Umbrella

Aave Umbrella is a modular, onchain risk management system that automates bad debt coverage for Aave v3 pools. Built by BGD Labs and approved by Aave governance, Umbrella introduces a more capital-efficient and automated way to protect the protocol without requiring governance intervention.

Umbrella allows users to stake two types of assets: aTokens (supplied tokens such as aUSDC, aUSDT, and aWETH) and GHO (Aave's native stablecoin). By staking these protocol assets, users actively contribute to risk management while earning rewards.

Umbrella enhances the reslience of the Aave Protocol by replacing the existing Safety Module with an automated staking system. If a deficit occurs in a given asset, Umbrella enables the corresponding staked assets to be burned and offset the bad debt, removing the need for governance decisions or manual intervention. This creates a more efficient, responsive, and predictable safety mechanism for the protocol and its users.

Umbrella can be interacted with using the Aave Labs Interface or BGD Labs Interface.

Automated Coverage: Eliminates reliance on governance for bad debt resolution by responding directly to measurable, onchain deficit data.

aToken Staking: Allows users to stake aTokens they already hold within Aave, continuing to earn underlying yield while participating in risk management.

Increased Efficiency: aTokens are the most capital-efficient assets to cover deficits. For example, burning aUSDT directly covers USDT bad debt without requiring market sales.

Enhanced Security: Creates a more resilient protocol by tying coverage directly to the borrow assets through an automated mechanisms.

With Umbrella, users who stake their aTokens continue earning yield on their supplied assets while gaining additional rewards for helping secure the protocol. For aToken staking (USDC, USDT, WETH), you earn dual yield streams. The underlying aToken yield continues accruing automatically in your staked position, while additional Safety Incentives compensate you for assuming slashing risk.

For GHO staking, you earn Safety Incentives directly since GHO doesn't generate underlying yield like aTokens. These rewards can be paid in various tokens like AAVE, GHO, or USDC, depending on governance configuration. Unlike automatic aToken yield, Safety Incentives must be actively claimed through blockchain transactions.

The rewards system uses a mathematically modeled Emission Curve that targets optimal staking levels. The system defines a target amount of staked assets and allocates maximum rewards when total staking reaches exactly that target. When total staked assets are below the target, rewards are proportionally higher to attract participation. When staking exceeds the target, rewards decrease slightly to discourage over-staking.

This creates a natural balancing mechanism that prevents extreme APY fluctuations. As a general rule, the maximum APY when minimal assets are staked is double the APY at target liquidity, but the curve avoids misleading triple-digit scenarios that disappear with increased participation.

In return for earning rewards, stakers accept the possibility of slashing if a deficit arises on the specific pool and asset they have staked. Staking risk is isolated to the specific asset and network where the aTokens are staked. For example, staking aUSDC helps cover bad debt in USDC only.

The system includes crucial deficit offset mechanisms that provide first-loss protection. For example, USDT staking has a 100,000 USDT offset, meaning the Aave DAO covers the first 100,000 USDT of bad debt before any staker assets are affected. While the protocol design allows for slashing up to the full staked amount in extreme scenarios, the offset mechanisms significantly reduce the likelihood of any slashing for typical deficit scenarios.

To put this in perspective, during the first month of Aave v3.3 operation, approximately $400 in total deficit accumulated across all pools, against nearly $9.5 billion in outstanding borrows. This represents roughly 0.000004% of outstanding borrowings.

Initial activation starts with Ethereum and will expand to other networks, focusing on high-borrow demand assets like USDC, USDT, WETH, and GHO. Activation parameters, including reward rates and target liquidity levels, are set by the Aave DAO, with ongoing management delegated to the Aave Finance Committee.

Each Umbrella deployment protects only the specific asset and network where it's staked, providing precise risk isolation. The system maintains a 20-day cooldown period and 2-day withdrawal window, consistent with the previous Safety Module.

Umbrella will gradually replace the legacy Safety Module. Current participants have different migration paths depending on their staked assets.

stkAAVE and stkABPT will remain active during the transition, with slashing disabled once Umbrella reaches sufficient scale. No immediate action is required for these positions.

Staked GHO (stkGHO) is being transitioned to savings GHO (sGHO) with new parameters that remove the cooldown period and slashing risk. This lets users earn yield on their GHO without the risk typically associated with Aave staked assets. For higher rewards with slashing risk, users can migrate to Umbrella stkGHO by first activating cooldown on legacy stkGHO, unstaking their GHO, then staking it in the new Umbrella system.

This empowers suppliers who aren't borrowing to participate in risk management while earning rewards, creating broader participation in protocol security and aligning incentives with protocol health.

See the Umbrella FAQ for more common questions.

Umbrella is built from three main contract types:

To participate, users deposit supported assets (wrapped aTokens or GHO) into the appropriate StakeToken contract. This action mints shares representing their position. The StakeToken uses an exchange rate that starts at 1:1 and only decreases if slashing occurs.

Staking can be performed with a standard ERC20 approve and deposit, or with EIP-2612 permit signature using depositWithPermit. Users may also set a cooldown operator to manage their cooldowns.

IERC20 underlying = IERC20(stakeToken.asset());underlying.approve(address(stakeToken), amount);stakeToken.deposit(amount, msg.sender);

To withdraw, users must first activate a cooldown by calling cooldown(). The cooldown period is 20 days (configurable by governance), followed by a 2-day unstake window. During cooldown, rewards continue to accrue and funds remain slashable. Only one cooldown record is allowed per user at a time. If a user transfers shares after activating cooldown, the amount available for withdrawal is reduced. Depositing more after cooldown does not affect the cooldowned amount.

After the cooldown period, users can withdraw within the unstake window using redeem or withdraw. If the window is missed, the cooldown must be restarted. Withdrawals are always subject to the current exchange rate, which may have changed due to slashing.

stakeToken.cooldown();// ...wait for cooldown period...stakeToken.redeem(shares, msg.sender, msg.sender);

Slashing is triggered automatically by UmbrellaCore when a deficit in the corresponding Aave pool exceeds the configured offset. Slashing reduces total assets in the StakeToken, lowering the value of all shares. The contract enforces a minimum assets floor to prevent full depletion. Only UmbrellaCore (the owner) can call slash, and slashed assets are sent to the Aave Collector for deficit coverage.

function slash(uint256 amount) external onlyOwner;

Rewards are managed by the RewardsController, which supports up to 8 reward tokens per StakeToken. Emission rates are governed by a piecewise linear curve, targeting optimal liquidity. Below the target liquidity, rewards are boosted to attract stakers; at target, emission is maximized; above target, emission tapers off to discourage over-staking. Governance sets up new assets and rewards, while a Rewards Admin can adjust emission rates and distribution end times.

Users can claim all available rewards for their assets at any time, or authorize a claimer to do so on their behalf.

rewardsController.claimAllRewards([address(stakeToken)], msg.sender);

To claim a specific reward:

rewardsController.claimRewards(    [address(stakeToken)],    amount,    msg.sender,    rewardToken);

To set a claimer:

rewardsController.setClaimer(user, claimer);