Aave Says V3.8 Guard Would Preserve Flash-Loan Liquidations

Aave Labs says its proposed V3.8 security upgrade would leave open a route used by flash-loan integrations to liquidate borrowing positions.

In an Oct. 23 clarification, Aave Labs said flashLoan() and flashLoanSimple() would remain outside the guard. That would allow a flash-loan callback to continue calling Aave Pool functions, including a liquidation, under the proposed design.

“Flash loans are not guarded in Aave V3.8,” Aave Labs said.

A flash loan lets a contract use Pool liquidity during one transaction. A liquidation integration can use those assets to repay an unhealthy borrow and take discounted collateral, which can help repay the flash loan. The callback is the contract code that runs after the borrowed assets are made available and before the transaction ends.

For flashLoanSimple(), the receiver must return the borrowed amount plus a fee in the same transaction. If it does not meet that repayment condition, the transaction reverts.

The proposed guard would use Ethereum transient storage, which holds data only for the duration of a transaction and is discarded when the transaction ends. The guard is intended to protect Pool accounting when a transaction interacts with the Pool more than once. The proposed design would let existing tools and integrations that rely on Aave flash loans continue to work as they do today.

V3.8 remains under community review. The proposed process starts with feedback; if it is positive, the next step is a Snapshot vote, followed by audits from Certora and other third parties before a formal Aave Improvement Proposal. Aave Labs’ earlier proposal for a transient-storage guard described the broader security change.