Breaking Aave Upgradeability

Summary: Trail of Bits reviewed Aave's version 2 codebase the day after its December 3rd deployment and found a vulnerability affecting versions 1 and 2 of the live contracts, which Aave mitigated within an hour of the report. The flaw let anyone call initialize directly on the LendingPool logic contract, set a controlled addresses provider, and execute arbitrary code including selfdestruct, and because OpenZeppelin's proxy returns success on a delegatecall to a contract without code, third-party contracts calling the pool would have acted as if code executed when it did not.
Key Takeaway: Five security firms reviewed the Aave codebase, some using formal verification, and none caught this bug - while Slither flags it in seconds, a gap that matters because the blast radius extended to external DeFi contracts whose logic would silently break.

Read the original at Trail of Bits Blog ↗