TL;DR
Aave V3 is over-collateralized lending. You supply an asset, someone else borrows against collateral, and borrower interest is the yield. The core contracts have still never been directly exploited, the audit registry is the deepest in lending, and governance sits behind real timelocks with Guardian multisigs that can pause and freeze.
Two things in this report are corrections rather than updates, and they point in opposite directions.
The first is good news we got wrong twice. The audit registry holds 49 files, not 40, and it contains a complete v3.7 release reviewed by six firms between 26 and 31 March 2026. GitHub's commit history settles the question the draft left open: commit 7e728cb5, dated 2026-03-31, added all six v3.7 files, and nothing has touched that directory since. They were sitting there on 5 August. The August report simply miscounted, and its closing line that the newest audit was nine months old was wrong when it was written.
The second correction is the reason this report exists. The April bad debt is still on Aave's books. We read getReserveDeficit(WETH) on the Aave V3 Ethereum Core Pool and it returns 52,964.45 WETH, roughly $139M at today's price. At the ETH price of the week it was recognized, that is $91.8M, which is the April incident report's own scenario-1 figure almost to the dollar. Archive reads put it at zero on 30 April, at 52,964.44 by 13 May, and at 52,964.45 from 25 May through today. Four months, not one wei eliminated. Because the WETH reserve shrank while the hole did not, it has grown from about 1.54% of the aWETH supply to 2.51%.
The last two reports said the April make-whole was complete. That was a conflation. Kelp's rsETH backing was fully restored on 26 May. Aave's WETH reserve deficit was not, and the two are different claims about different balance sheets. Track record goes to red on that basis.
Read the TVL rise carefully, because the obvious reading is wrong. TVL is $18.058B, up 29.3% from the $13.966B the August report printed. Over the same window ETH rose 40.4%. Measured in units rather than dollars, the ETH-family deposit base is flat, up 1.25%. The dollar figure went up because collateral got more expensive, not because depositors came back.
Checklist
Audits and contracts. Re-pulled this run from the aave-dao/aave-v3-origin audits directory: 49 files against the 40 recorded on 5 August. Two things the prior report missed. v3.6 carries five audits, not two: Blackthorn (16 Nov 2025), Certora, MixBytes and Savant (all 18 Nov 2025) and Pashov (29 Nov 2025). And there is an entire v3.7 release, audited by MixBytes and Sherlock (26 March 2026), Pashov (27 March), Certora (29 March), Savant (30 March) and Enigma (31 March). Six firms on one release. The commits API resolves what a directory listing could not: the v3.7 files were committed on 2026-03-31 and the directory has been untouched since, so this is a miss by our August run rather than a change at Aave. The standing caveat retires either way. The newest audit is about six months old, and the codebase has moved a release past where the last two reports placed it. Corroborating that, the governance forum carries an 11 September ARFC on "Unified Handling of the Isolated Flag in Aave V3.7 E-Modes", so v3.7 is the live line, not a branch. The core lending logic has still never been directly exploited, and the Immunefi bounty runs up to $1M.
Admin control. Held at yellow, and this run the machinery was read from the chain rather than the documentation. The Protocol Guardian Safe at 0x2CFe3ec4d5a6811f4B8067F0DE7e47DfA938Aa30 returns a threshold of 4 against 7 owners. The Governance Guardian Safe at 0xCe52ab41C40575B072A18C9700091Ccbe4A06710 returns 5 against 9. Both match what the prior report claimed, now verified rather than repeated. The timelock of either one day or seven days is still a documentation read, not a contract read.
The fast parameter path is what keeps this off green, and the numbers in the brief were wrong in the protocol's favour. Reading getRiskConfig() on the mainnet RiskSteward at 0x13a9CC64344b02bACC5AD9Cf38B5711F1B9ec3d4, supply caps and borrow caps each carry a maximum change of 100% of the current value with a minimum delay of 1.5 days, not 50% every 5 days. A cap can double every 36 hours, in either direction, with no community vote and outside the one-day timelock. The same contract can move collateral LTV, liquidation threshold and liquidation bonus by 0.50 percentage points every 3 days, which is five points of liquidation threshold in a month, and it can move the CAPO liquid-staking price cap by 5% every 3 days. That last one is the parameter family that caused the March liquidations. Activity is routine rather than rising: Risk Steward posts landed on 2 September and then on the 4th, 7th, 9th, 11th, 15th, 16th and 18th, which is the same roughly two-day cadence the forum carried through July. The concern is the width of the envelope, not a recent acceleration.
One more item, unmentioned anywhere else and unanswered nine days on. On 11 September an independent researcher posted that one signer on the 5-of-9 Governance Guardian Safe also sits on DeFi Saver's 3-of-6 admin Safe, verified by getOwners() on both. It is a correlation in an emergency-veto multisig, not an exploit, and five signatures are still needed. It has drawn no reply from Aave.
Oracle. Held at yellow, with the incident closed out and a new wrinkle. Chainlink feeds are wrapped in Aave's CAPO, which caps the growth rate of liquid staking tokens and pins stablecoins to a ceiling. March's failure is remediated: caps were temporarily cut, the snapshot parameters manually realigned, and compensation ran through a Direct-to-AIP. Better than the draft recorded, remediation did not stop there. On 5 May LlamaRisk proposed a snapshotRatio update across all of Aave V3, and on 29 May the payloads executed.
That proposal is also why this is not green. It reported snapshots between 458 and 810 days stale, with the gap between the CAPO upper bound and the live ratio reaching 52.31% on Ethereum Core and Prime sUSDe. March was CAPO pricing collateral too low and liquidating solvent users; this is CAPO permitting collateral to be priced too high and admitting bad debt. Both directions are live, the remedy on record is a one-time refresh with no automated cadence we could confirm, and a steward can move the LST cap 5% every 3 days in between. Separately, a 15 September test run reports that on the Aave read path it exercised, nothing rejects a price for being stale: a timestamp made unreadable, and then thirty days old, changed nothing about the price returned. That test replaced the Chainlink feed with a stand-in, so the feed's own acceptance rules never ran, and the finding is about Aave's read path rather than the oracle end to end.
Liquidity and exit. Deepest book in lending at $18.058B and comfortably the top of the market. It is also 70.3% of the $25.668B sitting there the day before the April exploit and 39.7% of the $45.444B October 2025 peak. Two things qualify the depth. First, the WETH reserve is under-backed by 52,964.45 WETH against an aWETH supply of 2,109,367, or 2.51%. Ordinary withdrawals work; the deficit is an accounting hole, not a queue. But the reserve owes 2.51% more WETH than it holds, and until someone eliminates it the last claims out are the ones that cannot be paid.
Second, an independent assessment posted 15 September models mainnet wstETH liquidation capacity and returns INDETERMINATE. It sizes a 99th-percentile liquidation at $7.15M of debt against $7.58M of collateral, finds only about $1.29M can be financed atomically through flash loans, and says the remaining $5.86M needs capital it cannot establish exists. The 6% liquidation bonus covers the tested size with roughly half a point to spare, but stops covering the worst regime at about $22.85M of repayment, and the average of the worst 1% of scenarios is $24.14M, where the required bonus is 6.0414% against the 6% available. Note the standing of this document: it is a community post by an author who states plainly that it is independent, unaffiliated with Aave Labs, the DAO or its service providers, and not a safety verdict. It has no replies. It is careful, reproducible work, not an Aave risk-provider finding, and the draft overstated it.
The ordinary exit constraints still apply. A fully utilized reserve means waiting on repayments, and the 4-of-7 Guardian can freeze a market immediately. The low-adoption asset deprecation ARFC from 29 July is still open with activity into 16 September and no on-chain execution confirmed, so if you hold a position on a long-tail reserve or a smaller deployment, plan an exit rather than assuming the market persists.
Yield: real versus emission. Real. Borrower interest paid into the reserve, not token emissions. GHO, the native over-collateralized stablecoin, adds protocol revenue.
Holder concentration. Dark for a third consecutive month. Etherscan's top-holders endpoint returned the API Pro error again on 2026-09-20, the same failure as August and July. What did refresh: AAVE circulating supply is 15,428,077.06 of a 16,000,000 max, up about 5,900 tokens on the month, at $140.65 for a market cap near $2.169B. The token is up about 54% since the last report while the protocol's unit deposit base stood still. Governance sets risk parameters and approves listings, which is precisely the surface that failed in April, so an unverified voter distribution is a real gap.
Track record. Downgraded to red, on evidence rather than on sentiment. The positive check first: we queried the DeFiLlama hacks registry rather than relying on silence, and it lists exactly two Aave entries ever, August 2024 at $56k and the March 2026 oracle misconfiguration at $862k. Nothing new in August or September 2026. The forum listing agrees.
What moves this to red is that the worst of the three episodes is still open on the protocol's own books. The 2022 CRV short squeeze (about $1.6M, cleared by the DAO via AIP-144) is closed. The March 2026 CAPO misconfiguration ($21.7M to $27M of wrongful liquidations across about 34 accounts, no protocol bad debt) is closed and compensated. The April 2026 rsETH contagion is not. The deficit was recognized on the Ethereum WETH reserve between 30 April and 13 May 2026 at 52,964.45 WETH and has not moved since. Read at four blocks spanning April to today, and on two independent nodes at the current block, it is identical. The DAO has not eliminated it, Umbrella has not absorbed it, and four months of ETH appreciation have turned a $91.8M hole into a $139M one.
The legal tail is also still untied. Roughly $71M of ETH has not moved since early May 2026, when Judge Margaret Garnett modified but did not vacate the restraining notice, allowed the transfer to an Aave-controlled wallet, and bound Aave to the notice as if served directly. Arbitrum delegates then voted the release through with about 91% support. The terrorism judgment creditors, holding three US judgments against North Korea totalling more than $877M before interest, kept their claim, and the merits were left unresolved. Nothing later surfaced in this run's searches, which is absence of reporting rather than a docket check.
Worst case
There are two, they are unrelated, and 2026 delivered both.
The first is collateral contagion. An asset Aave lists loses its backing through a flaw outside Aave, someone borrows against collateral that is now worthless, and the shortfall lands on the reserve you deposited into. That is April, and the important thing to understand this month is that it is not a story about the past. If you supply WETH to Aave V3 on Ethereum today, the reserve you are supplying into is 2.51% short, and has been for four months.
That surface is worth measuring rather than describing. Over the last six weeks the composition of Aave V3 shifted hard. Ethena's USDe went from about 326M units to about 1,122M, a rise of roughly 245% and close to $800M of new supply, while USDT fell 73.6%, syrupUSDT fell 50.5%, syrupUSDC fell 42.9%, GHO fell 39.1% and sUSDe fell 25.8%. USDe alone is now about 6.2% of the book, with sUSDe's 420M units on top. This is deliberate: Aave V4's architecture includes a hub framed around Ethena ecosystem activity, and a USDe listing on Avalanche went to Direct-to-AIP on 1 September. USDe is a far more liquid and better understood asset than rsETH was, and the post-April tier framework exists to bound exactly this. It remains true that the largest concentration change on Aave V3 this month was into a synthetic dollar whose backing is a basis trade.
Inside the flat ETH-family number there is a second shift worth naming. The aggregate is up 1.25% in units, but WETH itself is down 19.5% while weETH is up 15.7%. The reserve that took the April hit is the one depositors have been leaving.
The second worst case is that Aave's own risk automation misprices your collateral and liquidates you while you are solvent. That is March. There is no warning, and the window between a bad parameter landing and liquidation was one block plus minutes. Compensation arrived afterward, by governance decision, not by contract.
The designed backstop for the first case is Umbrella, which slashes staked aTokens or GHO once a pool's deficit clears a per-asset offset. In April, reporting put its capacity at roughly $80M to $100M against a modeled deficit of $123.7M to $230.1M. What the live deficit tells you is that whatever was or was not slashed, the hole was not closed. Aave's own April incident thread discussed pausing the WETH Umbrella module precisely so that a realized deficit would not trigger automatic slashing, leaving coverage to be handled manually through governance. Five months on, manually through governance has meant not yet.
Note where the backstop work is going. A TokenLogic ARFC dated 11 September would establish Umbrella coverage for Core WETH, USDC and USDT in Aave V4, with deficit offsets absorbed before independent underwriters. It is thoughtful, and it is V4 scope. The backstop is being designed for the new system while the old system's deficit sits unpaid. There is no equivalent backstop at all for the second case.
The lesson stands and has sharpened. In the tail, your protection may depend on an ecosystem rescue that nobody owes you and no contract guarantees, and the rescue may restore the collateral without ever closing the hole in your reserve.
Bottom line
Caution, held for a third month, but the shape of it changed.
Two things genuinely improved. The audit position is stronger than we reported: six firms reviewed v3.7 in March 2026, the registry runs to 49 files, and the nine-month-old-audit line that closed the last report was never true. And the oracle remediation went further than we credited, with a protocol-wide snapshot refresh executed on 29 May.
Against that, the central claim of the last two reports does not survive contact with the chain. The April make-whole is not complete. Aave's Ethereum WETH reserve carries a 52,964.45 WETH deficit, about $139M, recognized in early May and untouched for four months, now 2.51% of that reserve against 1.54% in April. Restored rsETH backing was reported as if it settled Aave's books. It did not, and nobody should have to read a pool contract to find that out.
Everything else compounds rather than offsets. The fast parameter path is twice as permissive as the brief believed, with caps movable 100% every 1.5 days and liquidation thresholds movable half a point every 3 days without a vote. Whether a mid-sized wstETH liquidation can actually be financed is unresolved. One Governance Guardian signer holds keys at an unrelated protocol, unanswered for nine days. The roughly $71M of recovered ETH has been legally contested since May. Holder concentration has been unreadable for three months running. Worst-flaw-wins does not average these away.
On the number that will tempt people most: a 29.3% TVL rise against a 40.4% ETH rise, with the ETH-family deposit base flat in units and WETH specifically down 19.5%, is not recovery. It is a smaller book, marked higher.
This is still one of the safest venues in DeFi on contract security and audit depth, and the yield is real. Prefer Core and Prime with blue-chip collateral, stay out of the long tail and the deployments queued for deprecation, size for collateral contagion rather than assuming a rescue, and keep health factors well clear of the liquidation threshold so that neither a 2.85% oracle error nor a half-point steward move can reach you. Re-check next month: whether the WETH deficit has finally been eliminated, the court docket, the live CAPO config and whether snapshots are drifting again, holder concentration, whether the Guardian signer overlap draws a response, and whether USDe concentration keeps climbing.
Data appendix
- TVL: $18,057,726,281.73 (DeFiLlama, aave-v3 slug, api.llama.fi/tvl/aave-v3, 2026-09-20, confirmed against the protocol endpoint's latest point at 2026-09-19 20:53 UTC). Scope note: this is the
aave-v3child only, the correct scope for this report. It deliberately excludes aave-v4 ($563,385,095, verified separately this run), aave-v2 ($110,729,482, also verified), aave-horizon-rwa, aave-v1, aave-aptos and aave-arc, all siblings under parent#aave. - Month-over-month basis, stated explicitly: the August report printed $13,965,738,414, giving +29.3%. The API's backfilled value for 2026-08-05 is $13.9902B, giving +29.1%. This report uses 29.3% throughout, measured against the figure the August report actually printed.
- TVL context: 90d ($12.3684B on 2026-06-22): +46.0%. Pre-exploit $25.6684B on 2026-04-17, so today is 70.3% of that. ATH $45.4439B on 2025-10-07, so today is 39.7% of peak. Recent daily prints: $16.8146B (09-18), $17.7661B (09-19), $18.0577B (current).
- TVL move versus collateral price: ETH went $1,868.62 on 2026-08-05 to $2,624.47 at this pull (+40.4%, DeFiLlama coins API) while TVL rose 29.3%. The 09-19 daily close was $2,611.56, giving +39.8% on that pair. The one-day jump from $16.815B to $18.058B tracks ETH's move from $2,446.14 on 09-18, so it is price, not an inflow event.
- Unit-denominated deposit base (own computation from DeFiLlama's per-chain
tokensarrays, 21 plain chain keys with theborrowedaggregate excluded, 2026-08-05 versus 2026-09-20): ETH-family units (WETH, wstETH, weETH, ezETH, rsETH, cbETH, osETH, ETH, rETH) 3,191,385 to 3,231,385, +1.25%. A broader ETH-ish basket including ETHx, tETH, wrsETH, xBETH and xETH gives 3,231,572 to 3,267,173, +1.10%, same conclusion. Within the aggregate: WETH 432,436 to 348,053 (-19.5%), weETH 1,181,266 to 1,367,117 (+15.7%), wstETH 999,584 to 956,471 (-4.3%), rsETH 380,997 to 351,413 (-7.8%). - Reserve composition shift (same computation): USDe 325,847,513 to 1,122,464,929 units (+244.5%, roughly +$800M, now about 6.2% of the book); sUSDe 566,446,753 to 420,196,135 (-25.8%); USDT 378,152,703 to 99,652,234 (-73.6%); syrupUSDT 324,854,626 to 160,931,052 (-50.5%); syrupUSDC 200,510,078 to 114,493,422 (-42.9%); USDC 280,092,575 to 257,801,811 (-8.0%); GHO 67,560,917 to 41,175,175 (-39.1%); PT-sUSDe-22OCT2026 153,098,616 to 58,191,473 (-62.0%). New this month: PT-aUSD-8OCT2026 (67,794,407) and PT-USDG-29OCT2026 (65,255,599). Aggregated across chains by symbol, so directional rather than exact.
- WETH reserve deficit (new this report, the central finding):
getReserveDeficit(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2)on the Aave V3 Ethereum Core Pool 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2 returns 52,964.45 WETH at block 26,014,640, identical on ethereum-rpc.publicnode.com and eth.drpc.org. Against an aWETH (0x4d5F47FA6A74757f35C14fD3a6Ef8E3C9BC514E8) total supply of 2,109,367.00, that is 2.51% of the reserve, about $139.0M at $2,624.47. Archive reads on drpc: 0.00 at blocks dated 2026-04-19, 2026-04-24 and 2026-04-30; 52,964.44 at 2026-05-13; 52,964.45 at 2026-05-25, at block 25,352,240 (~June), at block 25,700,000 (~August) and now. At $1,733 per ETH the figure equals $91.8M, matching the April incident report's scenario-1 estimate of about $91.79M on the Ethereum WETH reserve, then about 1.54% of aToken supply. Same-call deficits: rsETH 0, wstETH 0.0069, USDC 1.60, USDT 0.85, all negligible. - AAVE token: circulating 15,428,077.06 of a 16,000,000 max, price $140.65, market cap $2.1690B (CoinGecko, last_updated 2026-09-19 22:36 UTC). August: 15,422,150.53 at $91.35, mcap $1.4086B, so about +54% on price.
- Audits (re-pulled 2026-09-20 via the GitHub contents API on aave-dao/aave-v3-origin/audits, 49 files, was recorded as 40 on 2026-08-05): v3.0 OpenZeppelin, Trail of Bits, PeckShield, Certora, ABDK, SigmaPrime (2021-11 to 2022-01); v3.0.1/3.0.2 PeckShield, SigmaPrime, Certora (2022-12 to 2023-04); v3.1 Certora, MixBytes, Cantina contest (2024-04 to 2024-06); v3.2 Certora (x3, including stable-rate removal and liquid eModes), Oxorio, Pashov, Enigma (2024-09); v3.3 StErMi, Certora, Sherlock, Oxorio (2024-10 to 2025-01); v3.4 Enigma, Certora (x2), StErMi (x2), Blackthorn (2025-05 to 2025-06); v3.5 Certora, ABDK, StErMi, MixBytes (2025-07); v3.6 Blackthorn 2025-11-16, Certora 2025-11-18, MixBytes 2025-11-18, Savant 2025-11-18, Pashov 2025-11-29; v3.7 MixBytes 2026-03-26, Sherlock 2026-03-26, Pashov 2026-03-27, Certora 2026-03-29, Savant 2026-03-30, Enigma 2026-03-31. Plus MixBytes on StataToken/waToken and Certora on Collector.
- Audit corrections versus the August report, now fully resolved: the registry is 49 files, not 40. v3.6 carries five audits, not two. An entire v3.7 release exists. GitHub commit 7e728cb5, dated 2026-03-31T13:28:33Z, added all six v3.7 PDFs, and the commits API shows no commit touching the
auditspath since. The files were therefore present on 2026-08-05, and the August miscount and its nine-month-old-audit caveat were errors in that run rather than a change at Aave. This closes the item the draft left open. - Admin, verified on-chain 2026-09-20: Protocol Guardian 0x2CFe3ec4d5a6811f4B8067F0DE7e47DfA938Aa30,
getThreshold()4,getOwners()7 entries. Governance Guardian 0xCe52ab41C40575B072A18C9700091Ccbe4A06710,getThreshold()5,getOwners()9 entries. Both read twice. Executor timelock of one day or seven days re-confirmed from aave.com/docs/primitives/governance, a documentation read only; on-chain re-verification of the exact delays is refresh. - Risk Steward bounds, read on-chain and correcting the draft:
getRiskConfig()on RISK_STEWARD 0x13a9CC64344b02bACC5AD9Cf38B5711F1B9ec3d4 (Aave V3 Ethereum Core, listed as not upgradeable). Relative bounds, computed against the current value: supplyCap 100% and borrowCap 100%, each with a 1.5-day minimum delay; priceCapLst 5% and priceCapStable 0.5%, each 3 days. Absolute bounds: collateral LTV, liquidationThreshold and liquidationBonus 0.50 percentage points each, 3 days; eMode liquidationThreshold 0.10 points, eMode LTV and liquidationBonus 0.50 points, 3 days; baseVariableBorrowRate and variableRateSlope1 1.00 point, variableRateSlope2 20.00 points, optimalUsageRatio 3.00 points, all 1.5 days; discountRatePendle 2 days. Relative versus absolute is set per parameter by anisChangeRelativeflag and confirmed in_updateWithinAllowedRange. The draft's "50% every 5 days" does not match this contract. Scope: one steward on one instance; Aave V3 Ethereum also lists CLINIC_STEWARD, SVR_STEWARD, POOL_EXPOSURE_STEWARD, COLLECTOR_SWAP_STEWARD and three EDGE_RISK_STEWARD contracts whose configs were not read this run. - Risk Steward activity, correcting the draft's "busier than ever": "Risk Stewards: Cap and IRM Changes on Aave V3" posts on 2026-09-02, 09-04, 09-07, 09-09, 09-11, 09-15, 09-16 and 09-18, plus "[Risk Stewards] September 2026 WETH Interest Rate Adjustment on Base" (09-18), "[Risk Stewards] Monad Stablecoin IRM Adjustments" (09-11) and an August stablecoin batch (09-15). Comparable posts exist for 2026-07-05, 07-07, 07-13, 07-14, 07-15, 07-18 and 07-20. The cadence is steady state, not an increase.
- Governance Guardian signer overlap (new this report): governance.aave.com topic 25626, 2026-09-11, by an independent researcher. Reports that DeFi Saver's admin Safe (0x25eFA336886C74eA8E282ac466BdCd0199f85BB9, 3-of-6) shares one signer with the Aave Governance Guardian Ethereum Safe (0xCe52ab41C40575B072A18C9700091Ccbe4A06710, 5-of-9), both re-verified by the author via
getOwners(). One post, no replies as of this pull. We verified the Aave Safe's threshold and owner count independently but did not re-run the cross-protocol signer comparison. - Emergency pause or freeze, August to September 2026: none surfaced in the governance forum listing or the news scan. Recorded as not found rather than confirmed absent: refresh.
- Oracle: Chainlink plus CAPO, rate caps on liquid staking tokens and fixed caps on stablecoins. March 2026 incident remediated via temporary wstETH borrow cap cuts and manual snapshot realignment, with reimbursement through the Direct-to-AIP "wstETH CAPO Oracle Incident User Reimbursement" (topic 24275, created 2026-03-11). New this report: "[Direct-to-AIP] CAPO SnapshotRatio Update Across Aave V3" (topic 24854, 2026-05-05, LlamaRisk), which reported snapshots 458 to 810 days stale and CAPO-bound-to-ratio spreads up to 52.31% (Ethereum Core and Prime sUSDe), 13.84% (Polygon wstETH), 13.81% (Ethereum Core rETH) and similar; the Snapshot vote passed and payloads executed, confirmed in-thread 2026-05-29. No structural change to how snapshots stay in sync was confirmed, and the live CAPO config was not re-pulled: refresh.
- Oracle read-path staleness (new this report): the 15 September assessment reports that substituting the ETH/USD feed with a stand-in and forcing values through it, Aave returned the matching low price every time, and that making the timestamp unreadable and then thirty days old did not change the returned price, so nothing on the tested path rejects a stale price. Zero or negative values make the read fail outright. The author notes the stand-in bypasses the real feed's own acceptance rules, one of which is an on-chain floor of one hundred-millionth of a dollar.
- Holder concentration: refresh. Etherscan tokenTopHolders on 0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9 returned NOTOK, "API Pro endpoint required", again on 2026-09-20. Third consecutive month unverified.
- Liquidity assessment (new this report, with its standing corrected): "Mainnet wstETH Liquidation Assessment: Financing Remains Unverified", governance.aave.com topic 25643, 2026-09-15, at block 25,780,402. Four tests: oracle can show the crash PASS, simultaneous repayment PASS, money to repay INDETERMINATE, bonus adequate PASS. Overall INDETERMINATE. 99th-percentile liquidation $7.15M debt against $7.58M collateral; worst-1% average $24.14M and $25.59M; atomic flash-loan ceiling about $1.29M; residual $5.86M unfunded. Liquidation bonus fixed at 6% against a break-even of 5.35% to 5.50% selling into the market or 4.35% with primary redemption; coverage fails at about $22.85M of repayment, and at the worst-1% average the required bonus is 6.0414%, 4.14 basis points above what is available. The author states the work is independent, unaffiliated with Aave Labs, the DAO or its service providers, and not a parameter recommendation or safety verdict. One post, no replies. The draft presented this as an Aave governance assessment; it is an independent post on Aave's forum.
- Backstop: Umbrella slashes staked aTokens (aUSDC, aUSDT, aWETH) or GHO past a per-asset offset and routes proceeds to the Aave Collector. April 2026 reporting put capacity at about $80M to $100M (one source says about $50M) against a modeled $123.7M to $230.1M deficit. Aave's own rsETH incident thread (topic 24580) discusses pausing the WETH Umbrella module as a hard freeze, noting that a paused module is no longer counted as slashable when a reserve realizes a deficit, so coverage would need to be handled manually through governance. Whether the pause was enacted and whether any slashing executed: refresh. What is now established is that the deficit was never eliminated by any route.
- Backstop, V4 scope, correcting a double count: "[ARFC] Umbrella on Aave v4: Coverage Framework and Initial Market Parametrization", topic 25623, created 2026-09-11 by TokenLogic, recommends general-purpose Umbrella markets for Core WETH, Core USDC and Core USDT, with deficit offsets and underwriter opportunity cost in the framework. The draft described a TokenLogic proposal dated 11 September and a separate companion Umbrella framework dated 12 September; these are one proposal, dated 2026-09-11. The thread notes Aave v4 borrowing is concentrated in WETH, USDG, USDC, USDT and frxUSD.
- April 2026 event status: rsETH backing fully restored 2026-05-26 across five tranches per the August report. The Aave WETH reserve deficit is separately confirmed outstanding at 52,964.45 WETH, so the two claims must not be merged. The "[ARFC] rsETH Incident Funding Update" thread read this run still shows April-dated proposal-stage content, with no later resolution post visible.
- April 2026 event, open legal item: 30,765.67 ETH, about $71M. In early May 2026 (reported 2026-05-09) Judge Margaret Garnett (SDNY) modified but did not vacate the restraining notice, permitting an Arbitrum governance vote to move the ETH to an Aave-controlled wallet with Aave bound by the notice as if served directly, and shielding voters from liability. Arbitrum delegates approved the release with about 182.2M ARB and roughly 91% of voting power in favour. The terrorism judgment creditors (the Kim, Kaplan and Calderon-Cardona judgments against North Korea, together exceeding $877M before interest) retain their claim and the merits are unresolved. No later development found in this run's searches; treated as open on absent contrary reporting rather than a docket check: refresh.
- Incident registry check (method upgrade): the DeFiLlama hacks registry lists exactly two Aave-matching entries across its whole history: 2024-08-28 Aave, $56,000, Access Control; and 2026-03-12 Aave V3, $862,000, Oracle Misconfiguration. Nothing for August or September 2026. The April rsETH event is registered under KelpDAO rather than Aave. This is a positive check against a registry rather than an absence of news.
- Aave V4 (context, not V3 scope): live on Ethereum mainnet with a hub-and-spoke architecture. TVL $563,385,095 (api.llama.fi/tvl/aave-v4, 2026-09-20). No forced V3 migration; the two run in parallel. Reported security-review totals were read from ARFC thread bodies rather than independently confirmed: refresh.
- Governance activity scan, with three date corrections to the draft: "[ARFC] Low Adoption Asset Deprecation on Aave V3" is topic 25401, created 2026-07-29, last posted 2026-09-16, 10 posts. It is the same July ARFC still open, not a September successor, and no on-chain execution is confirmed. "[ARFC] Aave V4 Activation on Ethereum Mainnet" is topic 24293, created 2026-03-13, not a September item. "[ARFC] Deploy Aave V4 on Arc" is topic 25170, created 2026-06-19, not 2026-09-18; the September Arc activity is a set of asset assessments dated 09-14 and 09-15. Other September items: "[Gho Stewards] September 2026 GHO Parameter Update" (09-15), "[ARFC] Revision of ETH & BTC Collateral Efficiency on Aave" (09-16), "[ARFC] Custodied Collateral Lending: Aave V4 Isolated Hub & Spoke" (09-14), "[ARFC] Unified Handling of the Isolated Flag in Aave V3.7 E-Modes" (09-11), "Ethena USDe on Aave Avalanche Assessments" (09-18) and "[Direct to AIP] Onboard USDe to Aave V4 Core Instance on Avalanche" (09-01).
- Prior incidents: 2022 CRV short squeeze, about $1.6M of bad debt, cleared by the DAO via AIP-144. March 2026 CAPO misconfiguration, $21.7M to $27M of wrongful liquidations across about 34 accounts, no protocol bad debt. April 2026 rsETH contagion, about $91.79M on the Ethereum WETH reserve under scenario 1, up to about $230.1M under an L2-isolated model, now confirmed as a live 52,964.45 WETH deficit.
Maintained monthly. Methodology: DeFi Research Instruction v2.