Aave V3.8 adds reentrancy protection to pools, now live on 15 V3 markets.

November 12: Lending protocol Aave announced that, approved by the Aave DAO, Aave V3.8 developed by Aave Labs has gone live across 15 Aave V3 markets. This version adds new safeguards to Aave V3 to meet security standards.

According to the governance proposal submitted by Aave Labs, V3.8 is a security-focused upgrade with restrained changes, primarily adding reentrancy locks for pool operations during external callbacks. The protection is based on transient storage (EIP-1153), used to maintain accounting consistency when a single transaction interacts with the pool multiple times, and to guard against theoretical reentrancy attacks. Because it uses transient storage, the associated gas overhead is low. The upgrade covers active instances on Ethereum, Plasma, Avalanche, BNB Chain, Monad, Base, Arbitrum, Mantle, X Layer, Polygon, Linea, Optimism, Gnosis, MegaETH, and Celo.

Aave Labs stated that flash loans can still be composed with pool operations such as liquidations within the same transaction, but a flash loan cannot be initiated while other pool operations are in progress. This version passed Certora and third-party audits before entering on-chain governance voting.