{
"badges": [],
"description": "Aave V4 is a lending protocol. Users deposit assets to earn yield from borrowers, or post collateral to borrow against it; positions stay open as long as they remain overcollateralized, otherwise they get liquidated. V4 introduces a Hub and Spoke model: multiple markets (Spokes) with independent risk parameters share liquidity through a common Hub, with per-spoke caps bounding the maximum damage from any single market.",
"links": {
"websites": [
"https://aave.com/"
],
"documentation": [
"https://aave.com/docs"
],
"repositories": [
"https://github.com/aave-dao/aave-v4"
],
"socialMedia": [
"https://x.com/aave",
"https://discord.com/invite/aave",
"https://t.me/Aavesome"
]
}
}
colors+1-0
null
ecosystemColors+1-0
null
milestones+1-0
null
chainConfig+1-0
null
escrows+1-0
null
bridgeInfo+1-0
null
bridgeRisks+1-0
null
bridgeTechnology+1-0
null
scalingInfo+27-0
{
"capability": "appchain",
"daLayer": [
"Ethereum (calldata)"
],
"hostChain": {
"id": "ethereum",
"slug": "ethereum",
"name": "Ethereum"
},
"layer": "layer2",
"purposes": [
"Lending"
],
"reasonsForBeingOther": [
{
"label": "DeFi protocol",
"shortDescription": "Aave V4 is a DeFi lending protocol on Ethereum, not a scaling solution.",
"description": "Aave V4 is tracked here for its discovery-driven contract and permission map. It is not a scaling solution: it is a hub-and-spoke lending protocol. Hubs and Spokes on the same chain communicate via direct contract calls."
}
],
"stage": "Not applicable",
"type": "Other",
"vm": [
"EVM"
]
}
{
"detailedDescription": "\n## What is Aave V4\n\nAave is a lending protocol. Users come to Aave to do one of two things:\n\n- **Earn yield on assets they're not actively using.** A user deposits an asset (USDC, ETH, wstETH, ...) into a market and immediately starts accruing interest paid by borrowers of that same asset. Under normal conditions the deposit is liquid (it can be withdrawn whenever the market has spare liquidity) and can also be used as collateral for borrowing without giving up the yield. Admins with emergency and risk controls can pause or freeze a reserve: a paused reserve blocks withdrawals (and all other operations) until unpaused, while a frozen reserve still allows withdrawals but blocks new supplies, borrows, and collateral-enable (see the permissions section).\n- **Borrow against collateral they want to keep.** A user posts collateral (typically ETH, an LST like wstETH/weETH/rsETH, BTC, or another supported asset) and draws a loan in a different asset (often a stable like USDC, USDT, GHO). The loan accrues interest at a rate that floats with how much of the supply side is currently being borrowed. As long as the position stays sufficiently overcollateralized, it stays open indefinitely; if the collateral value drops too far, anyone can liquidate the position by repaying part of the debt and seizing collateral at a discount.\n\nBoth flows happen on a **Spoke** contract. A Spoke is a market: it defines which assets you can supply, which you can borrow, which count as collateral, and at what parameters. Each asset you supply can be toggled on or off as collateral individually, and all of your activity on a given Spoke (your supplies, your borrows, and which of your supplies are currently enabled as collateral) is tied together into a single health factor. You cannot supply on one Spoke and borrow against that collateral on a different Spoke: each Spoke is a self-contained position boundary.\n\nEach Spoke holds a set of **reserves** (one per asset). Each reserve points to a **Hub** for that asset's liquidity pool. The Hub is where the actual tokens sit and where interest accounting happens. A single Spoke can have reserves pointing to different Hubs (for example, the Ethena Ecosystem Spoke routes Ethena assets through the Plus Hub and stablecoins through the Core Hub). Prices come from a per-spoke **AaveOracle** that wraps Chainlink feeds with a growth-rate cap; interest rate parameters come from an **InterestRateStrategy** per Hub; protocol revenue is sent to a single **Treasury**.\n\nThe design choice in V4 is **shared liquidity with bounded per-segment risk**. In V3, each pool is fully isolated: separate liquidity, separate risk. Adding a risky asset to the main pool exposes all suppliers; creating a separate pool fragments liquidity and worsens rates. V4 breaks this tradeoff:\n\n- Multiple **Spokes** (markets) on each chain define independent collateral/borrow rules, risk parameters, and oracle sources. Each Spoke has a **drawCap** per asset set by governance that hard-limits how much liquidity it can borrow from the Hub.\n- A shared **Hub** pools the underlying liquidity across all Spokes. Suppliers on any Spoke earn yield from borrowers on every Spoke connected to the same Hub.\n- **Positions are isolated per Spoke.** Your health factor on one Spoke is independent of your positions on another. A liquidation cascade on one Spoke cannot trigger liquidations on another. The same asset (e.g., USDC) can be configured differently on different Spokes: usable as collateral on one, supply-only on another, not listed on a third.\n\nIf a risky collateral type depegs and creates bad debt on one Spoke, that bad debt IS absorbed by the Hub (all suppliers across all Spokes sharing that Hub see reduced share value). However, the maximum damage is bounded by the Spoke's drawCap. For example, if a Spoke has a 375K USDC drawCap and the total Hub has 100M USDC, the worst-case loss from that Spoke is 0.375% of the pool. In V3's single-pool model, there is no such per-segment bound.\n\nAdditionally, governance can halt or deactivate individual Spokes without affecting others. In V3, pausing is per-asset and affects all users of that asset across the entire pool.\n\n## Where does the yield come from?\n\nSupplier yield comes directly from interest paid by borrowers. There is no token emission, no external subsidy, and no Ponzi-like mechanism. The flow:\n\n1. **Borrowers pay interest.** Every borrowed position accrues interest at a rate (`drawnRate`) computed by the InterestRateStrategy contract. The rate is a function of utilization: `calculateInterestRate(liquidity, drawn, deficit, swept)`. When utilization is low, rates are low (incentivizing borrowing); when utilization is high, rates rise sharply (incentivizing repayment and new supply). The interest compounds via a `drawnIndex` that grows linearly over time: each second, the index increases by `previousIndex * rate * timeDelta`.\n\n2. **The interest grows the pool.** The Hub tracks `totalAddedAssets` per asset, which includes: the idle liquidity + swept liquidity + total debt owed by borrowers (drawn + premium) - protocol fees. As borrowers' debt grows (the drawnIndex increases), the total pool grows, and each supplier's `addedShares` become worth more underlying tokens. Suppliers don't receive yield as a separate payment; instead, their share of the pool appreciates.\n\n3. **The protocol takes a cut.** A configurable `liquidityFee` (set per asset by governance via the HubConfigurator) is deducted from the interest accrued between index updates. This fee is tracked as `realizedFees` on the Hub and sent to the Treasury (the `feeReceiver` address in each asset's config). The fee is subtracted from the pool before computing supplier share value, so suppliers receive the borrower interest minus the protocol's percentage.\n\n4. **Riskier borrowers pay more.** Each reserve on a Spoke has a `collateralRisk` value (in BPS, set by the PoolAdmin, capped at 1000% / 100,000 BPS). When a user borrows, the Spoke sorts their collaterals from safest to riskiest (by `collateralRisk` ascending) and \"uses\" them in that order to back the debt. A user whose debt is fully covered by safe collateral (zero `collateralRisk`) pays only the base rate; a user who has to dip into riskier collateral pays a surcharge proportional to the fraction of debt backed by risky collateral. For example, $200 of safe collateral + $400 of collateral with a 5% risk value, backing $600 of debt, yields a premium of 400·5%/600 = 3.33% on top of the base rate. This premium is tracked separately (`premiumShares` and `premiumOffsetRay`) and flows into the same pool, benefiting suppliers. On the current deployment, `collateralRisk` is zero for every reserve across all Spokes, so the mechanism exists but is dormant.\n\n5. **Idle liquidity can be reinvested into external yield strategies.** Each Hub asset supports a `reinvestmentController` that can sweep idle tokens out of the Hub and return them later; any surplus it reclaims grows the pool. This path is currently disabled on every asset on every Hub (see \"Reinvestment controllers\" below for the mechanism, risk, and activation).\n\nIn short: the primary yield is the interest spread. Borrowers pay `baseRate + riskPremium`, suppliers receive `baseRate + riskPremium - protocolFee`, and the Treasury receives `protocolFee`. All rates are algorithmically determined by utilization and collateral quality, not by governance votes or token emissions. A future secondary yield source may come from reinvestment of idle liquidity, but this is not currently enabled.\n\n## User flows\n\nAll user interactions happen on a **Spoke** contract. Users (or their approved position managers) call functions on the Spoke for the market they want to use. Each function takes a `reserveId` (identifying which asset within the Spoke) and an `onBehalfOf` address (who the position belongs to).\n\n- **Supply**: `supply(reserveId, amount, onBehalfOf)`. Transfers the underlying token from the caller to the Hub and credits the user's `suppliedShares`. The deposit immediately starts earning yield. The caller must have approved the Spoke for the token transfer.\n\n- **Withdraw**: `withdraw(reserveId, amount, onBehalfOf)`. Burns the user's `suppliedShares` and transfers the underlying token from the Hub to the caller. If the user is using this asset as collateral, the Spoke validates that the withdrawal doesn't make the position undercollateralized.\n\n- **Borrow**: `borrow(reserveId, amount, onBehalfOf)`. Draws liquidity from the Hub and transfers the borrowed token to the caller, recording the user's `drawnShares`. The Spoke validates the user's health factor: the borrow only succeeds if total collateral value (at oracle prices) exceeds total debt value by the required margin.\n\n- **Repay**: `repay(reserveId, amount, onBehalfOf)`. Transfers tokens from the caller back to the Hub, reducing the user's `drawnShares`. The repayment covers both the base debt and the accrued risk premium.\n\n- **Liquidation**: `liquidationCall(collateralReserveId, debtReserveId, user, debtToCover, receiveShares)`. Permissionless: anyone can call this to liquidate an undercollateralized position. The liquidator repays part of the user's debt (transferred from the liquidator to the Hub) and receives the user's collateral at a discount. The liquidation bonus scales with how far below the health factor threshold the position is. If the position is in deficit (debt exceeds collateral value), the loss is reported to the Hub.\n\n- **Set collateral**: `setUsingAsCollateral(reserveId, usingAsCollateral, onBehalfOf)`. Toggles whether a supplied asset counts as collateral for borrowing. Disabling collateral releases the asset from liquidation risk but reduces borrowing power.\n\nAll of these actions (except `liquidationCall`) are gated by an `onlyPositionManager(onBehalfOf)` check. A **position manager** is a contract or EOA authorised to act on another user's position: it can call `supply`, `withdraw`, `borrow`, `repay`, and `setUsingAsCollateral` with that user as `onBehalfOf`. The check allows a caller through if either (a) the caller is the user themselves, or (b) the caller is both **globally active** as a position manager on the Spoke *and* **explicitly approved** by the specific user.\n\nGlobal activation is controlled by the protocol admin: `updatePositionManager(address, bool)` is `restricted`, so only `ADMIN_ROLE` holders on the AccessManager can flip a contract to active. User approval is self-service: the user calls `setUserPositionManager(address, bool)` (or signs an EIP-712 message consumed by `setUserPositionManagersWithSig`) to add or remove approvals on their own account. A position manager can also voluntarily drop its authority over a specific user via `renouncePositionManagerRole`. A position manager cannot approve further position managers on the user's behalf — that action is always tied to the user's own `msg.sender`.\n\nThis two-sided gating is how router-style UX flows (ETH wrapping, permit-based approvals, batched multicalls) can operate on user positions without holding approvals on the user's token balances directly: the admin whitelists the router contract globally, and each user opts in individually.\n\n## Architecture\n\nAave V4 splits its protocol into two contract families:\n\n- A **Hub** holds the per-asset accounting: the registry of supported assets, the per-asset interest rate strategy, the per-asset spoke registry, and the per-asset treasury split. Hubs and Spokes communicate via direct EVM contract calls (not cross-chain messaging), so they must be deployed on the same chain.\n- A **Spoke** sits on a specific chain and holds a set of **reserves** (one per supported asset). Each reserve defines the per-asset config (collateral and borrow flags, freeze, pause, oracle source) and points to a specific Hub for that asset's liquidity pool. A single Spoke can have reserves pointing to different Hubs (e.g., the Ethena Ecosystem Spoke has Ethena assets routed through the Plus Hub and stablecoin assets routed through the Core Hub).\n\nOn Ethereum there are 3 Hubs and 10 Spokes, organized by market type (a main market listing most blue-chip assets, plus several risk-isolated markets for stables, BTC, Ethena, and correlated-LST pairs). The per-Hub and per-Spoke config tables live in the sections below.\n\n## Oracles\n\nEach Spoke has its own paired **AaveOracle** that exposes one price source per reserveId. The price sources are typically Aave-deployed **PriceCapAdapters** that wrap a Chainlink feed (or for liquid-staked / wrapped assets, a ratio provider) with a growth-rate cap on the underlying ratio. The discount rate on these caps is tunable within governance-set bounds (see the upgrades & governance section).\n\nFor the full set of actors who can swap oracles or adjust cap discount rates, see the upgrades & governance section below and the permissions section.\n",
"otherConsiderations": [
{
"name": "Hubs",
"description": "3 Hubs pool liquidity across Spokes. Each Hub has its own InterestRateStrategy, fee configuration, and per-asset spoke registry.\n\nThe interest rate borrowers pay on a Hub is a kinked curve driven by **utilization** (`drawn / (liquidity + drawn)`, the fraction of the pool that is currently borrowed):\n\n\n\n- **Base rate**: the rate charged when utilization is zero (nothing borrowed).\n- **Optimal util**: the target utilization governance wants the pool to sit at. It is the \"kink\" on the curve.\n- **Slope 1**: the extra rate added as utilization grows from zero to the optimal point. At optimal util, the borrow rate equals `base + slope 1`.\n- **Slope 2**: the extra rate added between optimal and 100% utilization. At 100% util, the borrow rate equals `base + slope 1 + slope 2` (typically very large, to make borrowing prohibitively expensive when liquidity is scarce and to keep some available for withdrawers).\n\nThe table below shows per-asset: the number of Spokes registered for that asset, current idle liquidity, the protocol fee taken by the Treasury, the four rate-curve parameters, whether a reinvestment controller is active (see \"Reinvestment controllers\"), and any accrued deficit (bad debt absorbed by suppliers).\n\n**CoreHub** — 17 assets, strategy: CoreHubIRStrategy\n\n| Asset | Spokes | Liquidity | Fee | Base rate | Slope 1 | Slope 2 | Optimal util | Reinvestment | Deficit |\n|---|---|---|---|---|---|---|---|---|---|\n| WETH | 6 | 134.13 | 15.00% | 0.00% | 2.35% | 14.00% | 92% | none | 0 |\n| wstETH | 4 | 409.36 | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| weETH | 4 | 2K | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| rsETH | 3 | 1K | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| USDT | 7 | 33K | 10.00% | 0.00% | 4.00% | 20.00% | 92% | none | 0 |\n| USDC | 7 | 2.3M | 10.00% | 0.00% | 4.00% | 20.00% | 92% | none | 0 |\n| GHO | 5 | 379K | 10.00% | 0.00% | 4.00% | 30.00% | 90% | none | 0 |\n| eth:0x8292... | 5 | 9.85 | 20.00% | 0.00% | 4.00% | 35.00% | 80% | none | 0 |\n| eth:0xe343... | 5 | 484K | 20.00% | 0.00% | 4.00% | 35.00% | 90% | none | 0 |\n| eth:0xCAcd... | 7 | 1.0M | 20.00% | 0.00% | 4.00% | 35.00% | 90% | none | 0 |\n| EURC | 6 | 256.95 | 10.00% | 0.00% | 5.50% | 35.00% | 90% | none | 0 |\n| WBTC | 4 | 38.74 | 20.00% | 0.25% | 4.00% | 60.00% | 80% | none | 0 |\n| cbBTC | 4 | 0.77 | 20.00% | 0.25% | 4.00% | 60.00% | 80% | none | 0 |\n| LBTC | 3 | 0.00 | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| XAUt | 3 | 71.36 | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| AAVE | 3 | 5K | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| LINK | 3 | 54K | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n\n**PrimeHub** — 7 assets, strategy: PrimeHubIRStrategy\n\n| Asset | Spokes | Liquidity | Fee | Base rate | Slope 1 | Slope 2 | Optimal util | Reinvestment | Deficit |\n|---|---|---|---|---|---|---|---|---|---|\n| WETH | 3 | 385.66 | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| WBTC | 3 | 29.99 | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| cbBTC | 3 | 6.39 | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| wstETH | 3 | 257.25 | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| USDC | 3 | 105K | 10.00% | 0.00% | 4.00% | 20.00% | 92% | none | 0 |\n| USDT | 3 | 372K | 10.00% | 0.00% | 4.00% | 20.00% | 92% | none | 0 |\n| GHO | 3 | 387K | 10.00% | 0.00% | 4.00% | 30.00% | 90% | none | 0 |\n\n**PlusHub** — 7 assets, strategy: PlusHubIRStrategy\n\n| Asset | Spokes | Liquidity | Fee | Base rate | Slope 1 | Slope 2 | Optimal util | Reinvestment | Deficit |\n|---|---|---|---|---|---|---|---|---|---|\n| eth:0x3de0... | 4 | 118K | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| eth:0xAeBf... | 4 | 22.59 | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| sUSDe | 4 | 12K | 0.00% | 0.00% | 0.00% | 0.00% | 99% | none | 0 |\n| USDe | 4 | 5K | 25.00% | 0.00% | 4.50% | 30.00% | 90% | none | 0 |\n| USDC | 3 | 50K | 15.00% | 0.00% | 4.50% | 20.00% | 92% | none | 0 |\n| GHO | 3 | 49K | 10.00% | 0.00% | 4.50% | 30.00% | 90% | none | 0 |\n| USDT | 3 | 41K | 15.00% | 0.00% | 4.50% | 20.00% | 92% | none | 0 |",
"references": [],
"risks": []
},
{
"name": "Spokes",
"description": "10 Spokes on Ethereum, each a self-contained market with its own position boundary, liquidation parameters, and oracle. Each reserve within a Spoke routes to a specific Hub for liquidity.\n\nEach reserve is bounded on both sides by two per-(Hub, asset, Spoke) caps set by governance, expressed in whole tokens (so a cap of `500K` on USDC means 500,000 USDC):\n\n- **addCap**: the maximum amount that can be supplied to the Hub through this Spoke (caps the Spoke's share of the pool's liquidity). Reaching it blocks further deposits on this reserve until existing supply is withdrawn or the cap is raised.\n- **drawCap**: the maximum amount that can be borrowed from the Hub through this Spoke (caps the Spoke's outstanding debt to the Hub). Reaching it blocks further borrows on this reserve. It also bounds the worst-case bad debt a single Spoke can inflict on a Hub: if every position on that Spoke is liquidated at zero recovery, the loss to the shared Hub pool cannot exceed the drawCap.\n\nA value of `∞` means the cap is set to the uint40 sentinel and is effectively unlimited. A value of `0` means the corresponding action is currently disabled on that reserve.\n\n**KelpeSpoke** — 2 reserves, target HF 1.02, max bonus HF 0.99, bonus 100%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| rsETH | CoreHub | supply-only | no | yes | 0.00% | 0 | 0 |\n| WETH | CoreHub | supply-only | no | yes | 0.00% | 0 | 3K |\n\n**EthenaCorrelatedSpoke** — 4 reserves, target HF 1.03, max bonus HF 0.99, bonus 100%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| eth:0xAeBf... | PlusHub | supply-only | no | no | 0.00% | 50K | 0 |\n| eth:0x3de0... | PlusHub | supply-only | no | no | 0.00% | 400K | 0 |\n| sUSDe | PlusHub | supply-only | no | no | 0.00% | 250K | 0 |\n| USDe | PlusHub | borrowable | no | no | 0.00% | 313K | 325K |\n\n**GoldSpoke** — 8 reserves, target HF 1.31, max bonus HF 0.90, bonus 90%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| XAUt | CoreHub | supply-only | no | no | 0.00% | 250 | 0 |\n| USDC | CoreHub | borrowable | no | no | 0.00% | 0 | 125K |\n| eth:0x8292... | CoreHub | borrowable | no | no | 0.00% | 0 | 63K |\n| eth:0xe343... | CoreHub | borrowable | no | no | 0.00% | 0 | 63K |\n| eth:0xCAcd... | CoreHub | borrowable | no | no | 0.00% | 0 | 63K |\n| EURC | CoreHub | borrowable | no | no | 0.00% | 0 | 50K |\n| GHO | CoreHub | borrowable | no | no | 0.00% | 0 | 63K |\n| USDT | CoreHub | borrowable | no | no | 0.00% | 0 | 125K |\n\n**LombardBTCSpoke** — 3 reserves, target HF 1.06, max bonus HF 0.99, bonus 100%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| LBTC | CoreHub | supply-only | no | no | 0.00% | 9 | 0 |\n| WBTC | CoreHub | borrowable | no | no | 0.00% | 0 | 5 |\n| cbBTC | CoreHub | borrowable | no | no | 0.00% | 0 | 3 |\n\n**MainSpoke** — 14 reserves, target HF 1.24, max bonus HF 0.90, bonus 90%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| WETH | CoreHub | borrowable | no | no | 0.00% | 6K | 475 |\n| wstETH | CoreHub | supply-only | no | no | 0.00% | 650 | 0 |\n| weETH | CoreHub | supply-only | no | no | 0.00% | 200 | 0 |\n| WBTC | CoreHub | borrowable | no | no | 0.00% | 40 | 5 |\n| cbBTC | CoreHub | borrowable | no | no | 0.00% | 20 | 3 |\n| AAVE | CoreHub | supply-only | no | no | 0.00% | 12K | 0 |\n| LINK | CoreHub | supply-only | no | no | 0.00% | 75K | 0 |\n| USDC | CoreHub | borrowable | no | no | 0.00% | 6.0M | 6.0M |\n| USDT | CoreHub | borrowable | no | no | 0.00% | 4.0M | 4.0M |\n| EURC | CoreHub | borrowable | no | no | 0.00% | 225K | 150K |\n| eth:0x8292... | CoreHub | borrowable | no | no | 0.00% | 500K | 340K |\n| eth:0xe343... | CoreHub | borrowable | no | no | 0.00% | 2.0M | 1.4M |\n| eth:0xCAcd... | CoreHub | borrowable | no | no | 0.00% | 2.5M | 1.7M |\n| GHO | CoreHub | borrowable | no | no | 0.00% | 1.5M | 1.5M |\n\n**BluechipSpoke** — 11 reserves, target HF 1.17, max bonus HF 0.90, bonus 90%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| WETH | PrimeHub | supply-only | no | no | 0.00% | 500 | 0 |\n| WBTC | PrimeHub | supply-only | no | no | 0.00% | 30 | 0 |\n| cbBTC | PrimeHub | supply-only | no | no | 0.00% | 25 | 0 |\n| wstETH | PrimeHub | supply-only | no | no | 0.00% | 600 | 0 |\n| USDC | PrimeHub | borrowable | no | no | 0.00% | 1.5M | 1.8M |\n| USDT | PrimeHub | borrowable | no | no | 0.00% | 1.5M | 1.9M |\n| GHO | PrimeHub | borrowable | no | no | 0.00% | 3.0M | 3.4M |\n| USDC | CoreHub | borrowable | no | no | 0.00% | 0 | 375K |\n| eth:0xCAcd... | CoreHub | borrowable | no | no | 0.00% | 0 | 200K |\n| EURC | CoreHub | borrowable | no | no | 0.00% | 0 | 150K |\n| USDT | CoreHub | borrowable | no | no | 0.00% | 0 | 375K |\n\n**EthenaEcosystemSpoke** — 10 reserves, target HF 1.03, max bonus HF 0.99, bonus 100%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| eth:0xAeBf... | PlusHub | supply-only | no | no | 0.00% | 250K | 0 |\n| eth:0x3de0... | PlusHub | supply-only | no | no | 0.00% | 2.0M | 0 |\n| sUSDe | PlusHub | supply-only | no | no | 0.00% | 1.0M | 0 |\n| USDe | PlusHub | borrowable | no | no | 0.00% | 1.0M | 960K |\n| USDC | PlusHub | borrowable | no | no | 0.00% | 500K | 625K |\n| USDT | PlusHub | borrowable | no | no | 0.00% | 500K | 625K |\n| GHO | PlusHub | borrowable | no | no | 0.00% | 1.0M | 1.1M |\n| USDC | CoreHub | borrowable | no | no | 0.00% | 0 | 375K |\n| eth:0xCAcd... | CoreHub | borrowable | no | no | 0.00% | 0 | 200K |\n| USDT | CoreHub | borrowable | no | no | 0.00% | 0 | 375K |\n\n**EtherFieSpoke** — 2 reserves, target HF 1.02, max bonus HF 0.99, bonus 100%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| weETH | CoreHub | supply-only | no | no | 0.00% | 3K | 0 |\n| WETH | CoreHub | borrowable | no | no | 0.00% | 0 | 3K |\n\n**ForexSpoke** — 7 reserves, target HF 1.04, max bonus HF 0.99, bonus 100%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| EURC | CoreHub | borrowable | no | no | 0.00% | 300K | 313K |\n| USDC | CoreHub | borrowable | no | no | 0.00% | 400K | 135K |\n| USDT | CoreHub | borrowable | no | no | 0.00% | 400K | 135K |\n| eth:0x8292... | CoreHub | borrowable | no | no | 0.00% | 0 | 90K |\n| eth:0xe343... | CoreHub | borrowable | no | no | 0.00% | 0 | 90K |\n| eth:0xCAcd... | CoreHub | borrowable | no | no | 0.00% | 0 | 63K |\n| GHO | CoreHub | borrowable | no | no | 0.00% | 0 | 13K |\n\n**LidoeSpoke** — 2 reserves, target HF 1.01, max bonus HF 0.99, bonus 100%\n\n| Asset | Hub | Mode | Paused | Frozen | collateralRisk | addCap | drawCap |\n|---|---|---|---|---|---|---|---|\n| wstETH | CoreHub | supply-only | no | no | 0.00% | 2K | 0 |\n| WETH | CoreHub | borrowable | no | no | 0.00% | 0 | 2K |",
"references": [],
"risks": []
},
{
"name": "AccessManager roles",
"description": "9 roles configured on the AccessManager: ADMIN_ROLE, HUB_CONFIGURATOR_ROLE, HUB_CONFIGURATOR_DOMAIN_ADMIN_ROLE, HUB_FEE_MINTER_ROLE, HUB_DEFICIT_ELIMINATOR_ROLE, SPOKE_DOMAIN_ADMIN_ROLE, SPOKE_CONFIGURATOR_ROLE, SPOKE_USER_POSITION_UPDATER_ROLE, SPOKE_CONFIGURATOR_DOMAIN_ADMIN_ROLE. 15 PriceCapAdapters are deployed across all markets.",
"references": [],
"risks": []
},
{
"name": "Reinvestment controllers",
"description": "Each Hub asset has a configurable `reinvestmentController` address. When set to a non-zero address, this controller can:\n\n- **`sweep(assetId, amount)`**: withdraw idle liquidity tokens from the Hub to the controller's address. The Hub tracks the removed amount in `asset.swept` so supplier share value is preserved.\n- **`reclaim(assetId, amount)`**: return tokens to the Hub, decreasing `swept` and increasing `liquidity`.\n\nThe intended use is deploying idle liquidity into external yield strategies. If the controller reclaims more than it swept, the excess grows the pool for all suppliers. The swept amount is included in the interest rate formula denominator (`drawn / (liquidity + drawn + swept)`), so sweeping does not artificially inflate borrow rates.\n\n**Risk**: when active, the controller can physically remove all idle liquidity from the Hub. If a supplier tries to withdraw more than the remaining `liquidity`, the transaction reverts until the controller reclaims. A malicious or compromised controller could sweep funds and never return them.\n\n**Current status**: all assets on all three Hubs have `reinvestmentController` set to the zero address (disabled). No idle liquidity is currently being reinvested. Governance (via HubConfigurator.updateReinvestmentController, gated by the AccessManager) can activate a controller at any time.",
"references": [],
"risks": [
{
"category": "Funds can be frozen if",
"text": "a reinvestment controller is activated and sweeps most idle liquidity, making withdrawals temporarily unavailable until the controller reclaims."
},
{
"category": "Funds can be lost if",
"text": "a reinvestment controller is activated and the controller contract or its external yield strategy is compromised, preventing reclaim of swept funds."
}
]
}
],
"upgradesAndGovernance": "Privileged authority over Aave V4 is concentrated in a small number of multisigs and one onchain governance endpoint, and upgrades execute with no timelock. Every Hub, every Spoke, the Treasury, every PriceCapAdapter, the ACLManager, and the AccessManager itself is deployed behind a TransparentUpgradeableProxy.\n\nTwo independent access control systems gate privileged calls. The OpenZeppelin V5 `AccessManager` gates every admin function on every Hub and Spoke through the `restricted` modifier, using role labels such as `ADMIN_ROLE`, `HUB_CONFIGURATOR_ROLE`, and `SPOKE_CONFIGURATOR_ROLE`. The top-level `ADMIN_ROLE` currently has two members: the **AaveV4AdminMultisig** (a 5-of-8 Gnosis Safe) and the **AaveGovV3Executor** (the onchain endpoint that runs proposals approved through Aave Governance V3). Both members are configured with an execution delay of zero, so privileged calls execute immediately once the multisig quorum or the DAO vote is reached. In parallel, a legacy `ACLManager` inherited from Aave V3 (with bytes32 roles `POOL_ADMIN`, `RISK_ADMIN`, `EMERGENCY_ADMIN`) continues to gate the PriceCapAdapters used by V4 oracles; discount-rate adjustments on those caps flow through this older system rather than through the V4 AccessManager.\n\nUpgrades go through several `ProxyAdmin` contracts whose owners resolve to either the AaveV4AdminMultisig or the AaveGovV3Executor. There is no separate upgrade timelock: once either owner submits an upgrade, it takes effect in the same transaction. The single most concentrated trust assumption is therefore the AaveV4AdminMultisig: five of its eight signers can replace the implementation of any V4 contract at will.\n\nBecause the AaveV4AdminMultisig holds `ADMIN_ROLE` directly, the same five signers can execute any `restricted` function on any Hub or Spoke without going through the Aave DAO. In one transaction, and with no delay, they can:\n\n- swap the oracle feed on any reserve via `updateReservePriceSource` (a wrong price enables unfair liquidations or blocks legitimate ones);\n- list, reconfigure, or pause reserves via `addReserve` and `updateReserveConfig` on any Spoke;\n- halt or deactivate entire Spokes and assets via the HubConfigurator (`haltSpoke`, `deactivateSpoke`, `haltAsset`, `deactivateAsset`);\n- redirect protocol fees via `updateFeeReceiver` and `updateLiquidityFee`;\n- install a reinvestment controller that can sweep idle Hub liquidity into an external strategy via `updateReinvestmentController`;\n- replace the interest-rate strategy on any Hub via `updateInterestRateStrategy`;\n- activate or deactivate a position manager on any Spoke via `updatePositionManager`;\n- move any ERC20 balance held by the Treasury (whose owner is the same multisig).\n\nThe AaveGovV3Executor can do all of the same things, but only after an Aave Governance V3 onchain vote executes through the governance executor; the DAO vote process is public and takes days end-to-end, but the resulting transaction then executes on V4 with no additional delay.\n\nPosition-manager activation is the one privileged call that does **not** directly threaten user funds: the `onlyPositionManager` check on the Spoke requires both admin activation *and* explicit per-user approval (`setUserPositionManager`), so the admin cannot drain a user who has not individually approved the activated contract. The practical risk there is a \"lure\" pattern: the admin activates a contract that users are then encouraged to approve.\n\nTwo routine-tuning paths exist for risk parameters, bounded by ranges set at deploy time or by governance. Neither can upgrade contracts or move funds. The **RiskCouncilMultisig** (2-of-2) operates the `RiskSteward` and can adjust supply caps, borrow caps, LTV and liquidation parameters, and PriceCapAdapter discount rates, within per-reserve bounds returned onchain (with a 3-day cooldown between updates on the same reserve). The **GhoRiskCouncilMultisig** (3-of-4) operates the `GhoAaveSteward` and `GhoDirectMinter` and can adjust GHO borrow rates, bucket capacities, and pause or unpause GHO minting, within bounds. Neither steward can raise its own bounds; only the AaveV4AdminMultisig or the DAO can.\n\nThe **EmergencyAdminMultisig** (5-of-9) holds the `EMERGENCY_ADMIN` role on the legacy V3-era ACLManager and can trigger emergency actions (such as pausing a PriceCapAdapter) on the V3 system that V4 oracles still depend on. It does not hold any V4 AccessManager role.\n"
}
{
"addresses": {
"ethereum": [
{
"name": "GoldSpokeOracle",
"isVerified": true,
"address": "eth:0x0083421fd178749af2201ddA5A7C3feB5790B80c",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x0083421fd178749af2201ddA5A7C3feB5790B80c#code"
},
{
"name": "PlusHub",
"isVerified": true,
"address": "eth:0x06002e9c4412CB7814a791eA3666D905871E536A",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x078247481bCFa9AB3C566f7a769352b8B4189532"
],
"implementations": [
"eth:0x7914A24757F209C8B64B660A57A4374027533Db9"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277111,
"transactionHash": "0x350b9601f7d2f2aaf591c3017c815472923b2ae8a3a6374c2e6d50120a321e79",
"implementations": [
"eth:0x7914A24757F209C8B64B660A57A4374027533Db9"
]
}
],
"description": "Aave V4 Hub. Cross-chain accounting hub: per-asset config (interest rate strategy, treasury, premium) and the registry of spokes that hold each asset across all chains. Trust assumption: governance (via HubConfigurator) can change feeReceiver (redirecting revenue), irStrategy (swapping the interest rate model), reinvestmentController (who can sweep idle liquidity), and liquidityFee (fee percentage) per asset. The Hub also gates spoke-to-hub calls (add/remove/draw/restore) via data-level checks: the calling spoke must be registered, active, and not halted.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x06002e9c4412CB7814a791eA3666D905871E536A#code"
},
{
"name": "PendlePriceAdapterA",
"isVerified": true,
"address": "eth:0x0a72df02CE3E4185b6CEDf561f0AE651E9BeE235",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x0a72df02CE3E4185b6CEDf561f0AE651E9BeE235#code"
},
{
"name": "LombardBTCSpokeOracle",
"isVerified": true,
"address": "eth:0x198Cac7f54FFc7d709Ac0FEc4B6454CE73e21D3D",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x198Cac7f54FFc7d709Ac0FEc4B6454CE73e21D3D#code"
},
{
"name": "CappedFrxUSDPriceAdapter",
"isVerified": true,
"address": "eth:0x25DEd2f9aE6ae9416693AB63Abe3aB25493861FD",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x25DEd2f9aE6ae9416693AB63Abe3aB25493861FD#code"
},
{
"name": "CappedUSDTPriceAdapter",
"isVerified": true,
"address": "eth:0x260326c220E469358846b187eE53328303Efe19C",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x260326c220E469358846b187eE53328303Efe19C#code"
},
{
"name": "PlusHubIRStrategy",
"isVerified": true,
"address": "eth:0x31280650661b8443723fa9739b3A164E3696af48",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-asset interest rate model used by the Aave V4 Hub. Stores the kink + growth-rate parameters per assetId; the assetId space is owned by HUB.getAssetCount. Trust assumption: anyone who can change these parameters can squeeze borrowers or starve depositors.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x31280650661b8443723fa9739b3A164E3696af48#code"
},
{
"name": "KelpeSpoke",
"isVerified": true,
"address": "eth:0x3131FE68C4722e726fe6B2819ED68e514395B9a4",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x5BeA32dE95a6107E3B8A9Faa5CB1D182C7D60D0d"
],
"implementations": [
"eth:0xcf07444e37d4f53E3D94f95D62315C8f5E8a369d"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277267,
"transactionHash": "0x23da88f2d98ace1a6cb400333a71b56b753d8932560945a3a2d6f498c22d01ca",
"implementations": [
"eth:0xcf07444e37d4f53E3D94f95D62315C8f5E8a369d"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x3131FE68C4722e726fe6B2819ED68e514395B9a4#code"
},
{
"name": "KelpeSpokeOracle",
"isVerified": true,
"address": "eth:0x37C316996C714Bf906743071e04E62220b3271ac",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x37C316996C714Bf906743071e04E62220b3271ac#code"
},
{
"name": "CappedSUSDePriceAdapter",
"isVerified": true,
"address": "eth:0x42bc86f2f08419280a99d8fbEa4672e7c30a86ec",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x42bc86f2f08419280a99d8fbEa4672e7c30a86ec#code"
},
{
"name": "CappedRsETHPriceAdapter",
"isVerified": true,
"address": "eth:0x47F52B2e43D0386cF161e001835b03Ad49889e3b",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x47F52B2e43D0386cF161e001835b03Ad49889e3b#code"
},
{
"name": "EthenaCorrelatedSpoke",
"isVerified": true,
"address": "eth:0x58131E79531caB1d52301228d1f7b842F26B9649",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x2A2DEEe71645Ef881C788C85eD0C8E9f152B6531"
],
"implementations": [
"eth:0x0dA228131d6a8c685c94d6b73440d6E21a7e7340"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277483,
"transactionHash": "0x2791ad46fd3191f216bb01c1b821f5e9e32f5b79bd9ca43a47a3412ea4b94593",
"implementations": [
"eth:0x0dA228131d6a8c685c94d6b73440d6E21a7e7340"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x58131E79531caB1d52301228d1f7b842F26B9649#code"
},
{
"name": "CappedUSDCPriceAdapter",
"isVerified": true,
"address": "eth:0x581b8Bc9d6104F71ad6da1f483B67500968C5994",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x581b8Bc9d6104F71ad6da1f483B67500968C5994#code"
},
{
"name": "CappedLBTCPriceAdapter",
"isVerified": true,
"address": "eth:0x5C1771583dbbAE5AFEd71ACD2BfC0eA4029EBB04",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5C1771583dbbAE5AFEd71ACD2BfC0eA4029EBB04#code"
},
{
"name": "GoldSpoke",
"isVerified": true,
"address": "eth:0x65407b940966954b23dfA3caA5C0702bB42984DC",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x1De446C91cF141c76f6eeF2331128ED7A4536846"
],
"implementations": [
"eth:0x70ed94A65Df287Dc54184963d7A9EdC83Dd34223"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277339,
"transactionHash": "0x79d92519491ad8dd8dbfc16f7fcf31a3c339ab31849ad9818ccda855f81e7d20",
"implementations": [
"eth:0x70ed94A65Df287Dc54184963d7A9EdC83Dd34223"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x65407b940966954b23dfA3caA5C0702bB42984DC#code"
},
{
"name": "LidoeSpokeOracle",
"isVerified": true,
"address": "eth:0x664D73b6C3591333Fd79510f7ce9ef81228824F5",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x664D73b6C3591333Fd79510f7ce9ef81228824F5#code"
},
{
"name": "LombardBTCSpoke",
"isVerified": true,
"address": "eth:0x7EC68b5695e803e98a21a9A05d744F28b0a7753D",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x128E41124dbc7d81434f332F9759B93243758F7B"
],
"implementations": [
"eth:0xd315ae3d19D8F9701Ba15574339ba192bAAc33C3"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277303,
"transactionHash": "0xaedbb1794b898dec841d2e375013be9f07332f756528359c9d4dd34bdc95c94d",
"implementations": [
"eth:0xd315ae3d19D8F9701Ba15574339ba192bAAc33C3"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x7EC68b5695e803e98a21a9A05d744F28b0a7753D#code"
},
{
"name": "CappedWstETHPriceAdapter",
"isVerified": true,
"address": "eth:0x869C9Ae2C8fbe82a8b0F768b9F791f89E083222C",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x869C9Ae2C8fbe82a8b0F768b9F791f89E083222C#code"
},
{
"name": "LiquidationLogic",
"isVerified": true,
"address": "eth:0x88dF535473C5adf1f57789734A05E555F7Deb8DB",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Delegatecall library shared by every Spoke to execute liquidations. Immutable (set at Spoke construction time, cannot be changed at runtime). The liquidationCall entry point is permissionless by design: anyone can liquidate undercollateralized positions. The liquidator transfers their own tokens to repay part of the debt and receives the borrower's collateral at a discount determined by the Spoke's liquidation config.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x88dF535473C5adf1f57789734A05E555F7Deb8DB#code"
},
{
"name": "PrimeHub",
"isVerified": true,
"address": "eth:0x943827DCA022D0F354a8a8c332dA1e5Eb9f9F931",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x22249b31797bD067E37F49dC93614C316976B158"
],
"implementations": [
"eth:0xe1e61cC36EbdBe30d51D04F38D7930663dcfE940"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277015,
"transactionHash": "0x8e69f1809ed4f4f77ac78711f2f6e1151d9c55f00dfa7c88a660317942d3b0a2",
"implementations": [
"eth:0xe1e61cC36EbdBe30d51D04F38D7930663dcfE940"
]
}
],
"description": "Aave V4 Hub. Cross-chain accounting hub: per-asset config (interest rate strategy, treasury, premium) and the registry of spokes that hold each asset across all chains. Trust assumption: governance (via HubConfigurator) can change feeReceiver (redirecting revenue), irStrategy (swapping the interest rate model), reinvestmentController (who can sweep idle liquidity), and liquidityFee (fee percentage) per asset. The Hub also gates spoke-to-hub calls (add/remove/draw/restore) via data-level checks: the calling spoke must be registered, active, and not halted.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x943827DCA022D0F354a8a8c332dA1e5Eb9f9F931#code"
},
{
"name": "MainSpoke",
"isVerified": true,
"address": "eth:0x94e7A5dCbE816e498b89aB752661904E2F56c485",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0xfFeAcCAd70f4393701272212dACD791c01957f7f"
],
"implementations": [
"eth:0xABd0E26FE17BDe4F1f1187Ed8aA80C274E03D8b5"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277159,
"transactionHash": "0xf9d58fb2d4bed9e43c0c8061243fc76e8c7c32dc2f394808ebcaeac49b97a0d6",
"implementations": [
"eth:0xABd0E26FE17BDe4F1f1187Ed8aA80C274E03D8b5"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x94e7A5dCbE816e498b89aB752661904E2F56c485#code"
},
{
"name": "BluechipSpoke",
"isVerified": true,
"address": "eth:0x973a023A77420ba610f06b3858aD991Df6d85A08",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0xD56EF224603F64b5d9530b49cA690ED76C3d3cF1"
],
"implementations": [
"eth:0x7a603B734EA48CD02ef38671b6CD3e06573f7450"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277411,
"transactionHash": "0x0160f0f37b5ccafd08e39c2af94ec46c564bb554bf8cd52a59b7259cf775e645",
"implementations": [
"eth:0x7a603B734EA48CD02ef38671b6CD3e06573f7450"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x973a023A77420ba610f06b3858aD991Df6d85A08#code"
},
{
"name": "MainSpokeOracle",
"isVerified": true,
"address": "eth:0x99B2B6CEa9C3D2fd8F4d90f86741C44B212a6127",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x99B2B6CEa9C3D2fd8F4d90f86741C44B212a6127#code"
},
{
"name": "EthenaCorrelatedSpokeOracle",
"isVerified": true,
"address": "eth:0x9b91a0943CADf554742E8Fb358B1cC4ae4F85F01",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9b91a0943CADf554742E8Fb358B1cC4ae4F85F01#code"
},
{
"name": "PendlePriceAdapterB",
"isVerified": true,
"address": "eth:0xa0dc0249c32fa79e8B9b17c735908a60b1141B40",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xa0dc0249c32fa79e8B9b17c735908a60b1141B40#code"
},
{
"name": "CappedEURCPriceAdapter",
"isVerified": true,
"address": "eth:0xa6aB031A4d189B24628EC9Eb155F0a0f1A0E55a3",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xa6aB031A4d189B24628EC9Eb155F0a0f1A0E55a3#code"
},
{
"name": "CoreHubIRStrategy",
"isVerified": true,
"address": "eth:0xAD88791B0F81D1FA242f637eB05bee0cbc53fe2f",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-asset interest rate model used by the Aave V4 Hub. Stores the kink + growth-rate parameters per assetId; the assetId space is owned by HUB.getAssetCount. Trust assumption: anyone who can change these parameters can squeeze borrowers or starve depositors.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xAD88791B0F81D1FA242f637eB05bee0cbc53fe2f#code"
},
{
"name": "ForexSpokeOracle",
"isVerified": true,
"address": "eth:0xB3CE6E7b6d389a66eA4a3777bA07219d00FB3a9D",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xB3CE6E7b6d389a66eA4a3777bA07219d00FB3a9D#code"
},
{
"name": "TreasurySpoke",
"isVerified": true,
"address": "eth:0xB9B0b8616f6Bf6841972a52058132BE08d723155",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x890B79dDcdCCd663B4D7fC121A7A70184489b505"
],
"implementations": [
"eth:0xECc0B581F2E7a5D9eB79b01a4972475f03F2076e"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277003,
"transactionHash": "0x26a243de4ed677f933301f08051f3ca13e5b4bb81b4a8da6b91bd433dd1c56e1",
"implementations": [
"eth:0xECc0B581F2E7a5D9eB79b01a4972475f03F2076e"
]
}
],
"description": "Receives the per-asset accrued protocol fees (configured in Hub.getAssetConfig.feeReceiver). Uses Ownable2Step (NOT the AccessManager), meaning the owner (a GnosisSafe multisig) has unconstrained authority. The transfer(token, to, amount) and withdraw(hub, assetId, amount, to) functions can move any token the Treasury holds to any address with no timelock. Ownership transfer requires acceptance by the new owner (2-step).\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xB9B0b8616f6Bf6841972a52058132BE08d723155#code"
},
{
"name": "EthenaEcosystemSpoke",
"isVerified": true,
"address": "eth:0xba1B3D55D249692b669A164024A838309B7508AF",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0xbceB5eBf77DcBBE1d2081d6BF591F04154BBa494"
],
"implementations": [
"eth:0x9711eaA68eB932faacf1555536BfEf3Eee4BdfFA"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277447,
"transactionHash": "0xc6dc3c03bc7aac2fa82ab1be78d21a1ca03f04be5a3a06132f43e4c529c941fb",
"implementations": [
"eth:0x9711eaA68eB932faacf1555536BfEf3Eee4BdfFA"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xba1B3D55D249692b669A164024A838309B7508AF#code"
},
{
"name": "EtherFieSpoke",
"isVerified": true,
"address": "eth:0xbF10BDfE177dE0336aFD7fcCF80A904E15386219",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0xDdC6B7F9e0E1A17a2140Ed4d1bA75E68a2D45B43"
],
"implementations": [
"eth:0x9DE5a0A5c61A1891946aAf28b0B332dDad2a975D"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277231,
"transactionHash": "0x7b38277f62fc376128453c12dd178f7bffb7224fe8344530cb3301cd689fc64d",
"implementations": [
"eth:0x9DE5a0A5c61A1891946aAf28b0B332dDad2a975D"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xbF10BDfE177dE0336aFD7fcCF80A904E15386219#code"
},
{
"name": "CappedUSDePriceAdapter",
"isVerified": true,
"address": "eth:0xC26D4a1c46d884cfF6dE9800B6aE7A8Cf48B4Ff8",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xC26D4a1c46d884cfF6dE9800B6aE7A8Cf48B4Ff8#code"
},
{
"name": "EthenaEcosystemSpokeOracle",
"isVerified": true,
"address": "eth:0xc390dbe9fc00D6db73C52d375642b47008C33c90",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xc390dbe9fc00D6db73C52d375642b47008C33c90#code"
},
{
"name": "CoreHub",
"isVerified": true,
"address": "eth:0xCca852Bc40e560adC3b1Cc58CA5b55638ce826c9",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x55b71C0aeD3c616162eE7c608c089A1055CEA3Bf"
],
"implementations": [
"eth:0xfE89fd96F270ac3C0F11921aF0390dbB1340F704"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277063,
"transactionHash": "0x3e60ffadbdedb2ca069c4261482ae525102a61f31bc47aeb7c3dc4d0c05bfc85",
"implementations": [
"eth:0xfE89fd96F270ac3C0F11921aF0390dbB1340F704"
]
}
],
"description": "Aave V4 Hub. Cross-chain accounting hub: per-asset config (interest rate strategy, treasury, premium) and the registry of spokes that hold each asset across all chains. Trust assumption: governance (via HubConfigurator) can change feeReceiver (redirecting revenue), irStrategy (swapping the interest rate model), reinvestmentController (who can sweep idle liquidity), and liquidityFee (fee percentage) per asset. The Hub also gates spoke-to-hub calls (add/remove/draw/restore) via data-level checks: the calling spoke must be registered, active, and not halted.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xCca852Bc40e560adC3b1Cc58CA5b55638ce826c9#code"
},
{
"name": "GhoPriceOracle",
"isVerified": true,
"address": "eth:0xD110cac5d8682A3b045D5524a9903E031d70FCCd",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xD110cac5d8682A3b045D5524a9903E031d70FCCd#code"
},
{
"name": "EtherFieSpokeOracle",
"isVerified": true,
"address": "eth:0xd8B153FaAA8f2b1bC774916FEd333A4F3dE48792",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xd8B153FaAA8f2b1bC774916FEd333A4F3dE48792#code"
},
{
"name": "ForexSpoke",
"isVerified": true,
"address": "eth:0xD8B93635b8C6d0fF98CbE90b5988E3F2d1Cd9da1",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0xA0a8d221F6592780F00dF65eE9ABc2489395C29f"
],
"implementations": [
"eth:0x20dF646124bE8B2067d0EdE32Caf143DF851573F"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277375,
"transactionHash": "0x780cd9c29c0d4fe3231a5b3409c53e8b6af447a8029278ba05a657dd0752286d",
"implementations": [
"eth:0x20dF646124bE8B2067d0EdE32Caf143DF851573F"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xD8B93635b8C6d0fF98CbE90b5988E3F2d1Cd9da1#code"
},
{
"name": "BluechipSpokeOracle",
"isVerified": true,
"address": "eth:0xdA1266a7b8620819dAE3F8bd6B546Da36e505bB8",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-reserve price oracle for an Aave V4 spoke. Maps each reserveId on the paired spoke to a price source contract (a Chainlink feed wrapped in a price-cap adapter, or a fixed-price adapter for stables). The Spoke depends on it for every borrow, withdraw, and liquidation calculation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xdA1266a7b8620819dAE3F8bd6B546Da36e505bB8#code"
},
{
"name": "PrimeHubIRStrategy",
"isVerified": true,
"address": "eth:0xDCd924047a4bDBFef9CCDDe845E5D45373Ad276D",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-asset interest rate model used by the Aave V4 Hub. Stores the kink + growth-rate parameters per assetId; the assetId space is owned by HUB.getAssetCount. Trust assumption: anyone who can change these parameters can squeeze borrowers or starve depositors.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xDCd924047a4bDBFef9CCDDe845E5D45373Ad276D#code"
},
{
"name": "LidoeSpoke",
"isVerified": true,
"address": "eth:0xe1900480ac69f0B296841Cd01cC37546d92F35Cd",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x8867D58d75745020669D61677ae29d69330c6cD5"
],
"implementations": [
"eth:0xF5B962FeE67fB810BCdFDc2a39BecAD4Fb1b687A"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1774277195,
"transactionHash": "0x8e840c767e0d83bde434f69869f60ce897676f77c04031bfbe28ee1134b3ae90",
"implementations": [
"eth:0xF5B962FeE67fB810BCdFDc2a39BecAD4Fb1b687A"
]
}
],
"description": "Aave V4 Spoke. The user-facing lending contract that holds per-asset reserves and routes liquidity through the Hub. Trust assumption: you trust the AccessManager role holders not to swap the oracle feed (updateReservePriceSource), not to activate a malicious position manager (updatePositionManager), not to freeze your reserves (updateReserveConfig), and not to push a malicious code upgrade via the proxy admin. All admin functions carry the restricted modifier, user functions require onlyPositionManager, and liquidationCall is permissionless by design.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xe1900480ac69f0B296841Cd01cC37546d92F35Cd#code"
},
{
"name": "CappedRLUSDPriceAdapter",
"isVerified": true,
"address": "eth:0xf0eaC18E908B34770FDEe46d069c846bDa866759",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xf0eaC18E908B34770FDEe46d069c846bDa866759#code"
},
{
"name": "CappedWeETHPriceAdapter",
"isVerified": true,
"address": "eth:0xf112aF6F0A332B815fbEf3Ff932c057E570b62d3",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xf112aF6F0A332B815fbEf3Ff932c057E570b62d3#code"
},
{
"name": "FixedUSDGPriceAdapter",
"isVerified": true,
"address": "eth:0xF29b1e3b68Fd59DD0a413811fD5d0AbaE653216d",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave-deployed price oracle adapter that wraps a Chainlink feed (BASE_TO_USD_AGGREGATOR) with a growth-rate cap and an optional ratio provider (RATIO_PROVIDER) for liquid-staked or correlated assets. The cap bounds how fast the wrapped price can grow; the ACL_MANAGER is the only contract that can re-snapshot or re-arm the cap. The ratio provider is the underlying staked-asset contract; the trust analysis treats it as a foreign asset, not as something to walk.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xF29b1e3b68Fd59DD0a413811fD5d0AbaE653216d#code"
},
{
"name": "PrimeACLManager",
"isVerified": true,
"address": "eth:0x013E2C7567b6231e865BB9273F8c7656103611c0",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Legacy Aave V3 access control contract (OpenZeppelin AccessControl with bytes32 roles). This is the SECOND trust path in Aave V4, independent of the OZ V5 AccessManager. RISK_ADMIN and POOL_ADMIN role holders can change PriceCapAdapter discount rates (setDiscountRatePerYear), which directly affects wrapped-asset price caps and liquidation thresholds. DEFAULT_ADMIN_ROLE can grant and revoke every other role. Users must trust both access control systems independently.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x013E2C7567b6231e865BB9273F8c7656103611c0#code"
},
{
"name": "AccessManager",
"isVerified": true,
"address": "eth:0x08aE3BE30958cDd1847ec58fFfd4C451a87fDF01",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "OpenZeppelin V5 AccessManager with an enumerable extension. The single source of truth for which roles can call which functions on which Aave V4 contracts. Trusting any Aave V4 instance ultimately reduces to trusting the role members and target gating registered here.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x08aE3BE30958cDd1847ec58fFfd4C451a87fDF01#code"
},
{
"name": "HubConfigurator",
"isVerified": true,
"address": "eth:0x1F0753480bB03EaA00863224602267B7E0525C3d",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Privileged admin interface for the Hub, gated through the AccessManager's restricted modifier. Every function on this contract is a trust-critical operation: listing/delisting assets, swapping interest rate strategies, redirecting fee receivers, adding/removing spokes, and setting position caps. The HubConfigurator is the primary path through which governance changes Hub-side parameters.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1F0753480bB03EaA00863224602267B7E0525C3d#code"
},
{
"name": "SpokeConfigurator",
"isVerified": true,
"address": "eth:0x9BFFf48BFb5A7AE70c348d4d4cb97E8DEFa5389a",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Privileged admin interface for Spokes, gated through the AccessManager's restricted modifier. Controls the most security-sensitive Spoke operations: oracle price source replacement (updateReservePriceSource), position manager activation (updatePositionManager), per-reserve pause/freeze flags, collateral risk weights, liquidation parameters, and reserve listing/delisting. All functions carry the restricted modifier.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9BFFf48BFb5A7AE70c348d4d4cb97E8DEFa5389a#code"
},
{
"name": "CoreACLManager",
"isVerified": true,
"address": "eth:0xc2aaCf6553D20d1e9d78E365AAba8032af9c85b0",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Legacy Aave V3 access control contract (OpenZeppelin AccessControl with bytes32 roles). This is the SECOND trust path in Aave V4, independent of the OZ V5 AccessManager. RISK_ADMIN and POOL_ADMIN role holders can change PriceCapAdapter discount rates (setDiscountRatePerYear), which directly affects wrapped-asset price caps and liquidation thresholds. DEFAULT_ADMIN_ROLE can grant and revoke every other role. Users must trust both access control systems independently.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xc2aaCf6553D20d1e9d78E365AAba8032af9c85b0#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x04F84020Fdf10d9ee64D1dcC2986EDF2F556DA11",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x04F84020Fdf10d9ee64D1dcC2986EDF2F556DA11#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0x078247481bCFa9AB3C566f7a769352b8B4189532",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x078247481bCFa9AB3C566f7a769352b8B4189532#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0x128E41124dbc7d81434f332F9759B93243758F7B",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x128E41124dbc7d81434f332F9759B93243758F7B#code"
},
{
"name": "Executor",
"isVerified": true,
"address": "eth:0x14339e2178A954d5FB839D5Ff31644fE0F25F517",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x14339e2178A954d5FB839D5Ff31644fE0F25F517#code"
},
{
"name": "MainDiscountRateAgent",
"isVerified": true,
"address": "eth:0x1B3bD355c43d2247946b8e0889d4b4e701bf430d",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 automation agent (AaveDiscountRateAgent). Holds RISK_ADMIN on the ACLManager to perform automated discount rate adjustments. The agent's admin is the Aave Governance V3 Executor via the AgentHub.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1B3bD355c43d2247946b8e0889d4b4e701bf430d#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0x1De446C91cF141c76f6eeF2331128ED7A4536846",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1De446C91cF141c76f6eeF2331128ED7A4536846#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x214eD9Da11D2fbe465a6fc601a91E62EbEc1a0D6",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x214eD9Da11D2fbe465a6fc601a91E62EbEc1a0D6#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0x22249b31797bD067E37F49dC93614C316976B158",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x22249b31797bD067E37F49dC93614C316976B158#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x26C46B7aD0012cA71F2298ada567dC9Af14E7f2A",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x26C46B7aD0012cA71F2298ada567dC9Af14E7f2A#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0x2A2DEEe71645Ef881C788C85eD0C8E9f152B6531",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x2A2DEEe71645Ef881C788C85eD0C8E9f152B6531#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x2c1d072e956AFFC0D435Cb7AC38EF18d24d9127c",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x2c1d072e956AFFC0D435Cb7AC38EF18d24d9127c#code"
},
{
"name": "RsETHGhoDirectMinter",
"isVerified": true,
"address": "eth:0x2cE01c87Fec1b71A9041c52CaED46Fc5f4807285",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0xD3cF979e676265e4f6379749DECe4708B9A22476"
],
"implementations": [
"eth:0xc718786A7E45353835De634897385b3371A749f0"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1735575551,
"transactionHash": "0xfe523145c2898c1feca3710cab60f06d40af5948fc6c71f38edbe5910d00217c",
"implementations": [
"eth:0xc718786A7E45353835De634897385b3371A749f0"
]
}
],
"description": "Aave V3 GhoDirectMinter. Contract that can mint/burn GHO tokens via an Aave V3 Pool facilitator. Holds RISK_ADMIN on the ACLManager. The guardian can pause minting. Owned by Aave Governance (Executor).\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x2cE01c87Fec1b71A9041c52CaED46Fc5f4807285#code"
},
{
"name": "PoolAddressesProvider",
"isVerified": true,
"address": "eth:0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 addresses provider (registry). Reached from Aave V4 because some V4 reserves are GHO-related contracts that route through the V3 GHO module. Cut walks into V3 internals; the V3 stack belongs to its own discovery.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x3E7d1eAB13ad0104d2750B8863b489D65364e32D",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x3E7d1eAB13ad0104d2750B8863b489D65364e32D#code"
},
{
"name": "MainEModeAgent",
"isVerified": true,
"address": "eth:0x4F2858d4A4e4464b34Aa4a22C41B2Ef540a59BF4",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 automation agent (AaveDiscountRateAgent). Holds RISK_ADMIN on the ACLManager to perform automated discount rate adjustments. The agent's admin is the Aave Governance V3 Executor via the AgentHub.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x4F2858d4A4e4464b34Aa4a22C41B2Ef540a59BF4#code"
},
{
"name": "RsETHCapoAgent",
"isVerified": true,
"address": "eth:0x52E652182b22C41d0202bB8D834982F43B12Cd21",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 automation agent (AaveDiscountRateAgent). Holds RISK_ADMIN on the ACLManager to perform automated discount rate adjustments. The agent's admin is the Aave Governance V3 Executor via the AgentHub.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x52E652182b22C41d0202bB8D834982F43B12Cd21#code"
},
{
"name": "AaveGovV3Executor",
"isVerified": true,
"address": "eth:0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave Governance V3 Executor. The chain-specific executor that runs proposals approved by Aave Governance V3. From Aave V4's perspective, this is the upgrade authority of the AccessManager and a leaf trust root: deeper Aave Gov V3 internals (PayloadsController, Governance, voting portals) belong in Aave Gov V3's own discovery.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x547a514d5e3769680Ce22B2361c10Ea13619e8a9",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x547a514d5e3769680Ce22B2361c10Ea13619e8a9#code"
},
{
"name": "MainGhoDirectMinter",
"isVerified": true,
"address": "eth:0x5513224daaEABCa31af5280727878d52097afA05",
"upgradeability": {
"proxyType": "EIP1967 proxy",
"admins": [
"eth:0x40E4243C9471bb0a84Ba0968bccc9b8975E5Ee62"
],
"implementations": [
"eth:0xE4C958dE49303c9be571E00582CF9454586dE76F"
]
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1755787667,
"transactionHash": "0x134b41aa0e6a2beb6ca5eb481f2ddbf27e840ba659101d5d9f6c2115682088cb",
"implementations": [
"eth:0xE4C958dE49303c9be571E00582CF9454586dE76F"
]
}
],
"description": "Aave V3 GhoDirectMinter. Contract that can mint/burn GHO tokens via an Aave V3 Pool facilitator. Holds RISK_ADMIN on the ACLManager. The guardian can pause minting. Owned by Aave Governance (Executor).\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5513224daaEABCa31af5280727878d52097afA05#code"
},
{
"name": "CoreHubProxyAdmin",
"isVerified": true,
"address": "eth:0x55b71C0aeD3c616162eE7c608c089A1055CEA3Bf",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x55b71C0aeD3c616162eE7c608c089A1055CEA3Bf#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0x5BeA32dE95a6107E3B8A9Faa5CB1D182C7D60D0d",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5BeA32dE95a6107E3B8A9Faa5CB1D182C7D60D0d#code"
},
{
"name": "RsETHGhoAaveSteward",
"isVerified": true,
"address": "eth:0x5C905d62B22e4DAa4967E517C4a047Ff6026C731",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 GhoAaveSteward. Automation contract that holds RISK_ADMIN to adjust GHO-specific parameters within hardcoded bounds: max 5% rate parameter change per update, 1-day cooldown. The RISK_COUNCIL address can trigger these changes without a governance proposal. Owned by Aave Governance (Executor).\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5C905d62B22e4DAa4967E517C4a047Ff6026C731#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419#code"
},
{
"name": "RsETHRiskSteward",
"isVerified": true,
"address": "eth:0x7e6a6B115D31d4A837E3C737c49Cf6Fafe6112C3",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 RiskSteward. Automation contract that holds RISK_ADMIN to adjust risk parameters within hardcoded bounds (3-day cooldown per parameter). The RISK_COUNCIL address can trigger these changes without a governance proposal. Owned by Aave Governance (Executor).\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x7e6a6B115D31d4A837E3C737c49Cf6Fafe6112C3#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0x8867D58d75745020669D61677ae29d69330c6cD5",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x8867D58d75745020669D61677ae29d69330c6cD5#code"
},
{
"name": "TreasuryProxyAdmin",
"isVerified": true,
"address": "eth:0x890B79dDcdCCd663B4D7fC121A7A70184489b505",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x890B79dDcdCCd663B4D7fC121A7A70184489b505#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6#code"
},
{
"name": "MainGhoAaveSteward",
"isVerified": true,
"address": "eth:0x98217A06721Ebf727f2C8d9aD7718ec28b7aAe34",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 GhoAaveSteward. Automation contract that holds RISK_ADMIN to adjust GHO-specific parameters within hardcoded bounds: max 5% rate parameter change per update, 1-day cooldown. The RISK_COUNCIL address can trigger these changes without a governance proposal. Owned by Aave Governance (Executor).\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x98217A06721Ebf727f2C8d9aD7718ec28b7aAe34#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0x9B4a96210bc8D9D55b1908B465D8B0de68B7fF83",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9B4a96210bc8D9D55b1908B465D8B0de68B7fF83#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0xA0a8d221F6592780F00dF65eE9ABc2489395C29f",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xA0a8d221F6592780F00dF65eE9ABc2489395C29f#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0xb49f677943BC038e9857d61E7d053CaA2C1734C1",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xb49f677943BC038e9857d61E7d053CaA2C1734C1#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0xbceB5eBf77DcBBE1d2081d6BF591F04154BBa494",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xbceB5eBf77DcBBE1d2081d6BF591F04154BBa494#code"
},
{
"name": "CapoAgent",
"isVerified": true,
"address": "eth:0xCc18Be380838956aad41FD22466085eD66aaBB46",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 automation agent (AaveDiscountRateAgent). Holds RISK_ADMIN on the ACLManager to perform automated discount rate adjustments. The agent's admin is the Aave Governance V3 Executor via the AgentHub.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xCc18Be380838956aad41FD22466085eD66aaBB46#code"
},
{
"name": "PoolAddressesProvider",
"isVerified": true,
"address": "eth:0xcfBf336fe147D643B9Cb705648500e101504B16d",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 addresses provider (registry). Reached from Aave V4 because some V4 reserves are GHO-related contracts that route through the V3 GHO module. Cut walks into V3 internals; the V3 stack belongs to its own discovery.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xcfBf336fe147D643B9Cb705648500e101504B16d#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0xD56EF224603F64b5d9530b49cA690ED76C3d3cF1",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xD56EF224603F64b5d9530b49cA690ED76C3d3cF1#code"
},
{
"name": "MainRatesAgent",
"isVerified": true,
"address": "eth:0xdA626E64f34f24e0236E0C9cD2F11ce4549a08c6",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 automation agent (AaveDiscountRateAgent). Holds RISK_ADMIN on the ACLManager to perform automated discount rate adjustments. The agent's admin is the Aave Governance V3 Executor via the AgentHub.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xdA626E64f34f24e0236E0C9cD2F11ce4549a08c6#code"
},
{
"name": "ProxyAdmin",
"isVerified": true,
"address": "eth:0xDdC6B7F9e0E1A17a2140Ed4d1bA75E68a2D45B43",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xDdC6B7F9e0E1A17a2140Ed4d1bA75E68a2D45B43#code"
},
{
"name": "EACAggregatorProxy",
"isVerified": true,
"address": "eth:0xF4030086522a5bEEa4988F8cA5B36dbC97BeE88c",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Chainlink price feed proxy. Wraps an underlying aggregator and forwards latestAnswer / latestRoundData; the admin chain belongs to Chainlink, not the consuming protocol.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xF4030086522a5bEEa4988F8cA5B36dbC97BeE88c#code"
},
{
"name": "MainRiskSteward",
"isVerified": true,
"address": "eth:0xFCE597866Ffaf617EFdcA1C1Ad50eBCB16B5171E",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Aave V3 RiskSteward. Automation contract that holds RISK_ADMIN to adjust risk parameters within hardcoded bounds (3-day cooldown per parameter). The RISK_COUNCIL address can trigger these changes without a governance proposal. Owned by Aave Governance (Executor).\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xFCE597866Ffaf617EFdcA1C1Ad50eBCB16B5171E#code"
},
{
"name": "MainSpokeProxyAdmin",
"isVerified": true,
"address": "eth:0xfFeAcCAd70f4393701272212dACD791c01957f7f",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xfFeAcCAd70f4393701272212dACD791c01957f7f#code"
}
]
},
"risks": [
{
"category": "Funds can be lost if",
"text": "the position manager on a Spoke is changed to a malicious contract via updatePositionManager (gated by AccessManager roles). An active position manager can supply, withdraw, borrow, and repay on behalf of all users who approved it."
},
{
"category": "Funds can be lost if",
"text": "an oracle price source is swapped to a malicious feed via updateReservePriceSource (gated by AccessManager roles). The oracle controls all collateral valuations; a wrong price enables unfair liquidations or prevents legitimate ones."
},
{
"category": "Funds can be lost if",
"text": "a malicious code upgrade is pushed through the proxy admin chain. Every Hub, Spoke, and Treasury is behind a TransparentUpgradeableProxy; the upgrade authority traces back to the Aave Governance V3 Executor."
},
{
"category": "Funds can be lost if",
"text": "the AaveV4AdminMultisig (5/8) calls transfer() or withdraw() on the Treasury to drain accumulated protocol fees. These functions have no timelock."
},
{
"category": "Funds can be lost if",
"text": "the interest rate strategy is swapped to a malicious contract via updateInterestRateStrategy on the HubConfigurator, or the fee receiver is redirected via updateFeeReceiver. Both are gated by AccessManager roles."
},
{
"category": "Funds can be frozen if",
"text": "AccessManager role holders freeze or pause reserves via the SpokeConfigurator (freezeReserve, pauseReserve, freezeAllReserves, pauseAllReserves) or halt/deactivate Spokes or assets via the HubConfigurator."
}
]
}