Aave V3.8 Leaves 2 Flash Loan Routes Unguarded. Here's Why Liquidators Care

Can you still liquidate an underwater Aave position with a flash loan once V3.8 ships? Yes. That's the answer Aave Labs gave on October 23.

But the fact that anyone had to ask is the actual story.

The Raw Data: 2 Exemptions, 1 Guard, 100 Gas

Here's what's on the table. Aave's V3.8 proposal went up on governance October 21. It adds a reentrancy guard to Pool operations, and a reentrancy guard does exactly one thing: it stops an external callback from re-entering a protected function before the first call finishes.

Aave Labs then clarified on October 23 thatflashLoanandflashLoanSimplesit outside that guard. Callbacks triggered by those functions can still call back into the Pool. Including for liquidations.

Two functions. That's the whole carve-out. And the carve-out matters because a liquidation integration might borrow an asset through a flash loan, repay an unhealthy position, and finish its transaction, all before the Pool ever checks settlement. Wall off every route back in and you don't harden the protocol. You break the machinery that keeps it solvent.

The implementation uses transient storage, shipped to Ethereum through EIP-1153. That's the same upgrade that arrived with Dencun in March 2024. Transient storage lives and dies with the transaction, which makes it a natural fit for carrying a temporary lock flag. The cost angle is real too. Writing temporary state to permanent storage runs 20,000 gas on a cold write. Transient storage costs 100. On a Pool that gets hammered every block, that gap isn't a rounding error. It's the difference between a guard that pays for itself and one that taxes every user to protect a handful.

What's still missing: feedback, a Snapshot vote, security review from Certora and other reviewers, then the on-chain improvement proposal. Nothing here's live. Nothing here's audited yet.

Why the Order of Operations Is the Whole Ballgame

Aave's developer docs lay out the sequence plainly. The Pool sends assets out. It calls the receiver contract. Then it checks settlement conditions. If the math doesn't check out, the transaction reverts.

For a simple flash loan, the receiver has to return the borrowed amount plus the fee. For the broader interface, things get spicier. Multiple assets, and under permitted conditions, an actual collateral-backed debt position.

So picture a keeper trying to clear a position that's drifted below its health factor. It flash-borrows, it repays the debt, it grabs the collateral at a discount, it returns the loan plus fee. All of that happens inside one transaction, with multiple trips back into the Pool, and some of those trips occur after assets have already left but before repayment gets verified.

Guard all of that indiscriminately and the liquidation reverts. Bad debt piles up. Suppliers eat the loss. The security feature becomes the exploit.

CT never misses. Except when it does. And the loudest take on the timeline for the last week has been some version of "Aave is killing flash loans," which was never accurate and is now officially wrong.

There's history here worth remembering. Reentrancy is the original DeFi sin, going back to 2016 and the DAO. Every serious lending protocol has had to draw this exact line, and drawing it badly has cost people nine figures more than once. The reflex to bolt guards onto everything is understandable. The discipline to carve out the intentional paths is the harder part.

What Integrators Are Actually Saying

According to the proposal's own framing, the design question isn't whether to lock things down. It's which routes back into the protocol are intentional. That's a security boundary drawn by design intent, not by blanket prohibition.

Traders are watching the same thing they always watch: whether the deployed bytecode matches the stated intent. A design clarification is a nice document. A Solidity diff is a fact.

Here's my take, and I'll say it plainly. This clarification should've shipped in the same post as the proposal. Dropping a reentrancy guard on the largest lending market in DeFi and letting integrators infer the flash loan implications for two days isn't how you communicate with people who run bots against your contracts. The answer was correct. The sequencing was sloppy. Another day, another saga.

Second take: transient storage is the most underrated part of this entire thing. EIP-1153 landed in March 2024 and protocols have been slow to internalize what it means for guard patterns. Cheaper locks mean you can afford to be more granular. Granular guards mean fewer broken integrations. This is the content we signed up for, honestly. Gas accounting dressed up as security engineering.

What's Next: 4 Checkpoints

First, the Snapshot vote. That's the temperature check, and it's where the actual political weight gets revealed. Watch whether the flash loan carve-out draws delegate objections or passes quietly.

Second, the Certora review. Certora does formal verification, not vibes. If the guard spec has a hole in how it handles re-entry through excluded entry points, that's where it surfaces. Any published report is the real signal here.

Third, the deployed code on Ethereum and every affected network. Fork test your liquidation bot against the reviewed implementation before the AIP executes, not after. The clarification gives integrators a concrete compatibility point. Use it.

Fourth, and this is the one nobody's pricing, whether the carve-out becomes a template. If Aave ships V3.8 with two excluded entry points and the sky doesn't fall, expect every other lending market to copy the pattern within a quarter. That's how standards get made in this industry. Somebody ships, nothing explodes, everyone forks the approach.

The guard is coming. Liquidations survive it. What remains to be proven is that the implementation Aave's governance eventually accepts enforces the boundary it promised while preserving the transaction sequences its integrators depend on.

Until the bytecode is on-chain and verified, every claim about V3.8 is a statement of intent. And in this industry, intent has a pretty rough track record.