Aave v4

Aave's new version under a Hub-and-Spoke model, running on Ethereum since 30/3/2026 (Avalanche since 7/2026), audited by multiple firms, with no incidents recorded. The new code is under 1 year old, and initial limits remain low.

• ✕Live only since 2026-03, under 1 year
• ✓Audited by 5 firms: ChainSecurity, Trail of Bits, Certora, Sherlock, Blackthorn
• ✓Bug bounty programme (Sherlock, up to $3.5M)
• !TVL $637M, below $1B
• ✓No recorded incident causing user losses in the core product
• iRisk of the asset itself: Liquidity is shared within each Hub: depositors bear bad-debt risk from every Spoke borrowing from that Hub, although each Spoke has separate risk parameters and caps. The code is new and has not been through a stressed market cycle.
• iLaunched with 3 Hubs (Core, Prime, Plus) and conservative supply/borrow caps; the Aave DAO votes to raise caps, add Spokes, and expand to more networks.
• iTwo sources on the bug bounty do not match: Aave’s Immunefi page lists up to USD 1 million, while aave.com/security states “Aave Core ... Up to $5M” on Immunefi. V4 has used a separate program on Sherlock (up to USD 3.5 million) since 18/5/2026.