Aave Review

How Aave scores in crypto lending

This entry rates the Aave lending protocol, with its code taken from the aave-v3-origin repository (v3.7), in our lending ranking. The basis is desk research of Aave's documentation and GitHub repository, checked on November 1, 2026. No position was opened. The category uses five criteria, each marked 0 to 10 and weighted equally, as described in our ratings methodology.

The overall score is the plain average: (4 + 4 + 6 + 9 + 10) ÷ 5 = 33 ÷ 5 = 6.6. That puts Aave fifth of the nine protocols on the live ranking page, behind Euler at 7.0 and ahead of Spark at 6.2. All five marks were checked against current sources on this pass and none changed.

Strongest criteria: audits and governance

Audit disclosure (10)

The audits folder in aave-v3-origin holds 49 files, each named with a date and a firm. The earliest is OpenZeppelin's v3 review from November 2021. The latest batch, dated March 26 to 31, 2026, covers v3.7 and comes from six reviewers: MixBytes, Sherlock, Pashov, Certora, Savant and Enigma. Other named firms include Trail of Bits, PeckShield, ABDK, Sigma Prime, Cantina, Oxorio, StErMi and Blackthorn. Most protocol versions in between have reports from more than one firm. The rubric asks for reports published with firms named and dated, and this archive meets it in full. Audits review code at a point in time and do not insure deposits.

Governance & timelock (9)

The governance documentation states who can change what, and how fast. Proposals that pass on-chain wait one day in the Short Executor's timelock, or seven days for changes to governance itself through the Long Executor. On-chain votes need at least 320,000 AAVE-equivalent taking part. Faster powers are named and bounded. A 4-of-7 Protocol Emergency Guardian can pause markets, and a 5-of-9 Governance Emergency Guardian can cancel proposals. The Risk Steward can move loan-to-value, liquidation thresholds and bonuses by at most 0.5 percentage points per update, with 72 hours between changes. The mark stops short of 10 because a one-day delay on most parameter changes gives users little time to react. The page also mentions a one-day queue in a passage that does not match the seven-day Level 2 figure.

Weakest criteria: fees, licence and per-asset terms

Fee disclosure (4): a deficiency

Aave charges no account fee. What a borrower pays comes from settings in the pool configurator documentation: the reserve factor taken from interest, a liquidation protocol fee and a flash-loan premium, all expressed in basis points (10,000 equals 100%). The page names each setting, and says the flash-loan premium goes in full to the treasury, but it lists no per-asset or default values. The rubric asks for fees published as figures rather than described as configurable parameters, so this is a measured gap, not an unchecked one. A borrower has to read the values from the market itself; our guide to reading a DeFi lending market shows where.

Licence & code openness (4): a deficiency with an end date

The LICENSE file on aave-v3-origin is BUSL-1.1, with the Aave DAO as licensor. Its additional use grant allows use and modification only on conditions. The code must not be used to move users or funds out of the Aave ecosystem, and it must not be used by anyone who has deployed a competing fork in the past four years. The change date is March 6, 2027, or earlier if a date is set in an ENS record named in the file, after which the licence becomes MIT. The rubric places delayed-open licences mid-table, which is where the 4 sits.

Liquidation terms (6)

The documentation states the trigger and the bonus rule. A position can be liquidated once its health factor falls below 1.0. The liquidation bonus "is always above 100%", so a setting of 105% gives the liquidator a 5% bonus, paid out of the borrower's collateral. The liquidations page adds that in Aave v4 the bonus follows a Dutch auction, rising as the health factor falls, but it gives no amounts. Per-asset liquidation thresholds and bonuses are not published as numbers in the docs. A borrower can follow the logic but cannot plan around a specific figure without checking each market.

What the score does not cover

• Rates and yields. Supply and borrow rates move with utilization and were not measured.
• Aave v4. The Hub-and-Spoke markets live on Ethereum since March 30, 2026 have their own code and parameters. This entry reads the v3.7 repository.
• Umbrella. The staking backstop for bad debt on Ethereum v3, with a 20-day cooldown, sits outside the five criteria.
• GHO and Horizon. The stablecoin and the real-world-asset market are not scored here.

Aave vs Euler, Silo Finance and Spark

Euler scores 7.0, four tenths above Aave. It marks 8 for fee disclosure against Aave's 4, which more than covers its lower governance mark (7 against 9). The two share a 4 for licence, a 6 for liquidation terms and a 10 for audits. Spark follows at 6.2 and Silo Finance at 6.0. Silo marks 9 for audits against Aave's 10, 3 for licence and 5 for governance. Spark, which runs Aave v3-derived code, does better on licence (6) and liquidation terms (8), matches Aave on fees (4) and does worse on governance (6). The category leader, Morpho at 8.8, scores 10 for licence and liquidation terms, the two areas where Aave loses most.

Who this rating suits

The score suits readers who weigh a deep, current audit record and bounded, documented governance powers most heavily. Those who need per-asset fees and liquidation figures from the documentation, or an open source licence today, should weigh the three lower marks. Borrowing against volatile collateral can lead to liquidation; the rating describes published documentation and is not advice to lend or borrow.