Aave V3.8 Goes Live With New Reentrancy Guard
The security upgrade adds a pool-wide reentrancy lock across 15 networks after clearing Aave governance without a single opposing vote.
Aave's flagship lending markets got a security tune-up on Nov. 11th. The protocol announced that V3.8, a narrow hardening release built by Aave Labs, is now running across 15 networks after sailing through governance without a single opposing vote.
— (@)
What's the Scoop?
The guard: V3.8's lone change is a pool-wide lock against reentrancy, the class of attack where a contract gets called again before it finishes updating its books. Aave Labs' proposal describes the risk as "theoretical," and no known exploit prompted the patch.
Enjoying this article?
Subscribe to Bankless or sign in
Cheap by design: The lock lives in transient storage (EIP-1153), the scratchpad from Ethereum's Dencun upgrade that wipes itself after every transaction. That makes a blanket guard nearly free in gas, which was the old objection to adding one.
Nothing breaks: Flash loan functions read the lock without setting it, so liquidations fired from inside a flash loan still go through. Founder Stani Kulechov said users and integrators don't need to do anything.
Zero dissent: The Snapshot poll drew roughly 381K AAVE in favor and none against, and the onchain vote (AIP 541) repeated the shutout with about 371.6K AAVE. Audit reports from Certora and ChainSecurity are filed alongside the code.
New steward: BGD Labs, which led earlier V3.x releases, left the DAO in April over centralization concerns. Aave Labs took over V3 upkeep afterward, and this release carries its name.
William M. Peaster
William M. Peaster, Senior Writer, has been with Bankless since January 2021. Immersed in Ethereum since 2017, he covers the onchain frontier with a particular interest in art, games, and other culture apps. He has a background in creative writing and writes fiction in his free time.
