Moderate-low risk — Aave V4 brings genuine architectural innovation with hub-and-spoke lending and Position Manager gateways, but both introduce unproven failure modes at scale. The protocol is battle-untested at $38M TVL with a 2-month track record, inherits V3's oracle vulnerabilities, and launches under weakened governance. Grade B- reflects strong Aave ecosystem pedigree offset by architectural immaturity and inherited risks.
Risk Breakdown
Top Risks
Hub-and-spoke architecture introduces a new failure mode: if the shared Liquidity Hub contract is exploited, all connected Spokes (Core, Prime, Plus) lose access to liquidity simultaneously — a single-contract blast radius that Aave V3's isolated pool design did not have. No Hub exploit has occurred in V4's ~2 months of live operation, but the architecture is battle-untested at scale.
Inherits Aave's CAPO (Chainlink Adaptive Price Oracle) adaptive layer, which misfired on March 10, 2026 in V3, causing $27M in wrongful liquidations across 34 accounts. CAPO desynchronization risk is a known failure mode that V4 carries into its own oracle stack without a documented fix.
Governance fragmentation risk: Aave Chan Initiative (responsible for 61% of DAO governance actions) and BGD Labs both departed in early 2026 following disputed budget votes. V4 inherits this governance thinning at a critical early phase when parameter decisions for new hubs carry outsized impact.
Frequently Asked Questions
Is Aave V4 safe to use?
What are the main risks of using Aave V4?
What is Aave V4's risk score breakdown?
How does Aave V4 compare to other Lending protocols?
Has Aave V4 ever been hacked or exploited?
Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.