Upgrade Aave instances to v3.8

Simple Summary

This proposal upgrades Aave V3 to V3.8, a non-invasive and very measured release focused on security. The changes it introduces are quite minor, but we consider them worth applying to make the system more robust and resilient going forward.

It includes the following changes:

• A reentrancy guard on Pool operations during external callbacks.

Securing Aave V3 remains a top priority, and additional security reviews are being planned. Further defense-in-depth improvements may be proposed in future upgrades.

Motivation

Aave V3.8 aims to make the system more robust and predictable. Gas costs are no longer the concern they once were, and recent developments such as transient storage allow the protocol to be strengthened with little downside in efficiency or gas costs.

Aave V3.8 Changes

Reentrancy hardening

Aave V3.8 introduces a guard based on transient storage (EIP-1153) that protects Pool accounting consistency, including when a single transaction's execution flow interacts with the Pool more than once. The change is intended to strengthen the robustness and security of the protocol over the long term, aligning the pools with industry best practice and protecting them against theoretical reentrancy exploits. Gas costs were historically a concern for this type of guard. With transient storage, that concern is no longer valid, as the guard can be applied with little overhead.

Specification

The upgrade applies to the Aave V3 instances on Ethereum (Core and Lido), Plasma, Avalanche, BNB, Monad, Base, Arbitrum, Mantle, X Layer, Polygon, Linea, Optimism, Gnosis, MegaETH and Celo.

Licensing

Aave V3.8 will be published as its own version of the Licensed Work under a Business Source License. The licence text is available here and will be included in the V3.8 repository. The Change Date for V3.8 is set by Aave Governance and recorded in the change-date text record at v38.aavelicense.eth. Until Governance sets a date, V3.8 stays under the Business Source License. As with the other codebase IP, the V3.8 IP will be transferred to the Aave Foundation through a separate governance proposal.

Security

Aave V3.8 has been audited by:

• Certora
• ChainSecurity
• TomerSecurityFirst

References

• Implementation
• Deployments
• Tests
• Code diffs
• Execution diffs
• Snapshot
• Discussion

Copyright

Copyright and related rights waived via CC0.