DeFi protocol (you keep your wallet, funds sit in a smart contract)
Aave v4C3/5· Higher risk
Facts last reviewed 27 Sept 2026
Aave's new version under a Hub-and-Spoke model, running on Ethereum since 30/3/2026 (Avalanche since 7/2026), audited by multiple firms, with no incidents recorded. The new code is under 1 year old, and initial limits remain low.
Compare a move (switching cost) →History: published and paid rates, incidents, legal status →
Why this tier
- Fails: Live only since 2026-03, under 1 year
- Meets: Audited by 5 firms: ChainSecurity, Trail of Bits, Certora, Sherlock, Blackthorn
- Meets: Bug bounty programme (Sherlock, up to $3.5M)
- Falls short: TVL $668.9M, below $1B
- Meets: No recorded incident causing user losses in the core product
- Note: Risk of the asset itself: Liquidity is shared within each Hub: depositors bear bad-debt risk from every Spoke borrowing from that Hub, although each Spoke has separate risk parameters and caps. The code is new and has not been through a stressed market cycle.
- Note: Launched with 3 Hubs (Core, Prime, Plus) and conservative supply/borrow caps; the Aave DAO votes to raise caps, add Spokes, and expand to more networks.
- Note: Two sources on the bug bounty do not match: Aave’s Immunefi page lists up to USD 1 million, while aave.com/security states “Aave Core ... Up to $5M” on Immunefi. V4 has used a separate program on Sherlock (up to USD 3.5 million) since 18/5/2026.
Tier history
- 29 Sept 2026C· Higher riskHigher risk
Products
| Coin | You earn | Highest rate | Tier | Product | Term | Conditions |
|---|---|---|---|---|---|---|
| USDE | 0.00% | Highest rate0.00% | C3/5· Higher risk | aave-v4 · Ethereum · Plus | FlexibleWithdraw any time | |
| BTC | 0.00% | Highest rate0.00% | C3/5· Higher risk | aave-v4 · Ethereum · Core | FlexibleWithdraw any time |
BTCTier: A lowest risk, D active incident. The number after the letter is the criteria met.