Executive Summary
This document presents LlamaRisk’s reference and analysis prepared for the initial deployment of Aave V4 on Ethereum Mainnet. It consolidates the hub-and-spoke architecture configuration, liquidation parameters, collateral factors, interest rate model settings, and Add Cap/Draw Cap recommendations produced in collaboration with @AaveLabs, @TokenLogic, and @ChaosLabs.
The deployment launches with 3 Hubs and 10 Spokes. The Core Hub serves as the primary liquidity venue and the source of cross-hub credit lines. The Prime Hub provides a non-borrowable blue-chip collateral environment for institutional-grade assets. The Plus Hub hosts Ethena ecosystem strategies behind its own caps and collateral efficiency conditions.
The initial parameters are deliberate launch-day guardrails, not a reflection of the full market risk capacity of these assets. The same assets carry substantially higher caps on Aave V3 today. The intent is to launch conservatively, accumulate on-chain usage data, and iterate via the standard risk management processes. Therefore, the initial months and phases of the protocol will not represent the full suite of features to be leveraged as the new version of Aave scales beyond the guarded deployment.
Architecture and Design Rationale
Hub-and-Spoke Topology
Aave V4 does not concentrate into a single Hub layout. Three architectural families are relevant to this deployment.
In a Monolithic Hub setup, a single Hub concentrates liquidity, with multiple Spokes connecting to it. Spokes are bounded by per-spoke add caps and draw caps, while assets continue to share a single utilization curve and rate environment. New Spokes can attach to existing liquidity depth without requiring separate pool bootstrapping. The trade-off is shared solvency: if a collateral listing performs worse than anticipated, any resulting bad debt is realized against the same Hub liquidity regardless of which Spoke originated the position. This model maximizes liquidity depth and rate stability but requires conservative assumptions across the entire venue.
In a Risk-profiled Hubs setup, multiple Hubs each maintain their own liquidity pool and accounting. Losses in one Hub are intended to remain contained within that Hub. Rates and liquidations become Hub-local, and utilization is measured per Hub. The main governance levers are Hub-level inventory and caps.
In an Asset-centric Hubs setup, a Hub is dedicated to a specific asset family or strategy domain. Collateral and borrowable sets are chosen to reflect that domain. This fits partner-driven or domain-specific markets that require a hard perimeter to scale. The primary trade-off is a higher concentration of tail risk and increased liquidity fragmentation, partially offset by the use of credit lines.
The three-Hub layout in this deployment is a response to an observed operating constraint in V3. When every borrowing intent shares a single solvency boundary, new growth areas compete for the same cap budget, forcing conservative defaults across the whole venue. Core remains the default rate environment and routing venue. Prime exists to serve suppliers who want a venue where their ETH and BTC are not borrowable. Plus exists so strategy-heavy stablecoin use can scale behind the Caps acceptable by the Core Hub.
Credit Lines
Credit lines make inter-Hub liquidity explicit and bounded. A Spoke can register a reserve that draws liquidity from a different Hub. Governance labels these cross-hub reserves with a prefix (e.g., “core” for credit lines of Core Hub, namely coreUSDT, coreUSDC) to distinguish them from natively supplied assets, but no separate token contract exists: users receive the actual underlying token. The credit line, DrawCap, serves as the senior exposure limit. Raising the cap scales capacity; lowering it limits the maximal capacity (if not yet reached); setting it to zero stops new draws.
The most operationally significant credit line in this initial configuration runs from Core Hub to the Plus Hub’s Ethena Ecosystem Spoke. Rather than requiring Plus to bootstrap its own independent stablecoin supply at genesis, Core’s stablecoin supply will be made available to Ethena borrowers via a governed credit line cap. This credit line is the principal mechanism enabling Ethena strategy growth within the Plus Hub, while strictly containing exposure of the main liquidity to Ethena’s strategies.
The total borrowable depth in a spoke reflects both organic direct supply and the governed credit line allocation from Core. However, Credit line’s Draw Caps then control how much of that routed inventory can be consumed, keeping the support measurable and reversible without merging solvency boundaries.
Two credit paths will be active at launch:
- Core to Prime/Bluechip: coreUSDT, coreUSDC, corefrxUSD, coreEURC
- Core to Plus/Ethena Ecosystem: coreUSDT, coreUSDC, corefrxUSD
- (Future) Plus to Core/Main: plusUSDe
Add Cap vs Draw Cap: The V4 Design Improvement
In Aave V3, the Supply Cap carries a dual burden: it limits collateral concentration and also serves as the only indirect mechanism to prevent borrow concentration. When a Supply Cap is reached, users whose health factor is declining cannot deposit additional collateral of the same asset to strengthen their position. Their only options are to repay debt or deposit other types of collateral.
V4 decouples this constraint. Draw Cap is the binding risk lever, limiting the collateral exposure on a per-Spoke basis. Add Cap can therefore be set without specific constraints so users can always supply more collateral to improve their health factor. Draw Cap is set conservatively to limit the actual risk exposure to the Hub’s liquidity pool.
For assets onboarded as collateral only (not borrowable), future Add Cap could be set to MAX_ALLOWED_SPOKE_CAP, the sentinel value in the Hub contract that bypasses the supply cap check entirely. This ensures that a user facing declining health can always deposit more collateral, which is the central UX guarantee V4 was designed to provide. Meanwhile, the Draw Cap will ensure that the exposure to a set of collaterals within a Spoke is strictly upper-bounded.
This rule should generally hold in smaller Spokes, where all collateral stems from similar asset profiles, but is generally not applicable to Spokes where significant collateral mixing is possible (i.e., the Main Spoke of Core Hub). Again, this approach would be taken in the future, but not during the initial guarded rollout phase.
Liquidation Design
V4 introduces a dynamic liquidation bonus that increases linearly as the health factor decreases, in contrast to V3’s static bonus. Two spoke-wide parameters shape the bonus curve. The targetHealthFactor is the HF to which a borrower is restored after liquidation; liquidators repay only enough debt to reach this value under normal circumstances. The healthFactorForMaxBonus is the HF at which the maximum liquidation bonus becomes active, with the bonus ramping linearly between HF of 1.0 and this value. The liquidationBonusFactor is a scaling parameter that determines both how steeply the bonus ramps and what the maximum bonus is.
Based on Aave liquidation data since the SVR launch on Ethereum, the majority of liquidations occur immediately as the health factor drops below 1.0. The median HF pre-liquidation is 0.9987, and the median HF post-liquidation is 1.125. These observations drive the parameter choices, particularly the targetHealthFactor, to ensure liquidation profits and SVR opportunity remain similar to V3.
Source: LlamaRisk, March 13, 2026
Health factor parameters set at the spoke level are determined by the nature of that spoke, including its risk profile, use case (e.g., looping), and borrowing efficiency. The target health factor for high-borrowing-power spokes should be set lower (less conservative), as the majority of user positions in these spokes are highly leveraged and remain at low HFs. In contrast, an open market spoke would have a more conservative targetHealthFactor, as the collateral is typically more volatile relative to the borrowed asset. The healthFactorForMaxBonus, however, would follow the opposite rationale. High-efficiency spokes would require a faster increase in LB, given the higher risk of a deficit stemming from greater borrowing power. An open market spoke with a low risk of deficit (lower borrowing power), such as the Main Spoke of Core Hub, would therefore have a lower healthFactorForMaxBonus. Also, we aim to ensure that the maximum liquidation bonus (LB) is reached before a position incurs bad debt. To achieve this, healthFactorForMaxBonus would be set above the highest CF of the assets within that spoke.
The liquidation protocol fee is proposed to be set at 10% across all assets, aligning with the configuration used for the majority of assets on Aave V3. With the proposed liquidation parameterization, liquidator profits are expected to remain similar to V3, or increase marginally (max LB multiplier), ensuring that liquidation incentives are not reduced. There are alternative approaches with different tradeoffs. Setting the fee to 0% would increase the liquidator’s profitability, with a portion of this value still captured by the protocol through SVR. Another option could be to set the fee to 0% while lowering the liquidation bonus, making users better off than on V3 without affecting liquidator profits. However, this would reduce the DAO’s value capture.
Collateral Factor
Collateral factor is analogous to Liquidation Threshold (LT) under V3, as it is used to calculate the Health Factor. However, it also represents borrowing capacity similar to LTV. Under V3, the difference between LTV and LT provides a buffer that allows users to borrow up to the LTV while still remaining below the liquidation trigger defined by LT. In V4, this buffer is removed and replaced by a single parameter, CF, which simultaneously determines both borrowing capacity and the point at which liquidation triggers. As a result, the value to which CF should correspond depends on the spoke type. For spokes that correspond to the open market configuration in V3, which already have relatively low LTV and LT values and therefore maintain safe borrowing capacity while providing sufficient room for liquidation before deficit risk, CF can be aligned closer to the V3 LT. In some cases (e.g., the Prime Hub), due to stronger segregation guarantees, the CF can exceed the Aave V3 baseline.
Interest Rate Model
IRM parameters are configured at the Hub level, not per spoke. They apply to an asset across all spokes within that Hub. The parameters follow the same two-slope utilization curve used in V3, defined by a base variable borrow rate, slope below the optimal usage ratio (Slope 1), slope above it (Slope 2), and the optimal usage ratio itself (Uoptimal). The Liquidity Fee is the fraction of borrower interest captured by the protocol treasury, equivalent to the reserve factor in V3.
The goal of the initial configuration was to keep the setup very similar to the one currently used on Aave v3, with an exception of more aggressive slope 2 parameters in order to proactively combat the market instability as it scales and searches for an equilibrium. Therefore, utilization shocks, which we observed on Aave v3 (e.g. the USDT and WETH reserves) are expected to be more short lived, at an expense of more aggresive borrow rate impact beyond optimal utilization levels.
Parameters presented jointly with @ChaosLabs.
Core Hub
Parameters presented jointly with @ChaosLabs.
Main Spoke
The Main Spoke is the general-purpose lending venue. It accepts the broadest collateral set and the broadest borrowable set in the deployment. Collateral-only assets (wstETH, weETH, LINK, AAVE) are not borrowable; however, their Add Caps are still specified in this case, not to allow unbalanced exposure to a particular type of assets.
Given this spoke represents an open-market configuration with lower borrowing capacity relative to collateral value, CF is set equal to the V3 LT, as the risk of bad debt from over-borrowing remains low, and a similar user risk profile can be expected.
Spoke-level liquidation parameters:
| Parameter |
Value |
Rationale |
| targetHealthFactor |
1.24 |
Generates liquidation sizes comparable to V3 based on post-liquidation HF data. Preserves SVR opportunity value while avoiding excessive borrower impact. |
| healthFactorForMaxBonus |
0.90 |
Max bonus activates at moderate stress, ensuring reliable liquidator participation before bad debt accrues. Highest CF in this spoke is 0.83. Setting too low (e.g., 0.80) delays incentives and risks stale positions; too high (above 0.95) triggers max bonus too easily. |
| liquidationBonusFactor |
0.80 |
A lower value implies a higher max LB, providing ample incentives for liquidators while keeping user losses controlled. |
Per-asset parameters. Max LB is set at 1.25x the V3 LB such that the effective bonus at HF 1.0 equals the V3 LB.
Lido, EtherFi, Kelp Spokes (E-Mode)
For LST/LRT leverage looping strategies, single-asset (E-Mode) spokes are chosen to avoid coupling parameters across collateral types and to keep controls granular. A combined correlated lane would inherit the weakest liquidity and oracle assumptions in the set and force one cap posture across multiple assets. Splitting the lanes keeps CF, liquidation bonus, draw caps adjustable per collateral, and makes it straightforward to clamp one asset without reshaping the rest of the ETH leverage flow.
| Parameter |
Value |
Rationale |
| targetHealthFactor |
1.05 |
High borrowing power and looping spoke; lower THF avoids oversized liquidations while restoring solvency. |
| healthFactorForMaxBonus |
0.98 |
Earlier max bonus activation for faster liquidator response in highly leveraged E-Mode dynamics. |
| liquidationBonusFactor |
0.90 |
Preserves near-boundary liquidator incentives while limiting user penalty at entry point. |
Lombard BTC Spoke (E-Mode)
Existing BTC-correlated borrowing activity on Aave V3 remains modest, with approximately $7.3m borrowed against WBTC and $7.7m against cbBTC at launch, and average health factors of 4.90 and 2.58 respectively. This supports conservative initial Draw Caps. The Lombard Spoke is treated as an exploratory Spoke and is therefore expected to grow gradually.
Spoke-level liquidation parameters:
| Parameter |
Value |
Rationale |
| targetHealthFactor |
1.05 |
Slightly higher THF than ETH e-Modes to improve post-liquidation safety given BTC volatility. |
| healthFactorForMaxBonus |
0.94 |
Earlier max bonus activation for faster liquidator response in highly leveraged E-Mode dynamics. |
| liquidationBonusFactor |
0.90 |
Keeps boundary bonus near V3 while allowing sufficient max LB in deep stress. |
Gold Spoke
The Gold Spoke uses XAUt as collateral for a set of borrowable stablecoins. As a non-crypto open-market spoke, it merits more conservative liquidation restoration parameters. Draw Caps will be set conservatively to reflect the Gold Spoke’s still-developing borrow-side liquidity profile.
Spoke-level liquidation parameters:
| Parameter |
Value |
Rationale |
| targetHealthFactor |
1.20 |
Open-market non-crypto collateral dynamics merit more conservative post-liquidation restoration. |
| healthFactorForMaxBonus |
0.90 |
Lower trigger avoids overpaying incentives too early while still reaching max LB before the deficit zone. |
| liquidationBonusFactor |
0.80 |
Matches the Main Spoke baseline and preserves V3-equivalent bonus at HF~1 with a 1.25x max LB cap. |
Per-asset parameters. CF is set equal to the V3 LT given low deficit risk. Max LB is set at 1.25x the V3 LB such that the effective bonus at HF 1.0 equals the V3 LB (6%).
Forex Spoke
The primary use case is borrowing one major fiat stablecoin against another, primarily EURC against USDC or USDC against EURC. Due to limited secondary market liquidity for EURC (approximately $4m of sell-side depth at launch), caps will need to be set conservatively across the board.
Spoke-level liquidation parameters:
| Parameter |
Value |
Rationale |
| targetHealthFactor |
1.10 |
Stablecoin basket with relatively lower volatility supports a moderate THF slightly below Main Spoke. |
| healthFactorForMaxBonus |
0.90 |
Incentives ramp sufficiently early without forcing max LB too close to HF~1. |
| liquidationBonusFactor |
0.80 |
Consistent with borrowing parameters for partially correlated strategies. |
Prime Hub
Bluechip Spoke
Prime’s non-borrowable collateral posture is designed around one operational promise: withdrawal availability and predictable behavior for suppliers. If collateral is borrowable, supplier experience is downstream of utilization and borrower demand. If collateral is not borrowable, supplier experience is dominated by the Hub’s own rules and the credit line limit governing any imported stablecoin inventory.
Collateral assets (wETH, wstETH, wBTC, cbBTC) are not borrowable within Prime Hub and will therefore be able to receive uncapped Add Caps in the future, keeping Draw Cap as the exposure limiter. Borrowable stablecoins carry numeric caps to control for supply concentration. Due to better segregation guarantees and no rehypothecation risk, the CF for these assets is explicitly set higher than on Main Spoke of Core Hub. It is notable that this preferential CF setup, specifically for wETH, may generate a negative Spoke preference feedback loop, where wETH supply that would be attracted to the Bluechip Spoke would not contribute to the available wETH liquidity on Core Hub, therefore minimizing the LST/LRT leverage looping capacity. However, this can be controlled for in the future by balancing the draw caps or aligning CF closer in case this scenario comes to fruition.
Spoke-level liquidation parameters are more efficient than in the Main Spoke in Core Hub, with targetHealthFactor set slightly lower at 1.14 to reflect the reduced volatility of the collateral set (the absence of LINK and AAVE reduces the weighted average CF in the spoke).
| Parameter |
Value |
Rationale |
| targetHealthFactor |
1.14 |
Generates liquidation sizes comparable to V3. Preserves SVR opportunity value while avoiding excessive borrower impact. |
| healthFactorForMaxBonus |
0.90 |
Max bonus activates at moderate stress before bad debt accrues. Highest CF in this spoke is 0.83. |
| liquidationBonusFactor |
0.80 |
Matches the Main Spoke baseline for the same LB increase slope |
Plus Hub
Ethena Ecosystem Spoke
This is a high borrowing efficiency spoke where the majority of positions are highly leveraged PT looping via stablecoins and USDe. The principal cross-hub credit line from Core Hub to this spoke allows Core’s existing deep stablecoin pools to serve Ethena borrowers without requiring Plus to bootstrap independent stablecoin liquidity at genesis. Users can also supply stablecoins directly into the spoke; the total borrowable depth reflects both organic supply and the credit line allocation. Spoke-level Draw Caps control how much of the routed inventory can be consumed.
The separation between the Ethena Ecosystem Spoke and the Ethena Correlated Spoke is primarily about isolating USDe borrowing to enable better parameters for that lane. Keeping them in separate spokes allows distinct CF, Draw Caps and liquidation settings to be applied independently, without constraints in one lane affecting the other.
Spoke-level liquidation parameters:
| Parameter |
Value |
Rationale |
| targetHealthFactor |
1.07 |
Intermediate efficiency profile between open market and correlated-looping setup. |
| healthFactorForMaxBonus |
0.95 |
Set above the max CF to allow liquidator participation and quick ramp-up of incentives given concentrated collateral and borrow dynamics. |
| liquidationBonusFactor |
0.90 |
Lower max LB to avoid high user losses in a high-efficiency environment. |
*Note: Exact PT maturities will be picked according to the significance of liquidity and time-to-maturity prior to the deployment AIP
Ethena Correlated Spoke (E-Mode)
This spoke isolates USDe-only borrowing, enabling a tighter correlated parameter set for positions where both collateral and debt are Ethena assets. It is the highest borrowing power spoke in the Plus Hub.
Spoke-level liquidation parameters:
| Parameter |
Value |
Rationale |
| targetHealthFactor |
1.05 |
Highest borrowing power profile in the Plus Hub; lower THF reduces liquidation size and borrower shock. |
| healthFactorForMaxBonus |
0.97 |
Fastest bonus ramp among Plus spokes to maintain execution under very unlikely but correlated risk. |
| liquidationBonusFactor |
0.90 |
Keeps boundary bonus close to V3 while avoiding excessive max LB expansion for correlated assets. |
*Note: Exact PT maturities will be picked according to the significance of liquidity and time-to-maturity prior to the deployment AIP
Credit Line Draw Caps
Credit lines are governed by Draw Caps enforced at the Hub level. These are the aggregate ceilings on Core-routed inventory across all connected spokes. The initial values are set at a conservative launch scale and do not reflect the full risk capacity implied by Core Hub’s existing stablecoin depth, to accumulate data before scaling.
In the future, the draw caps and assets included in the credit would be parametrized against market observations and growth vs risk balance needs.
Core to Prime/Bluechip:
| Asset |
DrawCap |
| coreUSDT |
200,000 |
| coreUSDC |
200,000 |
| corefrxUSD |
50,000 |
| coreEURC |
50,000 |
Core to Plus/Ethena Ecosystem:
| Asset |
DrawCap |
| coreUSDT |
200,000 |
| coreUSDC |
200,000 |
| corefrxUSD |
50,000 |
Other Parameters
Tokenization Spokes
A Tokenization Spoke is not a risk-management Spoke. It is an ERC-4626 vault contract that wraps a single Hub asset and issues a transferable, permit-enabled share token representing a supply position in the Hub’s liquidity pool. It implements no collateral sets, borrowable sets, liquidation parameters.
The key mechanics are straightforward. On deposit, assets are transferred directly into the Hub contract and HUB.add() is called. On withdrawal, HUB.remove() is called and assets are pushed to the recipient. All share pricing delegates to the Hub’s own accounting via previewAddByAssets and previewRemoveByShares, so shares appreciate at the Hub’s supply rate with no separate accounting layer.
The contract also implements intent-based operations via EIP-712, enabling gasless and delegated execution.
Its purpose is composability: any protocol that integrates ERC-4626 can interact with Aave V4 supply-only positions without understanding the Hub-and-Spoke architecture.
Parameters presented jointly with @ChaosLabs.
Collateral Risk (Risk Premium)
Collateral Risk is a per-asset parameter set on each spoke, expressed in basis points (0 to 100,000). It determines the User Risk Premium added on top of the base borrow rate. The protocol computes a position’s effective risk premium as a value-weighted average of the collateral risk scores across all assets a user has supplied as collateral. A score of 0 means the asset contributes no premium; higher values increase the borrowing cost for users posting that asset.
There is a single Spoke contract type in the V4 codebase. Zero risk premium is not a separate contract variant but a configuration state where all collateralRisk values in a spoke are 0. When every asset carries a collateralRisk of 0, the premium computation runs but produces zero for every user, which is the most gas-efficient operating state of the spoke.
Two spokes in this deployment are designated zero-risk-premium spokes by governance policy: the Lido Spoke and the Bluechip Spoke. For the Lido Spoke, collateral is a single highly correlated LST and risk differentiation within the spoke is not meaningful. For the Bluechip Spoke, the Prime Hub can be established as the risk baseline, therefore collateral assets should carry no rate penalty. These spokes should not have their collateralRisk values raised through future governance actions; doing so would contradict the design intent of those venues.
All other spokes launch with collateralRisk = 0 across all assets as the initial setting. These values will be tuned through future risk & growth management decisions as market scale increases.
Oracle Configuration
Oracle assignments for V4 should replicate the V3 Ethereum configuration. There are three oracle types in use across the deployment.
Standard Chainlink feeds are used. These are the SVR variants on Ethereum, which integrate MEV-capture mechanisms. SVR should be integrated on Aave V4 equivalently.
CAPO (Correlated Asset Price Oracle) is used for yield-bearing assets and stablecoins. For LST and LRT assets, CAPO wraps the underlying Chainlink feed with a growth cap expressed as maxYearlyRatioGrowthPercent and a minimumSnapshotDelay. The cap prevents oracle manipulation via artificially accelerated exchange rate reporting. For stablecoins, CAPO wraps the price feed with a fixed ceiling (priceCap).
Pendle linear discount adapters are used for PT tokens. These derive a price from the underlying asset’s oracle and a configurable maxDiscountRatePerYear and discountRatePerYear, which must be updated at each PT maturity rollover.
Ethena’s USDe should remain priced on par with USDT secondary market price, as currently applied across all Aave V3 deployments.
Flash Loan Configuration
Note: Initial setup would not have the flash loan functionality enabled, it is expected to be launched shortly after
Flash loan parameters for V4 match the current V3 Ethereum configuration. FLASHLOAN_PREMIUM_TOTAL is 5 bps (0.05%) and FLASHLOAN_PREMIUM_TO_PROTOCOL is 4 bps (0.04%). The remaining 1 bp is distributed to liquidity providers as additional interest. Flash loans are enabled for all borrowable reserves across all spokes. The fee waiver for approved flashBorrowers registered via ACLManager would carry over from V3 and applies to both the flashLoan and flashLoanSimple entry points.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk serves as a member of Ethena’s Risk Committee and an independent attester of Ethena’s PoR solution. LlamaRisk did not receive compensation from the protocol(s) or their affiliated entities for this work. The information should not be construed as legal, financial, tax, or professional advice.
-23% YTD
