Aave V3.8 is now live across 15 Aave V3 markets, following approval of the upgrade by the Aave DAO this week. Developed by Aave Labs, the release adds new layers of protection to the decentralized lending protocol, in line with industry best practices and Aave DAO security standards. The rollout was announced on November 11, 2026, via Aave's official X account.

The upgrade is focused squarely on security. Its central feature is a reentrancy guard on Pool operations during external callbacks, and the release is described as measured and non-invasive, introducing only minor changes to the existing system.

Reentrancy Guard Built on Transient Storage

The V3.8 upgrade introduces a guard based on transient storage, known as EIP-1153 — an Ethereum standard activated with the network's Cancun upgrade in 2024 — which provides storage that persists only for the duration of a single transaction. Reentrancy itself is one of the oldest vulnerability classes in smart contracts, dating back to the 2016 DAO exploit: an external contract, invoked during an operation, calls back into the Pool before that operation finishes. The guard is designed to protect the consistency of Pool accounting, and it also applies when a single transaction interacts with the Pool more than once. In practice, the protection covers Pool operations throughout external callbacks.

According to the proposal, the changes are minor but worth applying in order to "make the system more robust and resilient going forward." The guard aligns the pools with industry best practice and protects them against reentrancy exploits, which the proposal characterizes as theoretical. Securing Aave V3 remains a top priority for the team.

Gas costs were historically a concern for guards of this type, since conventional reentrancy protections have required writing to permanent storage on every lock and unlock. Recent developments such as transient storage, however, allow the protocol to be strengthened with little downside in efficiency, meaning the guard can now be applied with little overhead.

The Aave DAO approved the proposal before deployment began, and further defense-in-depth improvements may be proposed in future upgrades.

In its announcement on X, Aave said the release "adds new layers of protection to Aave V3":

Aave V3.8 is now live across 15 Aave V3 markets, following approval by the Aave DAO. Developed by Aave Labs, the release adds new layers of protection to Aave V3, in line with industry best practices and Aave DAO security standards. pic.twitter.com/HVkIEqgazP

— Aave (@aave) November 11, 2026

Deployment Rollout and Licensing Details

In total, the rollout spans 15 markets across a broad multichain footprint. The upgrade targets Aave V3 instances on Ethereum, covering both the Core and Lido deployments, and also covers Plasma, Avalanche, BNB Chain, Monad, Base, and Arbitrum. Mantle, X Layer, Polygon, Linea, and Optimism are included as well, while Gnosis, MegaETH, and Celo complete the list of targeted networks.

Only active instances are in scope, the proposal notes. Deployments with all assets frozen and caps set to zero are excluded; inactive instances therefore remain unchanged.

On licensing, Aave V3.8 will be published as its own version of the Licensed Work under a Business Source License — a source-available license that keeps code publicly viewable while restricting certain uses until the Change Date — with the license text included in the V3.8 repository. Aave Governance sets the Change Date, which is recorded at v38.aavelicense.eth, and until Governance sets a date, V3.8 stays under the Business Source License. The V3.8 intellectual property will later move to the Aave Foundation through a separate governance proposal.

Before the AIP — short for Aave Improvement Proposal, the format through which protocol changes are put to Aave governance — V3.8 will go through audits by Certora and third parties, and additional security reviews are also being planned.

This article is based on the original report published on Blockonomi.