Aave V3 Audit Finds High Risk in Reentrancy and Access Control
Aave (AAVE)
Editor:
Eugene Serbin
dev.to published a security audit report on 18 September 2026 regarding Aave V3, which holds approximately $17.7 billion in total value locked across Ethereum and Layer-2 networks. The review, conducted by senior DeFi security researchers, focused specifically on reentrancy and access-control vulnerabilities within the protocol's complex smart-contract interactions. The aggregate risk score for the audited surface was determined to be 7.4 out of 10, classified as high.
The most severe issues identified stem from improperly guarded external calls in the flash-loan and collateral-withdrawal paths, alongside over-broad admin role assignments in the upgrade proxy. Although none of the vulnerabilities are currently exploitable in the live main-net deployment due to existing defensive patterns like re-entrancy guards, they represent a significant attack surface for future upgrades. The report emphasizes that remediation is essential to maintain user confidence and protect the multi-billion-dollar ecosystem built on Aave.
Recommendations are ordered by risk severity, ease of implementation, and potential reduction in attack surface. The audit highlights that Aave V3 relies on isolated-mode risk parameters and efficiency mode for correlated assets, making precise security controls critical. The findings suggest that while current safeguards are effective, misconfigurations could expose the protocol to risk. The report concludes that addressing these issues is vital for the long-term stability of the lending market.
How the market reacted
Whalio's own Binance spot order flow for AAVE, measured when this story was written up on 18 September 2026. Not the outlet's figures.
AAVE is currently trading at $128.61 on Binance spot markets, with a 1-hour buy ratio of 54.5% and a 4-hour buy ratio of 51.0%. These short-term figures indicate a slight preference for buying pressure compared to the 24-hour buy ratio of 49.2%, suggesting that immediate trading activity is leaning toward accumulation. The 1-hour volume delta is positive at +$42,321, while the 4-hour delta stands at +$166,384, showing net inflows in the short term. However, the 24-hour volume delta is negative at -$223,592, indicating that over the longer day, sellers have outweighed buyers. The cumulative volume delta for the 24-hour period closed at +$770,375, reflecting that buying pressure was stronger earlier in the day. Net buying occurred for 15 out of the 24 hours, with a total spot volume of $14,447,877 and 200,751 trades recorded.
The latest daily buy ratio of 49.8% sits at the 52nd percentile of the last 324 days, against a median of 49.8% - ordinary for this coin.
Was that an ordinary day?
The same Binance spot measurements for AAVE, averaged over the days leading up to the story.
Over the preceding week, the 7-day average buy ratio was 49.7%, which is 0.5 points lower than the latest day's reading. Volume over the last 8 days was 1.30 times the average, indicating significantly higher trading activity than usual. Despite this volume spike, the 8-day volume delta was negative at -$1,038,045, showing that net selling pressure dominated the week. The price increased by 6.6% over the 8-day period, with net buying occurring on only 3 of the 7 days. This suggests that while trading activity was elevated, the underlying flow was predominantly bearish over the longer timeframe.