# \[ARFC\] Deploy Aave v3 on BOB

**URL:** https://governance.aave.com/t/arfc-deploy-aave-v3-on-bob/20544
**Category:** Governance
**Created:** [January 7, 2025, 4:52pm UTC](https://governance.aave.com/t/arfc-deploy-aave-v3-on-bob/20544 "2025-01-07T16:52:30Z")
**Posts on this page:** 1
**Page:** 2

<div class="post-metadata">

### Author: ![bgdlabs](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/bgdlabs/32/1829_2.png) [@bgdlabs](https://governance.aave.com/u/bgdlabs)
#### Post date: [October 24, 2025, 7:09am UTC](https://governance.aave.com/t/arfc-deploy-aave-v3-on-bob/20544/21 "2025-10-24T07:09:20Z")

</div>

# SolvBTC’s re-evaluation

Solv contacted us to re-evaluate the SolvBTC access control after implementing a Timelock contract as the new super admin.  
The following outlines the [key security concerns we previously raised](https://governance.aave.com/t/arfc-deploy-aave-v3-on-bob/20544/18) and details how the Solv team has addressed them.

  

## Security concerns

### **1. General system’s access control**

**Previous State:**

- _Access control was very centralized, distributed between EOA’s and Safe Wallets with low threshold._

**Current State:**

**Resolved**.

The Solv team has moved the most critical access control to the new [SolvTimelock](https://explorer.gobob.xyz/address/0xE7F5ECfB71Af23Ed73A9D47022642c80fAcB81A7), increasing the system security in terms of upgradability and other administrative tasks.

- **SolvTimelock overview** : _The SolvTimelock is a non-upgradable, using the OZ TimelockController role-based standard contract that enforces a delay before executing calls._

  

The following shows the updated access control risk table of the [OpenFundMarket](https://explorer.gobob.xyz/address/0xf5a247157656678398B08d3eFa1673358C611A3f) contract:

| **Previous Permission Owner** | **Current Permission Owner** | **functions** | **Criticality** | **Previous Risk** | **Current Risk** |
| --- | --- | --- | --- | --- | --- |
| [ProxyAdmin](https://explorer.gobob.xyz/address/0x23c4Eec3e1ccAF40e2dB1927ea8dFA6Feb7DF0E1) →[EOA (0x55C0…013E)](https://explorer.gobob.xyz/address/0x55C09707Fd7aFD670e82A62FaeE312903940013E) | [ProxyAdmin](https://explorer.gobob.xyz/address/0x23c4Eec3e1ccAF40e2dB1927ea8dFA6Feb7DF0E1) → [SolvTimelock](https://explorer.gobob.xyz/address/0xE7F5ECfB71Af23Ed73A9D47022642c80fAcB81A7) | upgrade, upgradeAndCall | **CRITICAL** | 🔴 | 🟢 |
| Admin: [Safe 3-of-5](https://explorer.gobob.xyz/address/0x0c2Bc4d2698820e12E6eBe863E7b9E2650CD5b7D) | Admin: [SolvTimelock](https://explorer.gobob.xyz/address/0xE7F5ECfB71Af23Ed73A9D47022642c80fAcB81A7) | setGovernorOnlyAdmin | **HIGH** | 🔴 | 🟢 |
| Governor: [EOA (0x55C0…013E)](https://explorer.gobob.xyz/address/0x55C09707Fd7aFD670e82A62FaeE312903940013E) | Governor: [SolvTimelock](https://explorer.gobob.xyz/address/0xE7F5ECfB71Af23Ed73A9D47022642c80fAcB81A7) | updatePoolInfoOnlyGovernor, setCurrencyOnlyGovernor, addSFTOnlyGovernor, removeSFTOnlyGovernor, setProtocolFeeOnlyGovernor, updateFundraisingEndTime | **HIGH** | 🔴 | 🟢 |
| Pool Managers: WBTC → [EOA (0x2e51…2BB0)](https://explorer.gobob.xyz/address/0x2e51F039Fc2de139af3D5A4bD6898d67C3442BB0) | Pool Managers: WBTC → [EOA (0x2e51…2BB0)](https://explorer.gobob.xyz/address/0x2e51F039Fc2de139af3D5A4bD6898d67C3442BB0) _MPC 2/3 Multisig_ | setWhiteList, closeCurrentRedeemSlot, removePool | **HIGH** | 🔴 | 🟡\* |
| subscribeNavManager: [Safe 1-of-3](https://explorer.gobob.xyz/address/0x538dB8BDD683b941d6Cee61d9a7a128D53c32522?tab=read_proxy) | subscribeNavManager: [Safe 3-of-5](https://explorer.gobob.xyz/address/0x538dB8BDD683b941d6Cee61d9a7a128D53c32522?tab=read_proxy) | setSubscribeNav | **HIGH** | 🔴 | 🟡 |
| redeemNavManager: [Safe 1-of-3](https://explorer.gobob.xyz/address/0x538dB8BDD683b941d6Cee61d9a7a128D53c32522?tab=read_proxy) | redeemNavManager: [Safe 3-of-5](https://explorer.gobob.xyz/address/0x538dB8BDD683b941d6Cee61d9a7a128D53c32522?tab=read_proxy) | setRedeemNav, updateFundraisingEndTime | **HIGH** | 🔴 | 🟡 |

\*_It is outside the scope of this analysis to evaluate MPC wallets since they cannot be distinguished from EOA wallets on-chain. However, we raised the risk to medium because the team confirmed it as an MPC wallet._

  

### [OpenFundRedemption](https://explorer.gobob.xyz/address/0xC20BA51fBB10fC596d0A5Ce4d7F4C7A7b26F2768?tab=contract_code)

The OpenFundRedemption is the contract for users to claim their requested redemptions. It is an OZ Beacon Proxy with a 2-step ownable for access control.

The following shows the updated access control risk table of the [OpenFundRedemption](https://explorer.gobob.xyz/address/0xC20BA51fBB10fC596d0A5Ce4d7F4C7A7b26F2768?tab=contract_code) contract:

| **Previous Permission Owner** | **Current Permission Owner** | **functions** | **Criticality** | **Previous Risk** | **Current Risk** |
| --- | --- | --- | --- | --- | --- |
| Admin → [BeaconFactory](https://explorer.gobob.xyz/address/0xaB86AA29c11f4071e6d576FFf5916b88b838BA91) → [EOA (0x55C0…013E)](https://explorer.gobob.xyz/address/0x55C09707Fd7aFD670e82A62FaeE312903940013E) | Admin → [BeaconFactory](https://explorer.gobob.xyz/address/0xaB86AA29c11f4071e6d576FFf5916b88b838BA91) → [SolvTimelock](https://explorer.gobob.xyz/address/0xE7F5ECfB71Af23Ed73A9D47022642c80fAcB81A7) | upgradeTo, setConcreteOnlyAdmin | **CRITICAL** | 🔴 | 🟢 |
| [OpenFundMarket](https://explorer.gobob.xyz/address/0xf5a247157656678398B08d3eFa1673358C611A3f) | [OpenFundMarket](https://explorer.gobob.xyz/address/0xf5a247157656678398B08d3eFa1673358C611A3f) | createSlotOnlyIssueMarket, setRedeemNavOnlyMarket | **HIGH** | 🟢 | 🟢 |

  

## Miscellaneous

- The SolvTimelock uses `TimelockController` standard from OpenZeppelin without changes. The security review of the OZ contracts can be found [here](https://github.com/OpenZeppelin/openzeppelin-contracts/tree/master/audits).

  

## Conclusion

After the improvements, SolvBTC has increased its security in terms of upgradability, and there are no major blockers for listing.

[Previous page](https://governance.aave.com/t/arfc-deploy-aave-v3-on-bob/20544.md?page=1)