The effort began in March 2025 when formal verification firm Certora joined developers during an Aave design workshop to help shape the protocol’s verification framework. Independent security researchers also reviewed early architectural decisions, providing adversarial feedback before the codebase reached the auditing stage.
From September through November 2025, several audit firms — including Chainsecurity, Trail of Bits, and Blackthorn — conducted manual code reviews and invariant testing. Fifteen security researchers participated in the process, contributing more than 275 audit days examining the V4 codebase and protocol mechanics.
A public security contest followed between November 2025 and January 2026 on the Sherlock platform. More than 900 verified participants submitted over 950 findings while probing the code. According to Aave Labs, no critical or high-severity vulnerabilities were identified, and most submissions were deemed invalid.
A second audit round in February 2026 added about 80 additional review days focused on validating fixes and ensuring new patches did not introduce fresh issues. Published reports from Trail of Bits, Blackthorn, and Chainsecurity likewise reported no high-severity flaws.
Looking ahead, Aave Labs explained that it plans to maintain formal verification during future development cycles, continue layered security testing methods, and introduce a standing bug bounty program — essentially inviting hackers to try their luck before attackers do.
FAQ What is Aave V4?Aave V4 is the upcoming version of the Aave lending protocol, a decentralized finance platform that allows users to lend and borrow digital assets. How long was Aave V4 audited?The protocol underwent roughly 345 cumulative days of security reviews, including audits, formal verification, and public testing. Did auditors find major vulnerabilities in Aave V4?Published reports from multiple audit firms reported no critical or high-severity vulnerabilities. What security steps will Aave use in future releases?Aave Labs plans to continue formal verification, layered testing, and introduce an ongoing bug bounty program to monitor protocol security.
