Aave v3

Effective control: sovereign to freezable by venue. At worst — The asset binds: USDT has an issuer with a freeze switch. The chain grades better and does not help.

The scheduled date is the outside bound. Kill criteria are monitored continuously, and any trigger reopens the memo immediately — rejections carry the longest scheduled looks because their kill criteria do the watching.

v2 SUPERSEDES v1. The v1 memo claimed Aave had never suffered a bad-debt event that impaired suppliers. That was FALSE at the time of writing and the error is recorded here rather than edited away. On 2026-04-18 an attacker forged a LayerZero cross-chain message and minted ~116,500 unbacked rsETH (~$293M, ~18% of supply), deposited 89,567 of it into Aave as collateral, and borrowed ~$190M of ETH across Ethereum and Arbitrum — repeating it on v4. Aave was left with ~$196M of bad debt concentrated in the rsETH/WETH pair, in a range reported between $123M and $230M. Largest DeFi exploit of 2026. The distinction that keeps this approved: THE AAVE CONTRACTS DID NOT FAIL. They behaved exactly as written. What failed was risk governance — in January 2026 Aave governance enabled e-mode for rsETH at 93% LTV, explicitly motivated by competitiveness and a target of $1B in new rsETH inflows. The protocol accepted a bridged liquid-restaking token as high-LTV collateral without assessing the bridge. That is a governance-chasing-TVL failure, and it is the failure mode we must now watch for, because unlike a code bug it cannot be audited away. The response was genuinely strong and is why this stays approved: rsETH frozen and LTV cut to zero within hours, >95% of unbacked rsETH recovered, a DeFi United coalition covering the shortfall, and a May 2026 overhaul of listing standards to assess cybersecurity, interoperability and technical architecture rather than price volatility alone — including wrap-depth ineligibility limits. Net: still the most battle-tested lending venue, now with a demonstrated ability to take a $200M hit and respond well. But downgraded from approved to approved-with-limits, sleeve cap cut 40% -> 30%, and review cycle shortened. Preferred asset remains GHO/sGHO over USDC: same contract risk, and the sleeve stops depending on Circle not freezing the client.

Kill criteria — events that revoke this verdict
• A SECOND bad-debt event above $50M within 24 months of 2026-04-18
• Any new collateral listing at LTV above 80% for a bridged or multi-wrap asset
• Governance publicly justifies a risk parameter by growth or competitiveness targets
• The post-rsETH listing framework is weakened or its wrap-depth limits removed
• Governance reduces timelock below 24h or hands emergency powers to a new multisig
• Utilisation sustained above 95% for 72h on a market we hold (exit risk)
• Any successful exploit of a v3 CORE contract (as distinct from a listed asset)

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on — the weakest layer governs, and the venue table names which one binds.