Aave V3.8 goes live with new reentry guard

Aave’s flagship lending marketplaces received a security update on November 11. The protocol announcement that V3.8, a beefed-up version designed by Aave Labs, now works on 15 networks after passing through governance without a single opposing vote.

— (@)

• The guard: The only change in 3.8 is a pool-wide lock against reentrancy, the class of attack in which a contract is recalled before its books have finished updating. Aave Laboratories proposal describes the risk as “theoretical” and there are no known exploits that prompted the use of the patch.

  Do you like this article?

  Subscribe to Bankless or log in

• Cheap by design: The lock lies in transient storage (EIP-1153), the notebook in Ethereum’s Dencun upgrade that clears itself after each transaction. This makes a protective blanket almost free of gas, which was the old objection to adding a blanket.

• Nothing breaks: Flash loan functions read the lock without setting it, so liquidations triggered from inside a flash loan continue to proceed. Founder Stani Kulechov said users and integrators do not need to do anything.

• Zero dissent: The Snapshot poll attracted about 381,000 AAVEs for and no against, and the chain vote (AIP 541) repeated the shutout with about 371.6,000 AAVEs. Audit reports from Certora and ChainSecurity are filed alongside the code.

• New steward: BGD Labs, which led previous versions of V3.x, left the DAO in April due to centralization issues. Aave Labs then took over maintenance of V3, and this version lives up to its name.