Author: Deep Tide TechFlow

On November 12, the lending protocol Aave announced that the V3.8 version, developed by Aave Labs and approved by Aave DAO, has officially launched in 15 Aave V3 markets, introducing kernel-level reentrancy protection for external callbacks of the funding pools.

According to DeFiLlama data, as of November 12, Aave's total locked value (TVL) exceeds $16.4 billion, with the V3 active market carrying over $15.23 billion. According to the official announcement from Aave, the upgrade covers active instances across 15 public chains.

Governance proposal implemented in twenty-two days, precisely targeting active pools

Tracing back the governance process, Aave Labs released the Aave V3.8 governance forum proposal on October 21 and submitted a Snapshot vote on October 27. On November 9, the community initiated the AIP #541 on-chain governance vote, which took 22 days to deploy and go live.

V3.8 adopts a restrained deployment strategy, covering active instances on Ethereum (Core and Lido), Plasma, Avalanche, BNB Chain, Monad, Base, and Arbitrum.

This synchronization covers Mantle, X Layer, Polygon, Linea, Optimism, Gnosis, MegaETH, and Celo markets while explicitly skipping any frozen markets with zero caps.

Utilizing EIP-1153 instant storage, read/write reduced to 100 Gas

In the contract architecture, the usual practice to prevent cross-function reentrancy is to write lock identifiers before the core state changes. However, after the implementation of EIP-3529, the refund cap for SSTORE state zeroing was reduced to 20%, causing high Gas consumption for maintaining persistent locks in high-frequency lending pools.

To address this, Aave V3.8 adopts the EIP-1153 instant storage specification. TSTORE and TLOAD only consume 100 Gas per read/write and are automatically zeroed at the end of the transaction, achieving reentrancy protection for the funding pool with minimal overhead.

Asymmetric locks accommodate flash loan liquidation and reentrancy boundary

Before launch, some developers worried that the reentrancy lock might block the liquidation combinations within the flash loan callbacks. Aave Labs disclosed that the flashLoan and flashLoanSimple entry points only check the lock status without applying locks.

This asymmetric design achieves bidirectional isolation: when initiating a flash loan, liquidation, deposits, or repayments can still be executed within the callback; however, if the outer layer is in the midst of a regular funding pool operation callback, requests to initiate another flash loan will be intercepted and rolled back directly.

Multi-party audits and open-source delivery, highlighting read-only interface boundaries

In terms of security verification, V3.8 completed Certora's formal verification and independent external security team's audit before submitting the AIP vote, and the new contract code has been released under the Business Source License (BSL) at the official Aave V3 code repository.

Community developers also remind downstream integrators that when external protocols read funding pool view functions (such as account health factors or reserve data) during a callback, they must pay attention to the boundary conditions of the underlying ledger being in an intermediate state and ensure peripheral risk control compatibility.