Aave Labs opened a governance proposal on October 21, 2026 for Aave V3.8, described as a non-invasive, security-focused release The upgrade adds a reentrancy guard on Pool operations using EI
Aave Labs posted a proposal to the Aave governance forum on October 21, 2026 outlining Aave V3.8, which the proposal describes explicitly as a non-invasive and very measured release focused specifically on security rather than new features or expanded functionality. The timing and narrow framing suggest the Aave team is prioritizing hardening the protocol’s existing attack surface over adding new capabilities with this particular release.
The centerpiece of the upgrade is a reentrancy guard added to the protocol’s core Pool operations, built using EIP-1153, an Ethereum improvement proposal that introduced transient storage, a type of data storage that exists only for the duration of a single transaction and is automatically cleared afterward. Reentrancy attacks, in which a malicious contract exploits a flaw to call back into a protocol’s functions before an initial transaction fully completes, have been one of the most common and costly categories of exploit across decentralized finance protocols historically, making a hardened reentrancy guard a meaningful defensive upgrade even without any accompanying new features.
If approved through Aave’s governance process, the proposal calls for the upgrade to deploy across a long list of Aave V3 instances, including deployments on Ethereum covering both the Core and Lido markets, as well as Plasma, Avalanche, BNB Chain, Monad, Base, Arbitrum, Mantle, X Layer, Polygon, Linea, Optimism, Gnosis, MegaETH, and Celo, explicitly excluding any instances that have already been fully frozen. That breadth reflects just how widely deployed Aave’s V3 codebase has become across the broader multi-chain decentralized finance landscape.
The proposal lays out a specific path toward final approval: an initial period of community feedback on the Aave Request for Comment, followed by a Snapshot vote, then independent security audits including a review from Certora, a firm that specializes in formal verification of smart contract code, before a final on-chain Aave Improvement Proposal gets submitted for a binding governance vote. The upgraded code is planned to be published under its own version of Aave’s Business Source License, the licensing structure the protocol has used for its more recent code releases.
Aave’s own proposal stated that securing Aave V3 remains a top priority, and that additional security reviews are being planned beyond just this specific upgrade, signaling an ongoing, broader security-focused effort rather than a single, isolated fix. The proposal, posted on Aave’s governance forum, did not specify a target date for the Snapshot vote or for a final on-chain Aave Improvement Proposal submission.
This post first appeared in Aave Labs Proposes a Security-Only Upgrade Hardening the Protocol Against Reentrancy Attacks
