Aave has operated across four protocol generations since 2020, and its security program has grown with each one. Manual audits, formal verification, invariant testing, fuzzing, public contests, and a standing bug bounty each entered the process as they proved their worth, and Aave Labs keeps testing newer methods as they mature.
Aave V4 underwent more than 340 days of cumulative security review before the scans outlined below happened, including manual audits, formal verification, invariant testing, fuzzing, and a six-week public contest. While Aave V3 has been hardened by years of production operation and successive audits on top of that.
In Security By Design: Aave V4, Aave Labs committed to evaluating AI-powered auditing as a complementary layer of the security program, and to maturing AI scanning for future releases. Delivering on that, we ran three AI security tools against Aave V3 and Aave V4, and are reporting the findings here.
Across 71 findings, no Critical or High severity issue was confirmed in either protocol. Every finding that survived manual validation is of Low or Informational severity, and at no point were users or their funds at risk from any issues mentioned.
How Deep the Existing Tests Run
Beyond vulnerability scanning, one tool ran mutation testing against four core V4 contracts, Hub, Spoke, TreasurySpoke, and AaveOracle, injecting 304 deliberate code mutations to measure whether Aave's own test suites would catch them.
Existing tests killed 271 mutations outright, and no mutation was shown to survive. The remaining 33 returned inconclusive because the suites timed out rather than because a mutation slipped through, and work is ongoing to speed those suites up. Coverage measures which lines a test suite touches. Mutation testing measures whether it would notice those lines being wrong.
Approach
Each tool uses a different methodology, so the codebases were probed from genuinely different angles rather than through three variations of the same scan. Scans ran against pinned commits of the production repositories, covering the full src trees, and where supported the tools received the same context human auditors work from, including the V4 threat model and prior audit reports.
Rather than taking any verdict on faith, Aave Labs manually reviewed every finding against the code and classified each as valid, false positive, duplicate, or by design, using the same triage discipline applied to audit and contest submissions.
Results
Results are anonymized per tool and presented in randomized order. This review was run to strengthen the protocol's security posture rather than to benchmark vendors against one another, and the aggregate outcome is what matters most for this analysis.
¹ Includes one issue previously reported and paid through the bug bounty program. ² Includes three findings on deprecated rewards contracts. ³ On a deprecated rewards contract no longer in use. ⁴ This tool's V4 report additionally lists four low and informational warnings covering operational edge cases with no security impact. ⁵ Three of the five confirmed only on deprecated or unused contracts. Six additional low and informational warnings cover view-only or far-future edge cases.
Several of the 20 validated findings were already known through existing processes such as the bug bounty program, which confirms the tools find real issues while also confirming those processes caught them first. A meaningful share affects deprecated code, and the rest are missing sanity checks in governance configuration paths, reachable only by trusted roles and failing safe by reverting, or view-function edge cases with no effect on protocol state. A small number of genuinely new items surfaced, all Low or Informational, each tracked and addressed where remediation is warranted.
A few findings arrived rated Critical or High, and validation confirmed every one as a false positive. Reading Aave correctly requires understanding its trust model, which is what human review contributes to a scan.
Where AI Helps Today
The review also covered periphery repositories including GHO, a.DI, aave-helpers, and the swap adapters, where hit rates ran materially higher than on the heavily audited V3 and V4 core. Precision was highest where prior scrutiny was lowest, which is consistent with deeply hardened core codebases and points to where AI tooling adds the most leverage today.
Even in the best runs, roughly half of the surfaced findings validated as real behavior, which places AI scanning as an early-stage layer alongside expert review. Human triage remains essential for separating signal from noise and assigning realistic severity under the protocol's trust model.
Going Forward
Aave Labs will keep working with leading teams in AI security tooling and run further AI-assisted reviews as those tools mature. We gave each vendor detailed feedback on false-positive patterns, duplicate reporting, and scoping, and the best-performing tools will be integrated into internal workflows so that scanning runs alongside development rather than only at release milestones. The methods listed above remain the foundation of the protocol's security posture, and AI scanning strengthens that stack without displacing any layer of it.
We will keep publishing results like these, including the ones less flattering than this set. Billions of dollars in user funds sit across DeFi, and the security of any one protocol raises or lowers the floor for all of them.
