Aave v4: A Design Framework for Pooled and Isolated Bluechip Collateral Markets

[ChaosLabs]

Overview

The objective of this analysis is to establish a structured foundation for governance discussions on how bluechip collateral should be configured in Aave v4, and to clearly articulate the trade offs, benefits, and risk implications associated with each design approach.

By combining hubs, spokes, and allocation mechanisms Aave v4 lets us approach a fresh design space, where we aim to both maximize capital efficiency and strictly reduce liquidity and rehypothecation risk for users or entities with specific requirements. This is achieved through the use of fully isolated markets, where collateral is never rehypothecated, and as such, liquidity risk is fully mitigated in the context of both withdrawals and liquidations.

This analysis examines how these architectural choices can be applied to bluechip collateral.
In this context, bluechip collateral refers specifically to WETH, WBTC and cbBTC. We outline multiple potential bluechip market designs ranging from the traditional pooled model to fully isolated collateral environments. Each design serves a different borrower and lender risk profile and presents a distinct combination of borrowing power, liquidity considerations, counterparty exposure and risk parameter flexibility.

What this analysis is NOT intended to cover

This document does not evaluate or make recommendations regarding which assets should be listed on Aave v4. It also does not provide guidance on risk parameterization for wide range of assets. Finally, this analysis does not examine how hubs and spokes should be configured for non bluechip collateral. The scope is purposefully limited to the design space for WETH, WBTC, and cbBTC within Aave v4, in order to start a focused technical discussion before extending the framework to a broader set of assets.

Market Designs for Bluechip Collateral

This section presents the full range of market design choices available for bluechip collateral. We outline each configuration individually and describe its native implementation under the Aave v4 infrastructure. Furthermore, we cover each configuration’s strengths and weaknesses, focusing on borrowing power, liquidity considerations, counterparty exposure, and parameter flexibility. After examining the designs one by one, we consolidate their features into a comparative analysis table to provide a clear assessment. The section concludes with our recommended structure for bluechip assets, which aims to serve a broad spectrum of borrowers and lenders with different risk preferences while maintaining a unified liquidity environment and avoiding unnecessary fragmentation.

1- Pooled Core Spoke

The pooled Core Spoke represents the most general and widely accessible configuration within the hub and spoke framework. In this building block configuration, a broad set of collateral assets is combined into a single pooled environment that closely mirrors the structure of the current Aave v3 Core market. The shared collateral base enables cross collateralization across many asset types, which in turn necessitates the use of the most conservative risk parameters within the v4 design space.

In this model, deposited assets are rehypothecated to generate yield based on borrower demand. Bluechip assets such as WETH, WBTC, and cbBTC are listed alongside other collateral assets, providing a familiar user experience and a risk profile that is consistent with the pooled model used today. This structure also benefits from direct access to the deepest stablecoin reserves in the protocol, which supports interest rate stability and ensures efficient borrowing conditions for users.

2- Bluechip Stablecoin Spoke with Cross Margin

The bluechip stablecoin spoke is a dedicated configuration that allows WETH, WBTC, and cbBTC to be used as collateral to borrow stablecoins while retaining cross collateral functionality within the spoke. This structure creates a focused environment for pristine assets.

The spoke continues to benefit from the deep stablecoin liquidity of the core hub, which supports rate stability and efficient borrowing conditions. Conceptually, it resembles the E Mode configuration in Aave v3, but with additional precision. As covered in our analysis Aave v4: New Features and Risk Parameter Analysis, v4 introduces several spoke level parameters regarding how liquidation should work, including targetHealthFactor, liquidationBonusFactor, and healthFactorForMaxBonus. These can be tuned specifically for bluechip assets to offer a more protective liquidation environment for borrowers, reflecting their lower risk profile.

Collateral within this spoke remains rehypothecated, enabling borrowers to earn a yield on their collateral. While bluechip assets can receive more favourable parameterization than in the general pooled environment, cross collateralization remains an important constraint. The volatility or utilization spike of one asset within the spoke affects the risk profile of the others during stress scenarios, which limits how aggressive the parameter settings can be. This interdependence prevents the collateral assets from reaching the more competitive risk settings achievable in segmented configurations that which we discuss in the following section.

3- Bluechip Stablecoin Spokes

Bluechip stablecoin spokes represent a more segmented configuration in which each pristine collateral asset is placed into its own dedicated spoke. Unlike the cross-margin design discussed earlier, this structure does not allow WETH, WBTC, and cbBTC to serve as collateral for one another. Each asset operates within an independent environment that maintains a clear separation of risk between collateral types.

This configuration enables spoke-level liquidation parameters to be tailored to the specific characteristics of each individual blue-chip asset. Parameters can therefore be optimized in a more focused manner than in a cross-collateralized structure, where inter-asset volatility places limits on parameter flexibility.

Collateral within these spokes continues to be rehypothecated, allowing borrowers to earn yield on their collateral based on utilization. Borrowers retain access to the deep stablecoin liquidity of the core hub, and the design does not introduce any liquidity fragmentation.

The removal of cross-collateralization allows these spokes to support higher borrowing power compared to a shared blue-chip spoke. By separating the collateral assets from one another, the design reduces correlated risk transmission and enables more competitive parameterization.

4- Isolated Bluechip Stablecoin Spoke with Cross Margin

The isolated setups introduce a separate hub and spoke structure dedicated solely to bluechip collateral, while still allowing cross collateralization between WETH, WBTC, and cbBTC. In this configuration, bluechip assets are not borrowable and their primary function within the hub is to serve as collateral for stablecoin borrowing.

A defining feature of this design is the removal of rehypothecation. Collateral is never lent out within the isolated hub, which ensures that borrowers retain full and immediate access to their collateral at all times. As a result, borrowers are not exposed to liquidity risk during periods of elevated utilization. Furthermore, the borrowers do not underwrite the obligations of other borrowers, since the setup prevents collateral from being serviced to separate borrowing positions as debt. This eliminates solvency and default risk stemming from the behavior or risk profile of other borrowers.

The absence of collateral utilization also strengthens the protocol’s risk posture. Because the collateral is never deployed into lending activity, the hub maintains complete liquidity for liquidations under stress scenarios. This removes the risk of liquidations being halted due to limited available liquidity and ensures that the protocol can always execute liquidations when required. As a result, the structure supports meaningfully more competitive risk parameters, reflecting the reduced systemic risk within a fully isolated environment.

This configuration is particularly well suited for borrowers who do not want their collateral to be rehypothecated and who value guaranteed availability of their deposited assets at all times. It is also an attractive environment for stablecoin suppliers who prefer to underwrite only pristine collateral and avoid exposure to a broader mix of assets.

The seperate hub does introduce liquidity fragmentation, given that the isolated hub does not have direct access to the deep stablecoin liquidity of the Core Hub. This can be addressed by establishing credit lines from the Core Hub and/or through the reinvestment controller, which allows idle stable liquidity from the Core to be allocated to the Isolated Hub when needed. Both approaches come with trade offs and operational considerations that require separate and detailed analysis beyond the scope of this work.

5- Isolated Bluechip Stablecoin Spokes

The isolated bluechip stablecoin spokes represent a configuration that closely resembles the cross margin version described in the previous section, with one key distinction. Instead of placing WETH, WBTC, and cbBTC together within a single isolated spoke, this design creates a separate spoke for each bluechip asset within the Isolated Hub. Each collateral type therefore operates fully independently while still benefiting from the isolated environment where no rehypothecation occurs.

This structure offers additional granularity in how spoke level liquidation parameters can be calibrated. However, the incremental benefit of this additional separation is relatively limited. Since collateral is never utilized in the isolated hub and full liquidity for liquidations is always available. As a result, while this design increases parameter flexibility, the practical improvement over a unified isolated bluechip spoke is marginal.

6- Isolated Bluechip Stablecoin Hubs

The isolated bluechip stablecoin hubs represent the most segmented configuration within the design space. In this structure, each collateral asset such as WETH and WBTC or cbBTC is placed not only into its own spoke but also into its own dedicated hub. This results in completely independent markets for each bluechip asset, where collateral is never rehypothecated and borrowers can only borrow stablecoins against a single type of pristine collateral.

While this approach preserves all the advantages of isolation, it materially increases liquidity fragmentation. Each hub must maintain its own supply of stable liquidity, and the absence of shared liquidity pools reduces the depth available to borrowers. Managing liquidity across multiple isolated hubs also requires more complex routing or credit line frameworks.

The incremental value of this design is limited. Its primary benefit is that it caters to stablecoin suppliers who may prefer to underwrite debt exclusively against a specific pristine collateral. However, onchain evidence from other isolated lending protocols suggests that suppliers rarely distinguish between bluechip assets to this degree, which reduces the practical demand for fully separated hubs.

One potential advantage of this configuration is the ability to implement distinct interest rate models for each collateral asset. This may offer some value where collateral specific dynamics or borrower demand patterns justify bespoke rate shaping. Nevertheless, this benefit must be weighed against the considerable fragmentation and operational overhead introduced by maintaining multiple isolated hubs.

Comparative Analysis of the Designs

The table below summarizes the key trade offs across the bluechip market designs by comparing borrowing power, borrowing scope, collateral treatment, liquidity characteristics, and parameter flexibility. Moving from the pooled Core Spoke toward increasingly isolated configurations, borrowing power and parameter flexibility rise as rehypothecation and cross asset dependencies are removed. This progression comes at the cost of reduced composability and, in some cases, increased liquidity fragmentation.

Taken together, the table illustrates that no single design dominates across all dimensions. Instead, the optimal configuration emerges from combining multiple designs to balance capital efficiency, risk isolation, and liquidity fragmentation, allowing Aave to serve diverse borrower and supplier preferences within a coherent market structure.

All values in the table are relative and intended to compare designs against each other rather than define absolute thresholds

Design	Borrow Power	Borrowing Scope	Rehypothecation Status	Liquidity Risk	Liquidation Liquidity Assurance	Liquidity Fragmentation	Parameter Flexibility
1- Pooled Core Spoke	Low	Stablecoins and volatile assets	Enabled	High	Medium	None	Low
2- Bluechip Stablecoin Spoke with Cross Margin	Medium	Stablecoins only	Enabled	High	Medium	None	Medium
3- Bluechip Stablecoin Spokes	High	Stablecoins only	Enabled	High	Medium	None	High
4- Isolated Bluechip Stablecoin Spoke with Cross Margin	Very High	Stablecoins only	Disabled	None	Very High	Medium	Medium
5- Isolated Bluechip Stablecoin Spokes	Very High	Stablecoins only	Disabled	None	Very High	Medium	High
6- Isolated Bluechip Stablecoin Hubs	Very High	Stablecoins only	Disabled	None	Very High	High	Very High

Recommended Path for Bluechip Assets

The objective of the recommended configuration is to serve a wide range of borrowers and stablecoin suppliers with different risk appetites, while avoiding unnecessary liquidity fragmentation and preserving the efficiency of the broader Aave v4 market. Rather than selecting a single design, we propose a layered structure that leverages multiple configurations in parallel, each serving a distinct user profile.

First, we recommend maintaining a pooled Core Spoke within the Core Hub, configured with conservative parameters. This spoke serves as the foundational building block of the market and closely mirrors the user experience and risk profile of the Aave v3 Core market. It enables broad cross collateralization, supports borrowing of both stablecoins and volatile assets, and provides direct access to the deepest liquidity pools in the protocol.

Second, within the Core Hub, we recommend introducing segmented Bluechip Stablecoin Spokes for each pristine collateral asset. Given the high utilization and systemic importance of assets such as WETH, separating bluechip collateral into dedicated spokes allows for improved parameterization. These spokes preserve access to Core Hub liquidity, avoid fragmentation, and enable higher borrowing power than the pooled Core Spoke.

Third, we recommend deploying an Isolated Bluechip Hub with a unified Bluechip Spoke that supports cross collateralization between WETH, WBTC, and cbBTC. In this isolated environment, collateral is not rehypothecated because bluechip assets are not borrowable. This configuration provides an alternative borrowing path for users who prioritize collateral availability, elimination of liquidity risk, and avoidance of underwriting other borrowers. The isolated hub can be bootstrapped through reinvestment allocations from the Core Hub and supported by credit lines that allow it to tap into core stablecoin liquidity when required.

Taken together, this structure offers borrowers three distinct risk and capital efficiency profiles.

By using the pooled Core Spoke, borrowers access a fully pooled borrowing experience similar to Aave v3, with the ability to borrow both stable and volatile assets against a broad set of collateral in conjunction with bluechip collateral, but with lower borrowing power.

By using the Bluechip Spokes within the Core Hub, borrowers give up the ability to borrow volatile assets and to use cross collateralization, but achieve higher borrowing power than in the pooled Core Spoke, without sacrificing access to the deep and stable liquidity of the Core Hub.

By choosing the Isolated Bluechip Spoke, borrowers accept the trade off of foregoing collateral yield and direct access to Core Hub stablecoin liquidity in exchange for maximum borrowing power, no liquidity risk, no rehypothecation, and no exposure to the solvency of other borrowers.

This layered approach allows Aave v4 to accommodate materially different borrower and supplier preferences without excessive liquidity fragmentation or forcing a single risk profile onto all users.

Conclusion

Aave v4 significantly expands the design space available for over collateralized lending by enabling markets that range from fully pooled environments to completely isolated collateral structures. This flexibility allows the protocol to serve a broader and more nuanced set of borrower and supplier preferences.

Through the analysis of bluechip market designs, this paper demonstrates that combining multiple configurations is the optimal approach to serving the full spectrum of user needs. Pooled markets maximize liquidity efficiency and composability, while isolated markets materially reduce liquidity and counterparty risk and enable more competitive parameterization. The key challenge is therefore not choosing between pooled and isolated designs, but combining them in a coherent manner that avoids unnecessary fragmentation.

By focusing on pristine assets such as WETH, WBTC, and cbBTC, this analysis establishes a structured foundation for future governance discussions on the configuration of Aave v4.

Disclaimer

Chaos Labs has not been compensated by any third party for publishing this recommendation.

Copyright

Copyright and related rights waived via CC0

[JosueMpia]

@ChaosLabs

By focusing on pristine assets such as WETH, WBTC, and cbBTC, this analysis establishes a structured foundation for future governance discussions on the configuration of Aave v4.

Just by reading this, great work team. This is a very strong and well thought out framework.

As I kept reading though, Two thoughts stood out to me. From a user perspective, especially in v4, most users are not trying to reason about pooled versus isolated, cross margin, or independent spokes. They really just want to answer a single question: what type of risk profile do I want today? Or simply, let me look at my conservative, balanced, or aggressive portfolio.

1. The proposal already defines these configurations very clearly at an architectural level. What feels missing is a simple product level abstraction that maps directly onto the models you describe. For example, a conservative user would naturally align with the isolated bluechip hub or spoke designs in this proposal, where rehypothecation is turned off and collateral safety is prioritized. A balanced user would align with bluechip spokes within the core hub, benefiting from shared liquidity but with more tailored risk parameters. An aggressive user would align with the pooled core spoke configuration, maximizing capital efficiency and borrowing power while accepting systemic exposure.
2. A related concern is operational complexity. More configurations mean more parameters to tune and monitor for both service providers and users. At scale, this can also lead to thinner liquidity and increased governance overhead, especially if we end up with dozens of hubs and dozens of spokes per chain. Without a clear abstraction layer, this risks creating frequent governance proposals and fragmented liquidity that are difficult to manage efficiently.

To be clear, I like this design framework. The ability for Aave to offer better risk containment while still supporting segmented but shared liquidity is a major step forward. More importantly, the fact that Aave does not need to commit to a single model and can trial multiple configurations over time is a real strength.

A simple risk class abstraction could help translate that flexibility into a clearer user experience and a more manageable operational surface, building on the solid foundation this proposal already establishes.

[simo]

I spent some time going through your analysis and I think it’s very solid from a risk design point of view.

What I’d like to add here is a slightly different angle, starting more from how people actually use DeFi lending today, rather than from architecture first.

From what we see in practice, usage tends to concentrate around a few recurring patterns:

1. Supply blue-chip assets
2. Supply blue-chip assets and borrow stablecoins
3. LST / LRT looping strategies
4. YBS looping strategies

One thing that comes up very often in institutional conversations is the preference for simplicity and clear boundaries. Many of them are not looking for maximum optionality, but for controlled exposure to blue-chip collateral, with as little cross-risk as possible.

That’s the lens through which I tried to read your framework.

The Core Hub, as you describe it, feels like a natural continuation of the Aave v3 Core market. It’s familiar, liquid, and flexible.

The Bluechip Stablecoin Spokes are designed to improve the experience for users who supply bluechip assets and borrow stables, by allowing better parameter tuning while still remaining within the Core liquidity environment.

That said, I’m a bit unsure about the need to introduce these bluechip spokes already in the initial setup. If we look at the dominant use cases, categories (1) and (2) are already well served by a strong Core Spoke. I would be very interested to see a more concrete analysis of how much better the parameters could realistically be, given a defined set of assets.

For users who care primarily about segregation, no rehypothecation, and predictable liquidation behavior, the Isolated Bluechip Hub seems the clearest answer. Even if liquidity there is more constrained, this setup aligns very well with what many institutional borrowers are looking for, and their demand could be managed through credit lines connected to the Core Hub.

One area that I think could be explored further is LSTs. A large share of current activity sits in category (3), and an LST-focused spoke connected to the Core Hub could be an interesting addition over time. I would be curious to hear your thoughts on this.

For category (1), supply-only blue-chip users, the configuration you describe effectively points them to the Core Spoke as the main option. This seems reasonable, since yield on assets like ETH depends on actual borrow demand for that asset, which is mainly concentrated in the Core market. The Isolated Bluechip Hub, instead, is clearly not designed as a yield venue, but as a collateral-only environment for borrowing with tighter risk control.

Overall, I find the framework very thoughtful and well researched. My only broader concern is about initial complexity. In complex systems, introducing too much configurability too early can sometimes increase the risk of errors rather than reduce it. For this reason, it might make sense to start with a leaner setup and progressively add bluechip or other spokes once the usage on v4 becomes clearer.

[shloky]

Simo raises a good point about wanting concrete analysis on parameter improvements. One dimension that might inform that: stablecoin quality isn’t homogeneous.

In the Isolated Bluechip Hub, credit lines from Core expose the isolated environment to whatever stablecoins are being supplied there. If the goal is “no rehypothecation, predictable liquidation behavior” for institutional borrowers, does it make sense to also consider spoke-level thresholds on which stablecoins can flow through those credit lines based on reserve composition, attestation recency, or peg stability?

Not proposing complexity for its own sake, just following the logic: if the isolated hub is meant to offer stricter risk containment, shouldn’t the stablecoin supply side get the same scrutiny as the collateral side?

[stani]

Hey everyone,

First of all, outstanding work by @ChaosLabs on the framework and on providing various options to compare different approaches.

From my perspective, I agree with the approach of having a pooled Core Hub with Core Spokes, which would serve as the risk-adjusted market for Aave. The Core Hub would be the main liquidity hub, holding the highest amount of capital to allocate to applicable spokes as new use cases appear. This would also result in the best UX for users, especially for borrowers, and would feel familiar to existing Aave V3 users.

I also think a separate ETH Blue Chip Spoke and a BTC Blue Chip Spoke makes sense, as it would allow for more optimized parameters for borrowing power while still accessing Core liquidity but would also like to see further analysis how much this would improve the parameters compared to the Core Spoke, and also timing whether its for launch or that can be added over time.

An Isolated Blue Chip Hub without rehypothecation improves the risk profile of this Hub, essentially making it a “low-risk DeFi hub.” Ideally, this would become the safest place to earn yield in DeFi.

My only question regarding the Isolated Hub is whether we should exceptionally allow ETH to be borrowed, perhaps through a separate spoke with a capped credit line as this would tie some growth opportunities based onchain data.

Perhaps we could discuss this in more detail during the next Aave V4 Service Providers Office Hours about the above.

I am also interested regarding @simo point on LSTs and am curious to hear Chaos Labs thoughts on that.

Another configuration parameter we should decide on, one that may be overlooked, is whether all spokes should be allowed to use the reinvestment feature or not (noting that the implementation of these strategies is still to be designed based on which strategies are suggested by SPs and community members). For the risk-adjusted Core Hub, this may make sense, but for lower-risk profiles, the scope or usage might need to be more limited.

Overall, this is a very strong approach and great work from the Chaos team, thanks for putting this forward.

[abdulwahed]

Critical Research Update: Model D Phantom Solvency — Formal Counterexample

Following the discussion on the Aave V4 architecture, I have processed the Model D (Hybrid Architecture) through the ADS-Checker framework.
The simulations identify a reachable systemic failure mode: Phantom Solvency.

Simulation Results — $96.3M Balance Sheet Divergence

Under partial and systemic stress, the protocol reaches a state where:

• Profit Centralization (68.7%)
  Deterministic yield continues to flow to the Main Hub via Senior Credit Lines.
• Loss Fragmentation (100%)
  Bad debt remains localized within Satellite Spokes and is absorbed by local stakers.

Result:
The Global Solvency Ratio remains > 1.0, while multiple spokes are provably insolvent.

This is not a monitoring artifact or accounting error.
Conservation and cross-hub accounting invariants hold — yet Solvency Equivalence (SE-1) is violated.

Phantom Yield Mechanism

The Main Hub remains solvent only by retaining interest derived from inter-hub debt that is uncollectible at the spoke level.
In this state, Senior Debt does not isolate risk — it masks deficits.

Key Data

• Divergence Gap: $96,375,000
• Invariant Violated: SE-1 (Solvency Equivalence)
• Proof Type: Constructive (7-step state-transition witness values)

Question for the Architects

How does V4 reconcile this divergence during cross-hub contagion events?
If Main Hub yield is derived from insolvent spokes, is Global Solvency a meaningful safety property — or an accounting illusion?

I have the full formal proof and simulation traces available for technical review and am available for a sync.

Best regards,
abdulwahed (HuntKits)

[Kene_StableLab]

Chaos Labs has done a great job with this analysis. From our point of view, this analysis does a good job breaking down the different ways various assets can be set up in V4.

The recommended structure makes sense, giving users options based on what they care about. Some borrowers want flexibility and are fine with their collateral being lent out; they can just use the pooled setup.
Other users want higher borrowing power and do not need to borrow volatile assets; they can use the dedicated bluechip spokes.
And for those who don’t want their collateral touched at all and want guaranteed access to it, there’s the isolated hub. Each setup serves a different need, which is the right approach.

The main question I am still curious about is this: how will liquidity flow into the isolated hub, since it won’t have direct access to the main pool?

[abdulwahed]

@stani @Kene_StableLab — really interesting points on the Hub-Spoke model.

Building on Kene’s question about liquidity flow, I’ve been looking into whether the “Isolated Blue Chip Hub” is as safe as it seems under extreme conditions. Specifically, I’ve been researching a scenario I call Asymmetric Deficit Socialization (ADS).

The “Phantom Yield” issue: > If a Spoke accrues interest that eventually turns into Bad Debt, the Hub has likely already extracted fees from that “accrued” interest and distributed them to depositors.

The Implication: > Isolation prevents rehypothecation, but it might not stop Hub depositors from receiving yield that’s effectively backed by Spoke insolvency. In my models, this breaks a core solvency invariant:

bad_debt > 0 ⟹ fees_extracted == 0

I’ve run some simulations on these “insolvency leaks” and would be happy to share the logic and results with the Aave Labs team privately if you’re interested in stress-testing this for V4.

Looking forward to the next Office Hours.