[ARFC] Adopt The SEAL Safe Harbor Agreement
Title: [ARFC] Adopt The SEAL Safe Harbor Agreement
Authors: @samczsun (SEAL), @dickson (SEAL), bgdlabs.eth
Date: 2025-09-02
Introduction
This proposal outlines Aave Governance’s adoption of the SEAL (Security Alliance) Whitehat Safe Harbor Agreement (“Safe Harbor Agreement”). By adopting Safe Harbor, Aave improves the security of its on-chain assets by allowing whitehats to intervene during active exploits to save protocol funds.
What is the Safe Harbor Agreement?
The Safe Harbor Agreement addresses a critical need in crypto: enabling whitehats to intervene during active exploits when traditional responsible disclosure procedures are not feasible.
Key aspects of the agreement include:
-
Encouraging Whitehats to Protect the Protocol: By adopting Safe Harbor, Aave incentivizes whitehats to step in and protect the protocol during active exploits by limiting their legal exposure.
-
Intervention Only During Active Exploits: Whitehats are authorized to act only when there is an immediate or ongoing exploit that threatens the protocol. This agreement applies only to critical situations where responsible disclosure procedures would not save funds due to the urgency of the exploit, and it is not intended for routine security testing or vulnerability reporting. An example of what would fall under scope would be a malicious transaction present in the mempool, which could be frontrun. An example of what falls out of scope would be a security researcher finding a critical vulnerability that should be reported to the protocol via a bug bounty provider. Any attempt to initiate a blackhat transaction, or to disguise a blackhat action as a whitehat intervention, is strictly prohibited and will not be protected under this safe harbor, and may result in prosecution to the fullest extent of the law.
-
Mandatory Return of Rescued Funds: Under the terms of the Safe Harbor, whitehats are required to return all rescued assets to a pre-designated recovery address controlled by the protocol within 72 hours of recovering them. This ensures that recovered funds are quickly secured, preventing delay or potential loss.
-
Clear Guidelines and Legal Protection: The agreement establishes strict rules for how whitehats must operate during an exploit, ensuring recovery efforts are conducted professionally and safely, minimizing the risk of mistakes or further damage to the protocol. By adhering to these guidelines, whitehats can limit their potential legal exposure, allowing them to act in good faith without fear of liability.
-
Incentivized Rescue Efforts: To motivate whitehats to act during critical situations, the agreement offers a bounty system similar to a bug bounty. Whitehats are rewarded with a percentage of the recovered assets, up to a predefined cap, for their successful interventions. Note: Safe Harbor and the Bug Bounty program are totally separate, but mutually exclusive rewards-wise: a whitehat rewarded for a report via the Bug Bounty program is not eligible for a reward on the same exploit, even if legal protection of Safe Harbor applies.
For more information, check out the Safe Harbor Agreement here.
Rationale
Aave is committed to enhancing its security and protecting user funds during critical moments. While security audits and other preventive measures are crucial, the unpredictable nature of exploits requires a swift, decisive response mechanism to minimize potential damage.
The Safe Harbor Agreement empowers whitehats to act immediately during an active exploit, providing a proactive and structured recovery process. By enabling whitehats to step in and recover assets during a crisis, Aave strengthens its defenses against emerging threats.
Benefits of adopting the Safe Harbor Agreement include:
-
Agile Defense Against Exploits: Whitehats are authorized to intervene as soon as an active exploit is detected, enabling them to respond faster than traditional methods. This ensures that Aave is protected against threats even without the ability to halt the protocol. Immediate action minimizes the window for malicious actors, reduces damages, and accelerates the recovery of assets during critical moments.
-
Clarified Rescue Process: The agreement ensures that every step, from intervention to fund recovery, is predetermined and streamlined. Whitehats know exactly where to send recovered funds, preventing chaotic negotiations or rushed decisions during an exploit. This clarity ensures efficient, decisive action when it matters most.
-
Clear Financial Boundaries: The predefined bounty system, with a cap matching Aave’s existing bug bounty, ensures that whitehats are incentivized fairly without creating conflicting priorities between exploit intervention and standard vulnerability disclosure. By setting expectations upfront, it eliminates post-exploit negotiations, ensuring funds are returned promptly without attempts to change the reward amount, keeping the process fair and transparent.
-
Aligning with Industry Best Practices: By adopting the Safe Harbor Agreement, Aave aligns itself with leading security practices across the industry, reinforcing its commitment to staying at the forefront of protocol security.
Adoption of the agreement complements audits by providing an additional layer of security, ensuring that the protocol is better prepared to respond to active threats.
Adoption Details
Aave will adopt the agreement with the following parameters. For a full description of these adoption details, review the Safe Harbor for Protocols document.
- Asset Recovery Address: Addresses controlled by Aave, which recovered funds will be returned to in the event of a hack.
| Chain | Address |
| Ethereum | 0x464C71f6c2F760DdA6093dCB91C24c39e5d6e18c |
| Polygon PoS | 0xe8599F3cc5D38a9aD6F3684cd5CEa72f10Dbc383 |
| Avalanche C-Chain | 0x5ba7fd868c40c16f7aDfAe6CF87121E13FC2F7a0 |
| Optimism | 0xB2289E329D2F85F1eD31Adbb30eA345278F21bcf |
| Arbitrum | 0x053D55f9B5AF8694c503EB288a1B7E552f590710 |
| Base | 0xBA9424d650A4F5c80a0dA641254d1AcCE2A37057 |
| BNB Chain | 0x25Ec457d1778b0E5316e7f38f3c22baF413F1A8C |
| Metis | 0xB5b64c7E00374e766272f8B442Cd261412D4b118 |
| Gnosis Chain | 0x3e652E97ff339B73421f824F5b03d75b62F1Fb51 |
| ZKSync Era | 0xd69Cbda644c6be817AaFb5Fd9174f50C33803B6b |
| Scroll | 0x90eB541e1a431D8a30ED85A77675D1F001128cb5 |
| Sonic | 0x1aB55bBdD5DF0782BBCf73553Af93BC6B29A286B |
| Soneium | 0xc7B3cc5F5988613b0D620623C514EDFB32539720 |
| Linea | 0x86E2938daE289763D4e09a7e42c5cCcA62Cf9809 |
| Celo | 0xC959439207dA5341B74aDcdAC59016aa9Be7E9E7 |
- Scope: List of all on-chain assets protected under Safe Harbor.
| Chain | Name | Address | Type (None, Existing Only, All) |
|---|---|---|---|
| Ethereum | Pool Addresses Provider (Core) | 0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e | Existing Only |
| Ethereum | Pool (Core) | 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2 | All (all active libraries, and the implementation under proxy) |
| Ethereum | Pool Configurator (Core) | 0x64b761D848206f447Fe2dd461b0c635Ec39EbB27 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Ethereum | Oracle (Core) | 0x54586bE62E3c3580375aE3723C145253060Ca0C2 | All (all per-asset feeds) |
| Ethereum | ACL Manager (Core) | 0xc2aaCf6553D20d1e9d78E365AAba8032af9c85b0 | Existing only |
| Ethereum | Collector (Core) | 0x464C71f6c2F760DdA6093dCB91C24c39e5d6e18c | All (implementation under proxy) |
| Ethereum | Debt Swap Adapter (Core) | 0xd7852E139a7097E119623de0751AE53a61efb442 | Existing only |
| Ethereum | RepayWithCollateralAdapter (Core) | 0x35bb522b102326ea3F1141661dF4626C87000e3E | Existing only |
| Ethereum | SwapCollateralAdapter (Core) | 0xADC0A53095A0af87F3aa29FE0715B5c28016364e | Existing only |
| Ethereum | WETHGateway (Core) | 0xd01607c3C5eCABa394D8be377a08590149325722 | Existing only |
| Ethereum | StataTokenFactory (Core) | 0xCb0b5cA20b6C5C02A9A3B2cE433650768eD2974F | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Ethereum | RateStrategy (Core) | 0x9ec6F08190DeA04A54f8Afc53Db96134e5E3FdFB | Existing only |
| Ethereum | Pool Addresses Provider (Prime) | 0xcfBf336fe147D643B9Cb705648500e101504B16d | Existing Only |
| Ethereum | Pool (Prime) | 0x4e033931ad43597d96D6bcc25c280717730B58B1 | All (all active libraries, and the implementation under proxy) |
| Ethereum | Pool Configurator (Prime) | 0x342631c6CeFC9cfbf97b2fe4aa242a236e1fd517 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Ethereum | Oracle (Prime) | 0xE3C061981870C0C7b1f3C4F4bB36B95f1F260BE6 | All (all per-asset feeds) |
| Ethereum | ACL Manager (Prime) | 0x013E2C7567b6231e865BB9273F8c7656103611c0 | Existing only |
| Ethereum | Debt Swap Adapter (Prime) | 0xd1B2dec98A95B773C4909B5CD8FB455F467A527f | Existing only |
| Ethereum | RepayWithCollateralAdapter (Prime) | 0x66E1aBdb06e7363a618D65a910c540dfED23754f | Existing only |
| Ethereum | SwapCollateralAdapter (Prime) | 0xD0887AA7fEBC8962c622493646195e7c76D94fCE | Existing only |
| Ethereum | WETHGateway (Prime) | 0x3167C452fA3fa1e5C16bB83Bc0fde4519C464299 | Existing only |
| Ethereum | StataTokenFactory (Prime) | 0x347C75d19718a05148687E13dca259aD016aB411 | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Ethereum | RateStrategy (Prime) | 0x8958b1C39269167527821f8c276Ef7504883f2fa | Existing only |
| Polygon PoS | Pool Addresses Provider | 0xa97684ead0e402dC232d5A977953DF7ECBaB3CDb | Existing Only |
| Polygon PoS | Pool | 0x794a61358D6845594F94dc1DB02A252b5b4814aD | All (all active libraries, and the implementation under proxy) |
| Polygon PoS | Pool Configurator | 0x8145eddDf43f50276641b55bd3AD95944510021E | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Polygon PoS | Oracle | 0xb023e699F5a33916Ea823A16485e259257cA8Bd1 | All (all per-asset feeds) |
| Polygon PoS | ACL Manager | 0xa72636CbcAa8F5FF95B2cc47F3CDEe83F3294a0B | Existing only |
| Polygon PoS | Debt Swap Adapter | 0xE28E2c8d240dd5eBd0adcab86fbD79df7a052034 | Existing only |
| Polygon PoS | RepayWithCollateralAdapter | 0x5d4D4007A4c6336550DdAa2a7c0d5e7972eebd16 | Existing only |
| Polygon PoS | SwapCollateralAdapter | 0xC4aff49fCeD8ac1D818a6DCAB063f9f97E66ec5E | Existing only |
| Polygon PoS | WETHGateway | 0xBC302053db3aA514A3c86B9221082f162B91ad63 | Existing only |
| Polygon PoS | StataTokenFactory | 0x1504F1d7b6892600ae0d394F9042e696dd9F87Fa | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Polygon PoS | RateStrategy | 0x56076f960980d453b5B749CB6A1c4D2E4e138B1A | Existing only |
| Avalanche C-Chain | Pool Addresses Provider | 0xa97684ead0e402dC232d5A977953DF7ECBaB3CDb | Existing Only |
| Avalanche C-Chain | Pool | 0x794a61358D6845594F94dc1DB02A252b5b4814aD | All (all active libraries, and the implementation under proxy) |
| Avalanche C-Chain | Pool Configurator | 0x8145eddDf43f50276641b55bd3AD95944510021E | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Avalanche C-Chain | Oracle | 0xEBd36016B3eD09D4693Ed4251c67Bd858c3c7C9C | All (all per-asset feeds) |
| Avalanche C-Chain | ACL Manager | 0xa72636CbcAa8F5FF95B2cc47F3CDEe83F3294a0B | Existing only |
| Avalanche C-Chain | Debt Swap Adapter | 0xE28E2c8d240dd5eBd0adcab86fbD79df7a052034 | Existing only |
| Avalanche C-Chain | RepayWithCollateralAdapter | 0x5d4D4007A4c6336550DdAa2a7c0d5e7972eebd16 | Existing only |
| Avalanche C-Chain | SwapCollateralAdapter | 0x2Cf641F7C0eac2788A7924B82d6Ca8EB7bAa4E3A | Existing only |
| Avalanche C-Chain | WETHGateway | 0x2825cE5921538d17cc15Ae00a8B24fF759C6CDaE | Existing only |
| Avalanche C-Chain | StataTokenFactory | 0xC2E7A608d868817dd58438913Ed72955a0567561 | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Avalanche C-Chain | RateStrategy | 0xCe1C5509f2f4d755aA64B8D135B15ec6F12a93da | Existing only |
| Optimism | Pool Addresses Provider | 0xa97684ead0e402dC232d5A977953DF7ECBaB3CDb | Existing Only |
| Optimism | Pool | 0x794a61358D6845594F94dc1DB02A252b5b4814aD | All (all active libraries, and the implementation under proxy) |
| Optimism | Pool Configurator | 0x8145eddDf43f50276641b55bd3AD95944510021E | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Optimism | Oracle | 0xD81eb3728a631871a7eBBaD631b5f424909f0c77 | All (all per-asset feeds) |
| Optimism | ACL Manager | 0xa72636CbcAa8F5FF95B2cc47F3CDEe83F3294a0B | Existing only |
| Optimism | Debt Swap Adapter | 0xE28E2c8d240dd5eBd0adcab86fbD79df7a052034 | Existing only |
| Optimism | RepayWithCollateralAdapter | 0x5d4D4007A4c6336550DdAa2a7c0d5e7972eebd16 | Existing only |
| Optimism | SwapCollateralAdapter | 0x830C5A67a0C95D69dA5fb7801Ac1773c6fB53857 | Existing only |
| Optimism | WETHGateway | 0x5f2508cAE9923b02316254026CD43d7902866725 | Existing only |
| Optimism | StataTokenFactory | 0x170d6D6FCAbF0Ba3932a03d5f470c16c39c18e39 | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Optimism | RateStrategy | 0x9359282735496463131139875849d5302Fb4bed1 | Existing only |
| Arbitrum | Pool Addresses Provider | 0xa97684ead0e402dC232d5A977953DF7ECBaB3CDb | Existing Only |
| Arbitrum | Pool | 0x794a61358D6845594F94dc1DB02A252b5b4814aD | All (all active libraries, and the implementation under proxy) |
| Arbitrum | Pool Configurator | 0x8145eddDf43f50276641b55bd3AD95944510021E | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Arbitrum | Oracle | 0xb56c2F0B653B2e0b10C9b928C8580Ac5Df02C7C7 | All (all per-asset feeds) |
| Arbitrum | ACL Manager | 0xa72636CbcAa8F5FF95B2cc47F3CDEe83F3294a0B | Existing only |
| Arbitrum | Debt Swap Adapter | 0x63dfa7c09Dc2Ff4030d6B8Dc2ce6262BF898C8A4 | Existing only |
| Arbitrum | RepayWithCollateralAdapter | 0xE28E2c8d240dd5eBd0adcab86fbD79df7a052034 | Existing only |
| Arbitrum | SwapCollateralAdapter | 0xF3C3F14dd7BDb7E03e6EBc3bc5Ffc6D66De12251 | Existing only |
| Arbitrum | WETHGateway | 0x5283BEcEd7ADF6D003225C13896E536f2D4264FF | Existing only |
| Arbitrum | StataTokenFactory | 0xd85922fFF51ba4130cEC7c499db4Ac3Eb9981EaD | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Arbitrum | RateStrategy | 0x429F16dBA3B9e1900087Cbaa7b50D38Bc60fB73F | Existing only |
| Base | Pool Addresses Provider | 0xe20fCBdBfFC4Dd138cE8b2E6FBb6CB49777ad64D | Existing Only |
| Base | Pool | 0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 | All (all active libraries, and the implementation under proxy) |
| Base | Pool Configurator | 0x5731a04B1E775f0fdd454Bf70f3335886e9A96be | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Base | Oracle | 0x2Cc0Fc26eD4563A5ce5e8bdcfe1A2878676Ae156 | All (all per-asset feeds) |
| Base | ACL Manager | 0x43955b0899Ab7232E3a454cf84AedD22Ad46FD33 | Existing only |
| Base | Debt Swap Adapter | 0xb12e82DF057BF16ecFa89D7D089dc7E5C1Dc057B | Existing only |
| Base | RepayWithCollateralAdapter | 0x63dfa7c09Dc2Ff4030d6B8Dc2ce6262BF898C8A4 | Existing only |
| Base | SwapCollateralAdapter | 0x2E549104c516b8657A7D888494DfbAbD7C70b464 | Existing only |
| Base | WETHGateway | 0xa0d9C1E9E48Ca30c8d8C3B5D69FF5dc1f6DFfC24 | Existing only |
| Base | StataTokenFactory | 0x78d33BF0014ab169725F2Ea5a62b200F2977faeE | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Base | RateStrategy | 0x86AB1C62A8bf868E1b3E1ab87d587Aba6fbCbDC5 | Existing only |
| BNB Chain | Pool Addresses Provider | 0xff75B6da14FfbbfD355Daf7a2731456b3562Ba6D | Existing Only |
| BNB Chain | Pool | 0x6807dc923806fE8Fd134338EABCA509979a7e0cB | All (all active libraries, and the implementation under proxy) |
| BNB Chain | Pool Configurator | 0x67bdF23C7fCE7C65fF7415Ba3F2520B45D6f9584 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| BNB Chain | Oracle | 0x39bc1bfDa2130d6Bb6DBEfd366939b4c7aa7C697 | All (all per-asset feeds) |
| BNB Chain | ACL Manager | 0x2D97F8FA96886Fd923c065F5457F9DDd494e3877 | Existing only |
| BNB Chain | Debt Swap Adapter | 0x5d4D4007A4c6336550DdAa2a7c0d5e7972eebd16 | Existing only |
| BNB Chain | RepayWithCollateralAdapter | 0x5598BbFA2f4fE8151f45bBA0a3edE1b54B51a0a9 | Existing only |
| BNB Chain | SwapCollateralAdapter | 0x33E0b3fc976DC9C516926BA48CfC0A9E10a2aAA5 | Existing only |
| BNB Chain | WETHGateway | 0x0c2C95b24529664fE55D4437D7A31175CFE6c4f7 | Existing only |
| BNB Chain | StataTokenFactory | 0x929B8a21a604b93DD7e95d5b9aAa3aDf5bE250ae | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| BNB Chain | RateStrategy | 0x86AB1C62A8bf868E1b3E1ab87d587Aba6fbCbDC5 | Existing only |
| Metis | Pool Addresses Provider | 0xB9FABd7500B2C6781c35Dd48d54f81fc2299D7AF | Existing Only |
| Metis | Pool | 0x90df02551bB792286e8D4f13E0e357b4Bf1D6a57 | All (all active libraries, and the implementation under proxy) |
| Metis | Pool Configurator | 0x69FEE8F261E004453BE0800BC9039717528645A6 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Metis | Oracle | 0x38D36e85E47eA6ff0d18B0adF12E5fC8984A6f8e | All (all per-asset feeds) |
| Metis | ACL Manager | 0xcDCb65fc657B701a5100a12eFB663978E7e8fFB8 | Existing only |
| Metis | RateStrategy | 0x258625AfDe0073f5Bbce50C0305f4C23B16C7F3a | Existing only |
| Gnosis Chain | Pool Addresses Provider | 0x36616cf17557639614c1cdDb356b1B83fc0B2132 | Existing Only |
| Gnosis Chain | Pool | 0xb50201558B00496A145fE76f7424749556E326D8 | All (all active libraries, and the implementation under proxy) |
| Gnosis Chain | Pool Configurator | 0x7304979ec9E4EaA0273b6A037a31c4e9e5A75D16 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Gnosis Chain | Oracle | 0xeb0a051be10228213BAEb449db63719d6742F7c4 | All (all per-asset feeds) |
| Gnosis Chain | ACL Manager | 0xEc710f59005f48703908bC519D552Df5B8472614 | Existing only |
| Gnosis Chain | Debt Swap Adapter | 0xE28E2c8d240dd5eBd0adcab86fbD79df7a052034 | Existing only |
| Gnosis Chain | RepayWithCollateralAdapter | 0x86b0521f92a554057e54B93098BA2A6Aaa2F4ACB | Existing only |
| Gnosis Chain | SwapCollateralAdapter | 0x63dfa7c09Dc2Ff4030d6B8Dc2ce6262BF898C8A4 | Existing only |
| Gnosis Chain | WETHGateway | 0x721B9abAb6511b46b9ee83A1aba23BDAcB004149 | Existing only |
| Gnosis Chain | StataTokenFactory | 0x33992721c565dA3248bd3af80524e054F5F05b42 | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Gnosis Chain | RateStrategy | 0x4cE496f0a390745102540faF041EF92FfD588b44 | Existing only |
| ZKSync Era | Pool Addresses Provider | 0x2A3948BB219D6B2Fa83D64100006391a96bE6cb7 | Existing Only |
| ZKSync Era | Pool | 0x78e30497a3c7527d953c6B1E3541b021A98Ac43c | All (all active libraries, and the implementation under proxy) |
| ZKSync Era | Pool Configurator | 0x0207d31b4377C74bEC37356aaD83E3dCc979F40E | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| ZKSync Era | Oracle | 0xC7F58Fca663a8d377B6D0c9703C697f56dC40088 | All (all per-asset feeds) |
| ZKSync Era | ACL Manager | 0xc6150b63c2F02528d4A969a248710A4658ed7928 | Existing only |
| ZKSync Era | WETHGateway | 0xAE2b00D676130Bdf22582781BbBA8f4F21e8B0ff | Existing only |
| ZKSync Era | RateStrategy | 0x57815Ab06D846d7dECd326Ee541CD06144FED237 | Existing only |
| Scroll | Pool Addresses Provider | 0x69850D0B276776781C063771b161bd8894BCdD04 | Existing Only |
| Scroll | Pool | 0x11fCfe756c05AD438e312a7fd934381537D3cFfe | All (all active libraries, and the implementation under proxy) |
| Scroll | Pool Configurator | 0x32BCab42a2bb5AC577D24b425D46d8b8e0Df9b7f | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Scroll | Oracle | 0x04421D8C506E2fA2371a08EfAaBf791F624054F3 | All (all per-asset feeds) |
| Scroll | ACL Manager | 0x7633F981D87dC6307227de9383D2ce7243158081 | Existing only |
| Scroll | WETHGateway | 0xE79Ca44408Dae5a57eA2a9594532f1E84d2edAa4 | Existing only |
| Scroll | StataTokenFactory | 0x01cfB64B99f717d791260ECb502e675d6E8Cf522 | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Scroll | RateStrategy | 0xC37353E5766164D8654D3CB395acfDcA4c2E7Ddc | Existing only |
| Sonic | Pool Addresses Provider | 0x5C2e738F6E27bCE0F7558051Bf90605dD6176900 | Existing Only |
| Sonic | Pool | 0x5362dBb1e601abF3a4c14c22ffEdA64042E5eAA3 | All (all active libraries, and the implementation under proxy) |
| Sonic | Pool Configurator | 0x50c70FEB95aBC1A92FC30b9aCc41Bd349E5dE2f0 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Sonic | Oracle | 0xD63f7658C66B2934Bd234D79D06aEF5290734B30 | All (all per-asset feeds) |
| Sonic | ACL Manager | 0x3a790a47c4d531FD333FAD24f70B0ccb521B3b5A | Existing only |
| Sonic | Debt Swap Adapter | 0x2E549104c516b8657A7D888494DfbAbD7C70b464 | Existing only |
| Sonic | RepayWithCollateralAdapter | 0x5598BbFA2f4fE8151f45bBA0a3edE1b54B51a0a9 | Existing only |
| Sonic | SwapCollateralAdapter | 0x78F8Bd884C3D738B74B420540659c82f392820e0 | Existing only |
| Sonic | WETHGateway | 0x061D8e131F26512348ee5FA42e2DF1bA9d6505E9 | Existing only |
| Sonic | StataTokenFactory | 0xFeeb6FE430B7523fEF2a38327241eE7153779535 | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Sonic | RateStrategy | 0xdFf435BCcf782f11187D3a4454d96702eD78e092 | Existing only |
| Soneium | Pool Addresses Provider | 0x82405D1a189bd6cE4667809C35B37fBE136A4c5B | Existing Only |
| Soneium | Pool | 0xDd3d7A7d03D9fD9ef45f3E587287922eF65CA38B | All (all active libraries, and the implementation under proxy) |
| Soneium | Pool Configurator | 0x1607FCeEc8dEbA4d5Da66D620b2363066d025a02 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Soneium | Oracle | 0x20040a64612555042335926d72B4E5F667a67fA1 | All (all per-asset feeds) |
| Soneium | ACL Manager | 0x7635bFF69E52023aB76267ab1EFf63434cdCe458 | Existing only |
| Soneium | WETHGateway | 0x6376D4df995f32f308f2d5049a7a320943023232 | Existing only |
| Soneium | StataTokenFactory | 0x535b2f7C20B9C83d70e519cf9991578eF9816B7B | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Soneium | RateStrategy | 0x486C2D3F59E4d72f3cAa301a7eF19E3db657F5b0 | Existing only |
| Linea | Pool Addresses Provider | 0x89502c3731F69DDC95B65753708A07F8Cd0373F4 | Existing Only |
| Linea | Pool | 0xc47b8C00b0f69a36fa203Ffeac0334874574a8Ac | All (all active libraries, and the implementation under proxy) |
| Linea | Pool Configurator | 0x812E7c19421D9f41A6DDCF047d5cc2dE2Ca5Bfa2 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Linea | Oracle | 0xCFDAdA7DCd2e785cF706BaDBC2B8Af5084d595e9 | All (all per-asset feeds) |
| Linea | ACL Manager | 0xbf32c7dFC72b730967072B112927ca0de205dbb5 | Existing only |
| Linea | WETHGateway | 0x31A239f3e39c5D8BA6B201bA81ed584492Ae960F | Existing only |
| Linea | StataTokenFactory | 0xc25Da0Ddab750739d2500dfD4E31EB4E83622F54 | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Linea | RateStrategy | 0xB1532b76D054c9F9E61b25c4d91f69B4133E4671 | Existing only |
| Celo | Pool Addresses Provider | 0x9F7Cf9417D5251C59fE94fB9147feEe1aAd9Cea5 | Existing Only |
| Celo | Pool | 0x3E59A31363E2ad014dcbc521c4a0d5757d9f3402 | All (all active libraries, and the implementation under proxy) |
| Celo | Pool Configurator | 0x7567E3434CC1BEf724AB595e6072367Ef4914691 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Celo | Oracle | 0x1e693D088ceFD1E95ba4c4a5F7EeA41a1Ec37e8b | All (all per-asset feeds) |
| Celo | ACL Manager | 0x7a12dCfd73C1B4cddf294da4cFce75FcaBBa314C | Existing only |
| Celo | StataTokenFactory | 0x2b33073B94243304bCb4dfFA6b624afA5BAA414D | All (stataTokes deployed from the factory, and the implementation of those tokens under proxy) |
| Celo | RateStrategy | 0x8B62D241Bf59f40991DCd18531683156d7013355 | Existing only |
| Ethereum | stkAAVE | 0x4da27a545c0c5B758a6BA100e3a049001de870f5 | All (proxy and implementation) |
| Ethereum | stkABPT | 0xa1116930326D21fB917d5A27F1E9943A9595fb47 | All (proxy and implementation) |
| Ethereum | sGHO (legacy) | 0x1a88Df1cFe15Af22B3c4c783D4e6F7F9e0C1885d | All (proxy and implementation) |
| Ethereum | GHO token | 0x40D16FC0246aD3160Ccc09B8D0D3A2cD28aE6C2f | Existing only |
| Ethereum | GHO CCIP Token Pool | 0x06179f7C1be40863405f374E7f5F8806c728660A | All (proxy and implementation) |
| Ethereum | GHO FlashMinter facilitator | 0xb639D208Bcf0589D54FaC24E655C79EC529762B8 | Existing only |
| Ethereum | GSM USDC | 0xFeeb6FE430B7523fEF2a38327241eE7153779535 | All (proxy and implementation) |
| Ethereum | GSM USDT | 0x535b2f7C20B9C83d70e519cf9991578eF9816B7B | All (proxy and implementation) |
| Ethereum | GHO Direct Minter (Core) | 0x593B09afc075B3c326CE2AD7750888645BA8943d | All (proxy and implementation) |
| Ethereum | GHO Direct Minter (Prime) | 0x2cE01c87Fec1b71A9041c52CaED46Fc5f4807285 | All (proxy and implementation) |
| Base | GHO token | 0x6Bb7a212910682DCFdbd5BCBb3e28FB4E8da10Ee | All (proxy and implementation) |
| Base | GHO CCIP Token Pool | 0x98217A06721Ebf727f2C8d9aD7718ec28b7aAe34 | All (proxy and implementation) |
| Avalanche | GHO token | 0xfc421aD3C883Bf9E7C4f42dE845C4e4405799e73 | All (proxy and implementation) |
| Avalanche | GHO CCIP Token Pool | 0xDe6539018B095353A40753Dc54C91C68c9487D4E | All (proxy and implementation) |
| Arbitrum | GHO token | 0x7dfF72693f6A4149b17e7C6314655f6A9F7c8B33 | All (proxy and implementation) |
| Arbitrum | GHO CCIP Token Pool | 0xB94Ab28c6869466a46a42abA834ca2B3cECCA5eB | All (proxy and implementation) |
| Ethereum | Umbrella core | 0xD400fc38ED4732893174325693a63C30ee3881a8 | All (proxy and implementation, and all stake tokens deployed from it being factory) |
| Ethereum | Umbrella RewardsController | 0x4655Ce3D625a63d30bA704087E52B4C31E38188B | All (proxy and implementation) |
| Ethereum | PermissionedPayloadsController (rewards) | 0xF86F77F7531B3374274E3f725E0A81D60bC4bB67 | All (proxy and implementation) |
| Ethereum | Permissioned Executor (rewards) | 0x2759de67aD133C747C9f41d56F1b8A343cE679a1 | Existing only |
| Ethereum | Governance core | 0x9AEE0B04504CeF83A65AC3f0e838D0593BCb2BC7 | All (proxy and implementation, and all voting portals) |
| Ethereum | Cross Chain Controller | 0xEd42a7D8559a463722Ca4beD50E0Cc05a386b0e1 | All (proxy and implementation, and all active bridges’ adapters) |
| Ethereum | Payloads Controller | 0xdAbad81aF85554E9ae636395611C58F7eC1aAEc5 | All (proxy and implementation) |
| Ethereum | Executor lvl1 | 0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A | All (proxy and implementation) |
| Ethereum | Executor lvl2 | 0x17Dd33Ed0e3dD2a80E37489B8A63063161BE6957 | All (proxy and implementation) |
| Ethereum | Voting Machine | 0x06a1795a88b82700896583e123F46BE43877bFb6 | All (all contract active and connected to it, like the voting strategy or the data warehouse) |
| Polygon PoS | Cross Chain Controller | 0xF6B99959F0b5e79E1CC7062E12aF632CEb18eF0d | All (proxy and implementation, and all active bridges’ adapters) |
| Polygon PoS | Payloads Controller | 0x401B5D0294E23637c18fcc38b1Bca814CDa2637C | All (proxy and implementation) |
| Polygon PoS | Executor lvl1 | 0xDf7d0e6454DB638881302729F5ba99936EaAB233 | All (proxy and implementation) |
| Polygon PoS | Voting Machine | 0x44c8b753229006A8047A05b90379A7e92185E97C | All (all contract active and connected to it, like the voting strategy or the data warehouse) |
| Avalanche C-Chain | Cross Chain Controller | 0x27FC7D54C893dA63C0AE6d57e1B2B13A70690928 | All (proxy and implementation, and all active bridges’ adapters) |
| Avalanche C-Chain | Payloads Controller | 0x1140CB7CAfAcC745771C2Ea31e7B5C653c5d0B80 | All (proxy and implementation) |
| Avalanche C-Chain | Executor lvl1 | 0x3C06dce358add17aAf230f2234bCCC4afd50d090 | All (proxy and implementation) |
| Avalanche C-Chain | Voting Machine | 0x4D1863d22D0ED8579f8999388BCC833CB057C2d6 | All (all contract active and connected to it, like the voting strategy or the data warehouse) |
| Optimism | Cross Chain Controller | 0x48A9FE90bce5EEd790f3F4Ce192d1C0B351fd4Ca | All (proxy and implementation, and all active bridges’ adapters) |
| Optimism | Payloads Controller | 0x0E1a3Af1f9cC76A62eD31eDedca291E63632e7c4 | All (proxy and implementation) |
| Optimism | Executor lvl1 | 0x746c675dAB49Bcd5BB9Dc85161f2d7Eb435009bf | All (proxy and implementation) |
| Arbitrum | Cross Chain Controller | 0xCbFB78a3Eeaa611b826E37c80E4126c8787D29f0 | All (proxy and implementation, and all active bridges’ adapters) |
| Arbitrum | Payloads Controller | 0x89644CA1bB8064760312AE4F03ea41b05dA3637C | All (proxy and implementation) |
| Arbitrum | Executor lvl1 | 0xFF1137243698CaA18EE364Cc966CF0e02A4e6327 | All (proxy and implementation) |
| Base | Cross Chain Controller | 0x529467C76f234F2bD359d7ecF7c660A2846b04e2 | All (proxy and implementation, and all active bridges’ adapters) |
| Base | Payloads Controller | 0x2DC219E716793fb4b21548C0f009Ba3Af753ab01 | All (proxy and implementation) |
| Base | Executor lvl1 | 0x9390B1735def18560c509E2d0bc090E9d6BA257a | All (proxy and implementation) |
| BNB Chain | Cross Chain Controller | 0x9d33ee6543C9b2C8c183b8fb58fB089266cffA19 | All (proxy and implementation, and all active bridges’ adapters) |
| BNB Chain | Payloads Controller | 0xE5EF2Dd06755A97e975f7E282f828224F2C3e627 | All (proxy and implementation) |
| BNB Chain | Executor lvl1 | 0x9390B1735def18560c509E2d0bc090E9d6BA257a | All (proxy and implementation) |
| Metis | Cross Chain Controller | 0x6fDaFb26915ABD6065a1E1501a37Ac438D877f70 | All (proxy and implementation, and all active bridges’ adapters) |
| Metis | Payloads Controller | 0x2233F8A66A728FBa6E1dC95570B25360D07D5524 | All (proxy and implementation) |
| Metis | Executor lvl1 | 0x6fD45D32375d5aDB8D76275A3932c740F03a8718 | All (proxy and implementation) |
| Gnosis | Cross Chain Controller | 0x8Dc5310fc9D3D7D1Bb3D1F686899c8F082316c9F | All (proxy and implementation, and all active bridges’ adapters) |
| Gnosis | Payloads Controller | 0x9A1F491B86D09fC1484b5fab10041B189B60756b | All (proxy and implementation) |
| Gnosis | Executor lvl1 | 0x1dF462e2712496373A347f8ad10802a5E95f053D | All (proxy and implementation) |
| ZKSync Era | Cross Chain Controller | 0x800813f4714BC7A0a95310e3fB9e4f18872CA92C | All (proxy and implementation, and all active bridges’ adapters) |
| ZKSync Era | Payloads Controller | 0x2E79349c3F5e4751E87b966812C9E65E805996F1 | All (proxy and implementation) |
| ZKSync Era | Executor lvl1 | 0x04cE39789e11a49595cD0ECEf6f4Bd54ABF4d020 | All (proxy and implementation) |
| Scroll | Cross Chain Controller | 0x03073D3F4769f6b6604d616238fD6c636C99AD0A | All (proxy and implementation, and all active bridges’ adapters) |
| Scroll | Payloads Controller | 0x6b6B41c0f8C223715f712BE83ceC3c37bbfDC3fE | All (proxy and implementation) |
| Scroll | Executor lvl1 | 0xc1ABF87FfAdf4908f4eC8dc54A25DCFEabAE4A24 | All (proxy and implementation) |
| Sonic | Cross Chain Controller | 0x58e003a3C6f2Aeed6a2a6Bc77B504566523cb15c | All (proxy and implementation, and all active bridges’ adapters) |
| Sonic | Payloads Controller | 0x0846C28Dd54DEA4Fd7Fb31bcc5EB81673D68c695 | All (proxy and implementation) |
| Sonic | Executor lvl1 | 0x7b62461a3570c6AC8a9f8330421576e417B71EE7 | All (proxy and implementation) |
| Soneium | Cross Chain Controller | 0xD92b37a5114b33F668D274Fb48f23b726a854d6E | All (proxy and implementation, and all active bridges’ adapters) |
| Soneium | Payloads Controller | 0x44D73D7C4b2f98F426Bf8B5e87628d9eE38ef0Cf | All (proxy and implementation) |
| Soneium | Executor lvl1 | 0x47aAdaAE1F05C978E6aBb7568d11B7F6e0FC4d6A | All (proxy and implementation) |
| Linea | Cross Chain Controller | 0x0D3f821e9741C8a8Bcac231162320251Db0cdf52 | All (proxy and implementation, and all active bridges’ adapters) |
| Linea | Payloads Controller | 0x3BcE23a1363728091bc57A58a226CF2940C2e074 | All (proxy and implementation) |
| Linea | Executor lvl1 | 0x8c2d95FE7aeB57b86961F3abB296A54f0ADb7F88 | All (proxy and implementation) |
| Celo | Cross Chain Controller | 0x50F4dAA86F3c747ce15C3C38bD0383200B61d6Dd | All (proxy and implementation, and all active bridges’ adapters) |
| Celo | Payloads Controller | 0xE48E10834C04E394A04BF22a565D063D40b9FA42 | All (proxy and implementation) |
| Celo | Executor lvl1 | 0x1dF462e2712496373A347f8ad10802a5E95f053D | All (proxy and implementation) |
| Ethereum | AAVE Ecosystem Reserve | 0x25F2226B597E8F9514B3F68F00f494cF4f286491 | All (proxy and implementation) |
| Ethereum | Aave Swapper | 0x3ea64b1C0194524b48F9118462C8E9cd61a243c7 | All (proxy and implementation) |
| Ethereum | ProxyAdmin (long) | 0x86C3FfeE349A7cFf7cA88C449717B1b133bfb517 | All (proxy and implementation) |
| Ethereum | ProxyAdmin | 0xD3cF979e676265e4f6379749DECe4708B9A22476 | All (proxy and implementation) |
| Polygon PoS | ProxyAdmin | 0xD3cF979e676265e4f6379749DECe4708B9A22476 | All (proxy and implementation) |
| Avalanche C-Chain | ProxyAdmin | 0xD3cF979e676265e4f6379749DECe4708B9A22476 | All (proxy and implementation) |
| Optimism | ProxyAdmin | 0xD3cF979e676265e4f6379749DECe4708B9A22476 | All (proxy and implementation) |
| Arbitrum | ProxyAdmin | 0xD3cF979e676265e4f6379749DECe4708B9A22476 | All (proxy and implementation) |
| Base | ProxyAdmin | 0xc85b1E333aecc99340b2320493Fe2d22b8734795 | All (proxy and implementation) |
| BNB Chain | ProxyAdmin | 0x39EBFfc7679c62Dfcc4A3E2c09Bcb0be255Ae63c | All (proxy and implementation) |
| Metis | ProxyAdmin | 0x1CabD986cBAbDf12E00128DFf03C80ee62C4fd97 | All (proxy and implementation) |
| Gnosis Chain | ProxyAdmin | 0xe892E40C92c2E4D281Be59b2E6300F271d824E75 | All (proxy and implementation) |
| ZKSync Era | ProxyAdmin | 0x158d6c497317367CEa3CBAb0BD84E6de236F060D | All (proxy and implementation) |
| Scroll | ProxyAdmin | 0x782559e349b084bB7C07c08404aE6E3436cDAE2E | All (proxy and implementation) |
| Linea | ProxyAdmin | 0x160E35e28fEE90F3656420584e0a990276219b5A | All (proxy and implementation) |
| Celo | ProxyAdmin | 0x54BDcc37c4143f944A3EE51C892a6cBDF305E7a0 | All (proxy and implementation) |
| Ethereum | Addresses Provider (v2) | 0xB53C1a33016B2DC2fF3653530bfF1848a515c8c5 | Existing only |
| Ethereum | Pool (v2) | 0x7d2768dE32b0b80b7a3454c06BdAc94A69DDc7A9 | All (all active libraries, and the implementation under proxy) |
| Ethereum | Pool Configurator (v2) | 0x311Bb771e4F8952E6Da169b425E7e92d6Ac45756 | All (aTokens and vTokens, whose proxy factory is the Pool Configurator on the initial listing. Also the implementation under proxy) |
| Ethereum | Oracle (v2) | 0xA50ba011c48153De246E5192C8f9258A2ba79Ca9 | All (all per-asset feeds) |
| Ethereum | RepayWithCollateralAdapter (v2) | 0x80Aca0C645fEdABaa20fd2Bf0Daf57885A309FE6 | Existing only |
| Ethereum | SwapCollateralAdapter (v2) | 0x135896DE8421be2ec868E0b811006171D9df802A | Existing only |
| Ethereum | WETHGateway (v2) | 0xa0d9C1E9E48Ca30c8d8C3B5D69FF5dc1f6DFfC24 | Existing only |
“All”: The Safe Harbor Agreement will cover both the subcontracts currently deployed under this contract and any future subcontracts deployed through it. This ensures that all present and future subcontracts are protected.
-
Contact Details: Designated security contact for Aave
-
Name: BGD Labs
-
Contact Information:
aave-security@bgdlabs.com
-
-
Bounty Terms: Predetermined rewards for successful whitehats that protect protocol funds
-
Bounty Percentage: 10% of recovered funds.
-
Bounty Cap (USD): $1M
-
Aggregate Bounty Cap (USD): $1M
-
Retainable: False
- This means that whitehats cannot retain their bounty directly from the recovered assets. Instead, all rescued funds must be returned to the protocol’s designated asset recovery address, and the bounty will be paid out separately afterwards.
-
Identity Verification: Named
- Whitehats may need to provide their full legal name. This requirement ensures compliance with legal obligations and is similar to the identity verification standards seen in traditional bug bounty programs.
-
Diligence Requirements: KYC & Global Sanction Verification
-
Aave may require all eligible whitehats to undergo Know Your Customer (KYC) verification and be screened against global sanctions lists, including OFAC, UK, and EU regulations. This process ensures that all bounty recipients are compliant with legal and regulatory standards before qualifying for payment.
-
In line with the ethos of Safe Harbor and Aave’s existing bug bounty practices, the DAO will avoid requesting KYC whenever possible to respect the anonymity of whitehats. However, KYC may still be required if deemed necessary during the due diligence process following an incident - for example, to validate eligibility for a reward or confirm compliance with legal obligations. If requested, this process will be completed within the 15-day post-incident review period.
-
Safe Harbor and the Aave Bug Bounty program are completely separate but mutually exclusive from a rewards perspective. A whitehat rewarded via the Bug Bounty program cannot receive a reward for the same exploit under Safe Harbor, even if Safe Harbor’s legal protections apply.
-
-
Note: The reward payment will be made from the funds of the Aave DAO treasury, not anyhow from from the rescued funds, which belong to the protocol’s users, not the DAO
Note: Reward denomination (stablecoins or other tokens) are sole discretion of the Aave DAO via the security coordinator, and following recommendations by treasury contributors. If the payment is partially or done in volatile assets (e.g., ETH or AAVE), the 30-day average price from the moment of the incident will be taken as reference.
Implementation Plan
-
Register Agreement On-Chain:
- The agreement will be registered on Ethereum in the Safe Harbor Registry at address
0x1eaCD100B0546E433fbf4d773109cAD482c34686, including all adoptionDetails. This ensures transparency and immutability.
- The agreement will be registered on Ethereum in the Safe Harbor Registry at address
-
Communicate Adoption:
- An official announcement will be made across all Aave communication channels, explaining the adoption and its significance to the community.
-
Future Updates to Scope:
- New versions of Aave will be reviewed and added to the Safe Harbor Agreement scope via Aave Governance vote, ensuring continued protection for all new contracts and functionalities.
Conclusion
Adopting the SEAL Whitehat Safe Harbor Agreement equips Aave with a rapid response mechanism for active exploits, enabling whitehats to step in effectively when needed most. The agreement provides clear guidelines for action, increasing the protection of user funds and demonstrating Aave’s commitment to proactive security.
References
-
SEAL Whitehat Safe Harbor Agreement Documentation: Framework
-
SEAL Whitehat Safe Harbor Agreement Legal Agreement: Link
-
Aave Bug Bounty: Aave’s Bug Bounty
Disclosures
The authors are not presenting this ARFC on behalf of any third party and are not compensated for creating it.
Next Steps
If this ARFC gets approved, the next step will be the on-chain voting by AAVE holders on the activation of the system on Ethereum.
Please share your thoughts and feedback in the discussion below before the proposal moves to a formal vote.