TLDR:
- Aave V3.8 is now live across 15 Aave V3 markets following approval by the Aave DAO this week.
- The upgrade adds a reentrancy guard on Pool operations using transient storage, known as EIP-1153.
- Only active instances are in scope, while those with all assets frozen and caps at zero are excluded.
- V3.8 will be published under a Business Source License, with Certora and third parties auditing it.
Aave V3.8 is now live across 15 Aave V3 markets following approval by the Aave DAO. Aave Labs developed the release, which adds new layers of protection to the lending protocol.
The upgrade follows industry best practices and Aave DAO security standards. It focuses on security and introduces a reentrancy guard on Pool operations during external callbacks.
The release is described as measured and non-invasive, with minor changes to the existing system.
Reentrancy Guard Built on Transient Storage
The Aave V3.8 upgrade introduces a guard based on transient storage, known as EIP-1153. The guard protects Pool accounting consistency.
It also applies when a single transaction interacts with the Pool more than once. This protection covers Pool operations during external callbacks.
The proposal states that the changes are minor but worth applying to “make the system more robust and resilient going forward.” The guard aligns the pools with industry best practice.
In addition, it protects them against theoretical reentrancy exploits. Securing Aave V3 remains a top priority for the team.
Gas costs were historically a concern for this type of guard. However, recent developments like transient storage allow the protocol to be strengthened with little downside in efficiency. As a result, the guard can now be applied with little overhead.
In its announcement on X, Aave said the release “adds new layers of protection to Aave V3.” Moreover, the Aave DAO approved the proposal before deployment began. Further defense-in-depth improvements may be proposed in future upgrades.
Deployment Rollout and Licensing Details
The upgrade targets Aave V3 instances on Ethereum, covering Core and Lido. It also covers Plasma, Avalanche, BNB, Monad, Base, and Arbitrum. Mantle, X Layer, Polygon, Linea, and Optimism are included as well.
Gnosis, MegaETH, and Celo complete the list of targeted networks. Only active instances are in scope. Instances with all assets frozen and caps set to zero are excluded. Therefore, inactive instances remain unchanged.
Aave V3.8 will be published as its own version of the Licensed Work. It falls under a Business Source License, and the license text will be included in the V3.8 repository. Aave Governance sets the Change Date, which is recorded at v38.aavelicense.eth.
Until Governance sets a date, V3.8 stays under the Business Source License. The V3.8 IP will later move to the Aave Foundation through a separate governance proposal. Before the AIP, Aave V3.8 will go through audits by Certora and third parties. Additional security reviews are also being planned.
