underlying.approve(address(stakeToken), amount);
stakeToken.deposit(amount, msg.sender);

Unstaking

To withdraw, users must first activate a cooldown by calling cooldown(). The cooldown period is 20 days (configurable by governance), followed by a 2-day unstake window. During cooldown, rewards continue to accrue and funds remain slashable. Only one cooldown record is allowed per user at a time. If a user transfers shares after activating cooldown, the amount available for withdrawal is reduced. Depositing more after cooldown does not affect the cooldowned amount.

After the cooldown period, users can withdraw within the unstake window using redeem or withdraw. If the window is missed, the cooldown must be restarted. Withdrawals are always subject to the current exchange rate, which may have changed due to slashing.

stakeToken.cooldown();
// …wait for cooldown period…
stakeToken.redeem(shares, msg.sender, msg.sender);

Slashing

Slashing is triggered automatically by UmbrellaCore when a deficit in the corresponding Aave pool exceeds the configured offset. Slashing reduces total assets in the StakeToken, lowering the value of all shares. The contract enforces a minimum assets floor to prevent full depletion. Only UmbrellaCore (the owner) can call slash, and slashed assets are sent to the Aave Collector for deficit coverage.

function slash(address destination, uint256 amount) external onlyOwner returns (uint256);

Rewards

Rewards are managed by the RewardsController, which supports up to 8 reward tokens per StakeToken. Emission rates follow the piecewise linear Emission Curve. Governance sets up new assets and rewards, while a Rewards Admin can adjust emission rates and distribution end times.

Users can claim all available rewards for their assets at any time, or authorize a claimer to do so on their behalf.

rewardsController.claimAllRewards(address(stakeToken), msg.sender);

To claim a specific reward:

address[] memory rewards = new address[](1);
rewards[0] = rewardToken;
rewardsController.claimSelectedRewards(address(stakeToken), rewards, msg.sender);

To set a claimer:

rewardsController.setClaimer(claimer, true);

Deployed Contracts

Resources

• Smart Contracts
• Frontend Implementation