Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
aave/aave-v3-core
master @ 782f519
56
Fixes
0
CVEs
HIGH
Peak severity
29.7%
Coverage
Highlights
Logic Error: 25 prior fixes. Scrutinize any change in this area.
contracts/protocol/libraries/logic/ValidationLogic.sol: most-fixed (8 issues). Treat as high-risk during review.
39 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: ValidationLogic serves as the central security checkpoint for asset transactions. The contract historically suffered from bypasses in siloed borrowing validation, automated collateral configurations, and publicly accessible validation entry points. Additionally, external visibility of validation helper libraries allowed unauthorized direct execution pathways.
Logic Error: The accounting of isolation mode total debt is highly prone to decimal precision mismatches and scaling bugs. Failure to correctly align debt ceilings, currency units, and borrow totals can allow attackers to bypass borrow limit caps or prematurely zero out active debt records.
Reentrancy: Flash loans operate on external callback execution, creating prime vectors for reentrancy. Delayed state updates or early array allocations prior to validation allow re-entering callers to exploit stale balances and manipulate reserve indexes.