Aave

Simple Summary

This proposal upgrades the Aave v3 instances on Ethereum, Polygon, Optimism and Arbitrum to the v3.0.2 version. The v3.0.2 is an upgrade based on the v3.0.1 version already running on the new Aave v3 Ethereum pool which comes with improvements to the handling of isolation mode, LTV0, and flashBorrower initiated flashloans. If this proposal succeeds, it will also authorize the upgrade of the V3 pools on Avalanche and Fantom via a delegatecall by the Aave Guardian.

The upgrades to be performed will affect the following contracts:

1. Pool
2. PoolConfigurator
3. aToken/variableDebtToken/stableDebtToken

And replace the AaveProtocolDataProvider on the PoolAddressesProvider with it’s next iteration.

Motivation

Aave v3 Ethereum has been activated via Aave governance at the end of January. But in reality, as described HERE, the smart contracts on Ethereum are a slightly improved version of v3, the so-called v3.0.1.

In an ecosystem like Aave, with liquidity pool instances spread across multiple networks, it is fundamental to try to keep version consistency, which is not the case at moment, with Polygon, Avalanche, Optimism, Arbitrum, Fantom, and Harmony running still on v3.0.0. Therefore this proposal aligns all pools at v3.0.2.

Specification

Upon execution on the respective network the proposal will:

• call POOL_ADDRESSES_PROVIDER.setPoolImpl(NEW_POOL_IMPL) to replace the Pool implementation (all networks)
• call POOL_ADDRESSES_PROVIDER.setPoolConfiguratorImpl(NEW_POOL_CONFIGURATOR_IMPL) to replace the PoolConfigurator implementation (all networks, excluding mainnet)
• call POOL_ADDRESSES_PROVIDER.setPoolDataProvider(NEW_PROTOCOL_DATA_PROVIDER) to replace the AaveProtocolDataProvider (all networks, excluding mainnet)
• iterate through all currently listed tokens on the pool (fetched via POOL.getReservesList()) (all networks, excluding mainnet)
  • call POOL_CONFIGURATOR.updateAToken(inputAToken) to replace the aToken implementation
  • call POOL_CONFIGURATOR.updateVariableDebtToken(inputVToken) to replace the vToken implementation
  • call POOL_CONFIGURATOR.updateStableDebtToken(inputSToken) to replace the sToken implementation
  • call POOL_CONFIGURATOR.setReserveFlashLoaning(reserve, true) to enable flashloaning on the reserve
• call ACL_MANAGER.grantRole(ISOLATED_COLLATERAL_SUPPLIER_ROLE, SWAP_COLLATERAL_ADAPTER) to maintain pre-upgrade behavior (all networks, excluding harmony)
• call ACL_MANAGER.grantRole(ISOLATED_COLLATERAL_SUPPLIER_ROLE, MIGRATION_HELPER) to maintain pre-upgrade behavior (mainnet, avalanche, polygon)

Security and additional considerations

We applied the following security procedures for this upgrade:

• Code diffing: Comparing the codebase of all v3.0.0 with the one of v3.0.1, more specifically the one on Aave v3 Ethereum, to not have any unexpected logic included.
• Storage diffing: Comparing the storage layout of both versions, to verify that there is no misalignment between them, which could create important problems.
• Assets configurations pre/post upgrade: In a simulation environment, validating the configurations of the assets pre-upgrade are the same as post-upgrade, only with those changes that are intended (e.g. enabling the new flashloanable flag only present on v3.0.1, later explained).
• Additional E2E tests: Also in a simulation environment, checking that the main actions available on the pool can be performed (e.g. supply, borrow) on all pools with non-frozen assets.
• Extra review: Given their involvement in the development of Aave v3, we have requested AaveCompanies to take a look at the procedure, in order to have multiple parties validating it.
• Audit: Certora and SigmaPrime reviewed the v3.0.1 -> v3.0.2 changes

The decision to enable flashloanable for all the assets has been taken in order to have the highest possible consistency with the current state of the assets in the pools: currently, all are flashloanable, so by enabling the new flag, they will continue to be so.

References

• Repository
• Storage/code diffs
• sigma prime 3.0.1 audit report
• PeckShield 3.0.1 audit report
• Cerora 3.0.2 audit report
• sigma prime 3.0.2 audit report
• Forum discussion
• Payload:Mainnet
• Payload:Polygon
• Payload:Arbitrum
• Payload:Optimism
• Payload:Avalanche
• Payload:Fantom
• Update diffs
• BorrowLogic: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• BridgeLogic: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• ConfiguratorLogic: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• EModeLogic: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• FlashLoanLogic: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• LiquidationLogic: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• PoolLogic: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• SupplyLogic: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• PoolImpl: Mainnet, Polygon, Arbitrum, Optimism, Avalanche, Fantom
• PoolConfiguratorImpl: Polygon, Arbitrum, Optimism, Avalanche, Fantom
• ATokenImpl: Polygon, Arbitrum, Optimism, Avalanche, Fantom
• STokenImpl: Polygon, Arbitrum, Optimism, Avalanche, Fantom
• VTokenImpl: Polygon, Arbitrum, Optimism, Avalanche, Fantom
• AaveProtocolDataProvider: Polygon, Arbitrum, Optimism, Avalanche, Fantom

Copyright

Copyright and related rights waived via CC0.