Aave Labs’ proposed V3.8 upgrade would leave two flash-loan functions outside a new Pool guard, allowing their callbacks to call Pool functions such as liquidations while the security design remains under community review.
Aave Labs said in a clarification dated Oct. 23 that the guard would not cover flashLoan() or flashLoanSimple(). A callback is code in the receiving contract that runs after liquidity arrives and before the transaction closes. Under the proposal, that code could make additional calls to the Aave Pool during the same transaction, including a liquidation.
Flash borrowing makes Pool funds available to a contract for a single transaction. An integration handling a liquidation can use the liquidity to repay debt that qualifies for liquidation, then receive the borrower’s collateral at a discount. That collateral can help fund repayment of the flash loan. With flashLoanSimple(), the receiver must return the principal and a fee before the transaction completes; otherwise, the transaction reverts.
Ethereum transient storage, which the guard would use, is cleared when a transaction ends. Aave Labs says the proposed guard is designed to keep Pool accounting sound when a transaction makes repeated calls to the Pool. The proposed scope leaves the flash-loan functions outside that protection, keeping existing tools and integrations able to use Pool calls from their callbacks. An earlier Aave Labs proposal set out the broader transient-storage security change.
The upgrade remains in community review. Aave Labs outlined a conditional path: positive community feedback would trigger a Snapshot vote, after which Certora and other third parties would audit the proposal. The team would submit a formal Aave Improvement Proposal after those reviews.
