Aave V3.8 was deployed to active Aave V3 markets across 15 chains following Aave DAO approval, according to a November 12, 2026, report by 深潮 TechFlow. Developed by Aave Labs, the release adds a core-level reentrancy guard for callbacks from pool operations. The design question is where to block a callback from re-entering the pool without breaking flash-loan compositions.
Aave Labs posted its governance-forum proposal on October 21 and submitted it to Snapshot on October 27. On-chain voting for AIP #541 began November 9. The report describes a 22-day path from proposal to deployment. The rollout covered active instances on Ethereum (Core and Lido), Plasma, Avalanche, BNB Chain, Monad, Base, Arbitrum, Mantle, X Layer, Polygon, Linea, Optimism, Gnosis, MegaETH and Celo. Frozen legacy markets with limits set to zero were excluded.
The lock mechanism. A conventional persistent-storage lock carries a gas cost for a frequently used lending pool; the report notes that EIP-3529 reduced the refund cap for clearing storage to 20%. V3.8 instead uses EIP-1153 transient storage. Its TSTORE and TLOAD operations cost 100 gas each, according to the report, and transient storage clears at the end of the transaction.
The flash-loan boundary. Aave Labs said the flashLoan and flashLoanSimple entry points check the lock but do not set it. A flash loan initiated first can therefore still use its callback to combine a liquidation, deposit or repayment. In the opposite direction, an attempt to start a flash loan during the callback of a regular pool operation is blocked and reverted. The protection is deliberately asymmetric, not a ban on all callback activity.
The report says V3.8 underwent Certora formal verification and an audit by an independent external security team before the AIP vote; the contracts were published in Aave’s official V3 repository under the Business Source License (BSL). Those checks do not remove every integration concern: community developers cautioned that view functions, including account health-factor and reserve-data reads, may be called while the underlying ledger is in an intermediate state during a callback.
For scale, DeFiLlama data cited in the report put Aave’s total value locked above $16.4 billion as of November 12, 2026, with more than $15.23 billion in active V3 markets. Those figures describe the reported deployment context, not a measured security outcome.
Source: techflowpost.com (originally published 2026-11-12 11:22 UTC+8)
