Aave

Aave is a set of smart contracts that pools deposits from lenders and lends them to borrowers who post more collateral than they borrow. Nobody approves a loan. The contracts set interest rates from how much of each pool is in use, and if a borrower's collateral falls too far, anyone can repay part of the loan and take collateral at a discount. Lenders receive aTokens, which grow in balance as interest accrues.

The project started in 2017 as ETHLend, a peer-to-peer lending platform founded by Stani Kulechov, and relaunched as Aave with pooled liquidity in January 2020, according to Wikipedia's account of its history. Kulechov now leads Aave Labs, the company that builds the aave.com app, Aave Pro and Aave Kit. Aave Labs dropped its Avara umbrella brand in February 2026, saying all products would operate under the Aave Labs name, The Block reported. The interface terms identify the operator only as Aave Labs and apply Cayman Islands law. A Legal Entity Identifier record lists an active Cayman company, Aave Group SEZC, formerly Avara Group SEZC; Aave itself does not say which entity signs its terms.

The protocol is owned in practice by the Aave DAO, meaning holders of the AAVE token. They vote on every new market, asset listing, risk parameter and contract upgrade, and they control a treasury funded by the protocol's share of interest. Aave Labs is one paid contributor among several, not the owner of the contracts.

Most of the money sits in Aave V3, which runs a separate market on each supported network. DefiLlama lists 21 of them as of October 2026, including Ethereum, Arbitrum, Base, Avalanche, Optimism, Polygon, BNB Chain, Linea, Mantle, Plasma and MegaETH. Within a market, every listed asset can be both supplied and borrowed, with a loan-to-value limit, a liquidation threshold and a liquidation bonus set per asset. Two features narrow the shared risk: efficiency mode lets correlated assets such as stablecoins or ETH derivatives borrow against each other at higher ratios, and isolation mode limits newer collateral to borrowing a short list of stablecoins up to a cap.

Aave V4 went live on Ethereum on 30 March 2026 and runs alongside V3, not in place of it. It uses a hub-and-spoke design: hubs hold the liquidity, and spokes are individual lending markets with their own collateral rules that draw on a hub. Aave Labs reported in its September 2026 update that V4 had passed $1 billion in deposits and $310 million in active loans, and that it had launched on Arc and on Base, where an Equities Hub accepts seven Coinbase tokenized stocks as collateral with USDC as the only borrowable asset.

GHO is Aave's own dollar stablecoin, minted by borrowers against collateral on Aave rather than supplied by lenders. About $0.70 billion was in circulation in late October 2026, per DefiLlama. Holders can deposit it as Savings GHO, whose rate Aave Labs said was raised to 4.50% APR in September 2026. Aave Horizon is a separate, permissioned market for tokenized real-world assets such as money-market funds.

Aave has no account or deposit fee. Its revenue comes from a reserve factor: a share of the interest borrowers pay goes to the Aave treasury instead of to lenders. The share is set per asset by governance, so the supply rate you see is already after it. Borrow and supply rates move continuously with pool utilization, and the live figures are shown per asset in the app and on the governance forum's risk posts.

Being liquidated is the cost most borrowers should plan around. On Aave V3 Ethereum Core, WETH carried an 80.5% loan-to-value limit, an 83% liquidation threshold and a 5% bonus in May 2026, per LlamaRisk's governance post. A liquidator who repays your debt receives that bonus out of your collateral.

The contracts accept any wallet. The aave.com interface is a separate matter: its terms bar users in Belarus, Côte d'Ivoire, Cuba, Iran, Iraq, Liberia, Libya, Myanmar, North Korea, Russia, Sudan, Syria, Venezuela, Crimea and the Donetsk, Luhansk, Kherson and Zaporizhzhia regions of Ukraine, and any other place under comprehensive sanctions. There is no identity check on the standard markets. Horizon, the real-world asset market, is permissioned because the assets posted there are restricted securities.

Aave Labs is also rolling out the Aave App, a consumer savings app. Its September 2026 update describes early access through invitation passes, including drops aimed at US users, with USDC and USDT deposits enabled on Ethereum.

Aave is non-custodial: assets sit in contracts, and no company can move a user's deposit. The contracts are upgradeable, though, and the authority to upgrade them belongs to AAVE governance through an on-chain vote and timelock. A Protocol Guardian can freeze reserves quickly in an emergency, which it did across V3 deployments on 18 April 2026, and risk stewards can adjust parameters within limits that governance has set. For V4 deployments a separate Protocol Security Council carried out launches and early cap changes.

The audit record is long. Aave's security page lists reviews of V4 by Sherlock, ChainSecurity, Trail of Bits and Blackthorn between October 2025 and May 2026; of V3.7 by Certora, Pashov, MixBytes, Enigma Dark, Savant and a Sherlock contest in March 2026; and of earlier V3 releases by firms including Sigma Prime, PeckShield, OpenZeppelin, ABDK and Trail of Bits, with Certora formal verification on most versions. The core bug bounty on Immunefi pays up to $5 million and the V4 program on Sherlock up to $3.5 million. Audits reduce the chance of a code flaw; they say nothing about whether a listed collateral asset is sound.

Umbrella is Aave's backstop: users stake aTokens or GHO and accept that their stake can be used to cover bad debt in exchange for rewards. The security page puts it at $146 million. Umbrella is not insurance for depositors. In April 2026 roughly 80% of the WETH backstop on Ethereum was already in the unstaking queue when it was needed, Rekt reported, and governance paused it while the loss allocation was settled.

The recurring risk on Aave is collateral, not code. The April 2026 rsETH event shows how it works: rsETH released without backing from Kelp's bridge was posted as collateral on Aave V3, and 82,650 WETH and 821 wstETH were borrowed against it, per the incident report written by Aave's service providers. WETH pools reached 100% utilization, so ordinary WETH lenders could not withdraw until reserves were frozen, rates adjusted and liquidity returned. Aave's contracts were not compromised, but suppliers carried the exposure. The attacker's positions were liquidated on 6 May 2026, and WETH loan-to-value limits were restored after LlamaRisk's May proposal.

Oracle configuration is the second risk. On 10 March 2026 a mismatch in the CAPO price feed priced wstETH about 2.85% below market and liquidated about $26 million of positions across 34 accounts. There was no bad debt, but borrowers who had done nothing wrong lost their liquidation bonus to bots until the DAO compensated them.

Governance is the third. In 2026 two long-standing contributors, BGD Labs and the Aave Chan Initiative, ended their work with the DAO after disputes with Aave Labs over V4 and control of the brand, and the funding vote that followed passed with about 75% support. Users depend on a small number of teams to maintain contracts and set parameters, and that group has changed this year. Its record as a protocol, set against other DeFi systems, is covered in how Aave compares with other DeFi protocols. For a comparison of how other lenders handle these trade-offs, see how Aave compares with other lending platforms.

Using Aave needs a self-custody wallet holding the asset you want to supply plus a little of the network's gas token. On app.aave.com you connect the wallet, pick a market, supply an asset and, if you want to borrow, enable it as collateral and choose an amount that keeps your health factor comfortably above 1. Each step is a signed transaction, and the approval you grant the contract stays in place until you revoke it.

Withdrawing is the same process in reverse and settles in one transaction, with no lock-up, as long as the pool has unborrowed liquidity. That condition matters. When a pool is fully borrowed, as WETH pools were after 18 April 2026, withdrawals wait until borrowers repay or rising rates attract new supply. Borrowers must repay the loan, or enough of it, before collateral can be withdrawn.

Aave's milestones run from a peer-to-peer lender to a multi-network credit protocol with its own stablecoin.

• 2017: ETHLend launches as a peer-to-peer lending platform.
• January 2020: relaunch as Aave with pooled liquidity.
• Early 2022: Aave V3 audits by Trail of Bits, PeckShield, ABDK, Sigma Prime and Certora completed ahead of release.
• November 2022: about $1.6 million of CRV bad debt, covered by the DAO treasury.
• 2023: GHO stablecoin launches.
• February 2026: Aave Labs retires the Avara brand.
• 10 March 2026: CAPO oracle misconfiguration liquidates about $26 million of wstETH positions.
• 30 March 2026: Aave V4 launches on Ethereum.
• 12 April 2026: DAO approves a $25 million stablecoin grant and 75,000 AAVE to Aave Labs under the 'Aave Will Win' framework.
• 18 April 2026: rsETH bridge exploit hits Aave V3 markets; the DeFi United recovery follows.
• September 2026: Aave V4 passes $1 billion in deposits and launches on Arc and Base.