Skip to content

Security

Peace of mind by design.

6+ Years
Of protocol operation.
$4.65B+
In liquidations processed.
65+
Independent audits & reviews.
$146M
Umbrella insolvency backstop.
$5M+
Live bug bounty rewards.
SOC 2 Type 2
Annual security audit.

Governed by code, not companies.

The Aave DAO governs protocol upgrades through proposals, votes and timelocks. Stewards make routine changes within delegated limits, while Guardians can intervene in emergencies.

View Governance Portal
DAO-controlled upgrades
AAVE holders approve protocol upgrades through onchain AIPs. Stewards manage defined operations within DAO-set limits.
Proposal timelocks
Approved AIPs wait before execution: 1 day for Level 1 proposals and 7 days for Level 2 governance changes.
Governance Guardian
A 5-of-9 multisig can cancel malicious or erroneous proposals. A separate 4-of-7 Protocol Guardian handles emergencies.
Full transparency
Forum discussions and Snapshot votes are public. AIP votes and execution are recorded onchain.
Standard proposal lifecycle
Live Onchain

  1. ARFC review

    A public business case is discussed on the forum, with risk and technical assessments where applicable.

    4-day discussion

  2. Snapshot vote

    A binding offchain vote records the DAO’s decision before an AIP proceeds onchain.

    1-day delay3-day vote

  3. AIP on-chain vote

    Security providers review the payload. After creation, the AIP waits one day before onchain voting opens.

    3-day vote10 days for Level 2

  4. Monitoring + timelock

    Successful proposals enter a timelock. The Governance Guardian can cancel a malicious or erroneous proposal.

    1-day timelock7 days for Level 2

  5. Execution

    Any address can execute after the timelock, usually through automation. Cross-chain payloads use a.DI; unexecuted payloads expire.

Incident Response & Disclosure.

What happens when something goes wrong, and how fast. Public commitments at every step, ending with a post-mortem on the governance forum.

  1. Detect

    Continuous monitoring covers onchain activity, offchain infrastructure, and emerging risk signals 24/7.

  2. Triage

    Security and risk teams triage issues with Guardian responders ready.

  3. Remediate

    Specialists fix it; audit firms verify it.

  4. Disclose

    Every incident ends in a public post-mortem.

  1. Detect

    Continuous monitoring covers onchain activity, offchain infrastructure, and emerging risk signals 24/7.

  2. Triage

    Security and risk teams triage issues with Guardian responders ready.

  3. Remediate

    Specialists fix it; audit firms verify it.

  4. Disclose

    Every incident ends in a public post-mortem.

Protocol Transparency

Review deployed contracts, live parameters, access controls, and protocol changes.

Contract addressesFind deployed Aave Protocol contracts across every supported network.docs/resources/addressesLive parametersReview the current parameters that configure Aave markets and assets.docs/resources/parametersAccess controlsUnderstand the roles, permissions, and controls used by the protocol.docs/resources/access-controlsChangelogTrack changes to protocol deployments, configurations, and interfaces.docs/resources/changelog

Bug Bounties

Aave splits its bug bounty across specialist platforms. Each program covers a different part of the protocol. Find the one that matches what you found and submit.

Security
Assessment Brief

A comprehensive overview of Aave's security posture, governance controls, audit history, and incident response.

Download the PDF
branded shields for security assessment brief

Compliance & Auditing

Review independent protocol audits and Aave Labs’ SOC 2 Type II attestation covering organisational controls.

SOC-2 Type II

Mar 2026

Attestation letter can be supplied on demand

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

View Contracts

AI-Assisted Reviews

View More

Client Application

DDOS Protection

Advanced cloud-based DDoS protection services are used to identify and neutralize threats before they reach interface infrastructure.

Domain Protection

To safeguard the domain, DNSSEC is used to protect against DNS spoofing and ensure domain name requests are securely authenticated.

Intrusion Detection

The front-end employs state-of-the-art intrusion detection systems (IDS) that monitor for suspicious activities and potential threats, ensuring immediate detection and response to protect user data.

Modification Detection

Content Security Policy and Subresource Integrity checks are used to detect and prevent unauthorized modifications to front-end code.

IPFS Naming Records

Each commit of the Aave Interface codebase is automatically deployed to IPFS. The app.aave.com IPNS pointer and domain text records are continuously updated to reflect latest deployment hash using the DNSLink standard.

Security Insights.

Deep dives into how Aave approaches security, risk management, and protocol resilience, hand-picked for institutional readers.

Read More

AI-Assisted Security Review of Aave V3 & V4

Three AI security tools were run against Aave V3 and V4. Across 71 findings, no Critical or High severity issue was confirmed in either protocol.

Security by Design: Aave V4 Governance Security Update

How Aave V4 achieved zero high-severity findings across 345 days of security review, formal verification, and a 900-participant public contest.

How Aave Liquidations Perform Under Volatile Conditions

A data-driven look at Aave's $4.6 billion in historical liquidations, demonstrating the protocol's resilience across multiple market cycles and stress events.

Fire Drills

Regular simulated-incident exercises that stress-test the response process end-to-end, in public.

  • Annual large scale fire drill simulating high impact scenarios
    Passed
  • Quarterly emergency protocol guardian drills
    Passed

Dig Deeper

Code, governance, and documentation are all in the open.

ronnie working on a laptop with aave logo on it
GitHub
Protocol code, audits, and AIPs.
View on GitHub
ronnie holding a scratchpad and a pen hanging on the ear
Help & Support
Your questions answered.
Visit Help & Support
ronnie playing with blocks
Documentation
Architecture, contracts, integration.
Read the Docs

FAQs

Yes. Aave publishes independent audit reports, security reviews, and formal verification reports across protocol versions.

Audit reports are available on the Aave Security page. Deployed contracts are listed in the Aave docs and the Aave Address Book.

Smart contract risk cannot be eliminated. Aave mitigates it through open-source code, independent audits, formal verification, governance review, and bug bounties.

Protocol changes are governed by the Aave DAO through onchain proposals, voting, timelocks, and execution.

No central party can freeze or alter individual user positions. Certain reserve-level controls may be used only for protocol risk management.