Aave Pool update
01Summary
Proposal to deploy a security patch across all Aave v3 instances (Ethereum, Polygon, Avalanche, Optimism, Arbitrum, Base, and Gnosis) to fix a technical vulnerability detected during internal security review. The patch upgrades the Aave Pool contract via setPoolImpl() function on PoolAddressesProvider.
- Type
- contract upgrade
Key changes
- Upgrade of Aave Pool implementation across all v3 instances via setPoolImpl() function call(high)
- Fix for detected technical security issue affecting Aave v3(high)
Notable concerns
- Code details withheld until execution to prevent advance disclosure of the patch
- Verification of code will occur just before execution rather than in advance
Generated by Kvorum
02Description
Simple summary
Proposal to apply a fix on Aave v3 for all different instances.
Motivation
During an internal security review, a technical problem on Aave v3 has been detected. After coordinating with the Aave Guardian to apply protective measures, this proposal applies a fix on all Aave v3 instances, that completely solves the issue.
Specification
The proposal does an upgrade of the Aave Pool, on all different Aave instances, by calling the setPoolImpl() function on the PoolAddressesProvider smart contract. In order to not disclose the patch in advance, the code will be verified just before execution. We have disclosed the code to contributors of the community (Certora, Avara, and extra security researchers) for them to certify in the governance forum thread about the legitimacy of the upgrade.
References
- Implementation: AaveV3Ethereum, AaveV3Polygon, AaveV3Avalanche, AaveV3Optimism, AaveV3Arbitrum, AaveV3Base, AaveV3Gnosis
- Tests: AaveV3Ethereum, AaveV3Polygon, AaveV3Avalanche, AaveV3Optimism, AaveV3Arbitrum, AaveV3Base, AaveV3Gnosis
- Discussion
Copyright
Copyright and related rights waived via CC0.
03Mismatch analysis
The proposal follows Aave's standard governance payload pattern: a single on-chain action on Ethereum invokes execute() on a dedicated payload contract, which internally is expected to contain the logic to call setPoolImpl() on the PoolAddressesProvider across all listed Aave v3 instances (via cross-chain messaging infrastructure such as the CrossChainController, per the linked GitHub implementation files). The decoded action list only shows the top-level execute() call and does not expose the internal multi-chain calls, which is typical for this proposal architecture and does not by itself indicate a discrepancy — it is a limitation of the decoding depth rather than a mismatch. The description's claims (upgrading Pool implementations across all listed networks, using setPoolImpl(), with code disclosed only right before execution) are consistent with the nature of a payload-execute() call and the referenced source files. Because we cannot inspect the internal calldata of the payload contract, confidence is medium rather than high — we cannot fully verify that setPoolImpl() is called on exactly the seven listed instances with correct new implementation addresses. However, this pattern is standard for BGD Labs cross-chain patch proposals and no numeric values, targets, or claims in the description contradict what is visible in the decoded action. No omissions, extra claims, or value/target mismatches were found at the level of visibility available. Discrepancies: none identified given the information available. Given the standard nature of the pattern and lack of any visible contradiction, this proposal is assessed as consistent, with medium confidence due to the necessarily opaque nature of the single decoded execute() call.
Generated by Kvorum
04Actions
- Target
- 0x529c…a994
- Value
- 0 wei
- Function
- fallback()
- Arguments
{}- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
No forum thread is confidently linked to this proposal.
08Similar proposals
- aaveexecutedUpgrade Aave instances to v3.384%
- aavecanceledUpgrade Aave V3 pools to Aave V3.0.283%
- aaveexecutedUpgrade Aave V3 pools to Aave V3.0.283%
- aaveexecuted3.2 patch for legacy periphery82%
- aaveexecutedAave v3.1 upgrade82%
- aaveexecutedUpgrade all Aave instances to 3.280%
- aaveexecutedUpgrade Aave instances to v3.6 Part 180%
- aaveexecutedUpgrade Aave instances to v3.6 Part 280%
- aaveexecutedUpgrade Aave instances to v3.6 Part 379%
- aaveexecutedUpgrade Aave instances to v3.579%