Aave v3 DefaultReserveInterestRateStrategyV2

Aave v3 Upgradability - BaseImmutableAdminUpgradeabilityProxy

Aave v3 Upgradability - InitializableImmutableAdminUpgradabilityProxy

Aave v3 Upgradability - VersionedInitializable

Aave v3 Global configurations - Reserve Configuration

Aave v3 Global configurations - User Configuration

Aave v3 Logic Libraries - Configurator Logic

Aave v3 Logic Libraries - Flash Loan Logic

Aave v3 Logic Libraries - Isolation Mode Logic

Aave v3 Logic Libraries - Liquidation Logic

Aave v3 Logic Libraries - Validation Logic

new Aave Safety Module (stkABPT and stkGHO)

Aave v2 DefaultReserveInterestRateStrategy

Aave v2 BaseImmutableAdminUpgradeabilityProxy

Aave v2 InitializableImmutableAdminUpgradeabilityProxy

Aave v2 Global configurations - Reserve Configuration

Aave v2 Global configurations - User Configuration

Aave v2 Logic libraries - ValidationLogic

All code of Aave can be found at [https://github.com/aave-dao](https://github.com/aave-dao), [https://github.com/aave/](https://github.com/aave/), [https://github.com/aave-dao](https://github.com/aave-dao) and [https://github.com/bgd-labs](https://github.com/bgd-labs) . All production addresses can be found at  [https://github.com/bgd-labs/aave-address-book/tree/main.](https://github.com/bgd-labs/aave-address-book/tree/main)

Aave is a decentralized non-custodial liquidity protocol where users can participate as suppliers or borrowers in a common pool. Suppliers provide liquidity to earn a passive income, while borrowers are able to borrow in an overcollateralized (perpetually) or undercollateralized (one-block liquidity) fashion.

Contract fails to deliver promised returns, but doesn't lose value

Griefing

Imprecision on accounting (balances, rates)

Theft of gas Low

Direct theft of any funds in the Aave Treasury

Theft of yield, defined as funds not classified as the principal (not including yield yet to be earned)

Permanent locking of unclaimed yield of users, defined as funds not classified as the principal (not including yield yet to be earned)

Temporary locking of funds classified as the principal or funds of the Aave treasury

Smart contract unable to operate due to lack of token funds

Loss of rewards-to-be-accrued

Manipulation of interest rates (supply or borrow) with mechanisms not intended or limited by design

Unexpected infrastructural behavior

Major manipulation of governance voting results deviating from voted outcome, whenever protection mechanisms (e.g. cancellation of proposal) can’t mitigate the damage.

Direct theft of any user funds classified as the principal, whether at-rest or in-motion

Permanent locking of user funds classified as the principal or funds of the Aave treasury

Protocol insolvency

Keep in mind the restrictions on impacts based on the respective asset:
- For all assets labeled as “Aave v2” and deployed on the Ethereum network, only Critical and High impacts are in-scope. 
- For all assets labeled as “Aave v2” and deployed on networks other than Ethereum, including L2s on Ethereum, onlyCritical impacts are in-scope.

AAVE