# Certora - Monthly Update **URL:** \ **Category:** Governance\ **Created:** [December 3, 2024, 9:49am UTC](https://governance.aave.com/t/certora-monthly-update/20038 "2024-12-03T09:49:03Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [December 3, 2024, 9:49am UTC](https://governance.aave.com/t/certora-monthly-update/20038/1 "2024-12-03T09:49:03Z")
Hello, dear community πŸ‘‹ Following repeating requests and recommendations by members and to provide transparency, we’re returning to our good ways of periodically reporting our work for the benefit of the DAO. This thread is where you’ll find these reports. ### What To Expect Here #### Audit Reviews and Formal Verification We will post the projects we worked on along with the security report (if done) and the formal tests we’ve created. #### AIP Reviews We will share a high-level summary and simple statistics on the AIPs we reviewed. Our review process guarantees that: - Suggested payloads genuinely reflect the desired intention raised for voting - Potential implementation risks are identified and acted upon before execution - Emerged proposals followed the DAO’s formal process and adhered to the highest transparency standards #### Advancement Related to Development Efforts As we mentioned in our [renewal thread](https://governance.aave.com/t/arfc-aave-certora-continuous-security-services/19262/7), we are developing tools that will enable us to do our work better and can be of interest to the DAO. Since these developments are not part of the engagement and are developed on a best-effort basis, we will update only on significant releases that aren’t too technical and from which we think the DAO benefits. #### Misc Any involvement that isn’t included in the previous sections and may include: - Actions related to us having guardian role(s) - Involvement in incident response - **Only if and after details are already public** ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [December 3, 2024, 9:57am UTC](https://governance.aave.com/t/certora-monthly-update/20038/2 "2024-12-03T09:57:13Z")
# September - November 2024 ## Executive Summary In the last Quarter, Certora has continued to safeguard the Aave ecosystem through code reviews, rigorous formal verification, and proactive security measures. πŸ‘€ Total proposals reviewed: **53** βœ… Proposals approved: **52** ✍ Proposals rejected/modified: **9** ❌ Issues requiring proposal cancellation: **1** βš’ Proposals required actions other than cancellation: **8** ### Audit Reviews and Formal Verification πŸ“œ Total smart contracts reviewed: **74** πŸ•΅ Projects reviewed: **7** 1. **ParaSwapAdapter patch** 2. **V3.2 - Liquid eMode - [Link to Security Report](https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-09-19_Certora_Aave-v3.2_Liquid_eModes.pdf)** 3. **V3.2.1 - StableDebt Token Getter For Integrator** 4. **EzETH oracle - [Link to Security Report](https://governance.aave.com/t/arfc-onboard-ezeth-to-aave-v3-lido-instance/18504/12)** 5. **CrossChain Gho Token Upgrade to CCIP V1.5** 6. **CrossChain Gho Token Upgrade to CCIP V1.5 AIP** 7. **V3.3 - Deficit Assuming and Handling - Report in Progress** ---
**Author:** ![midapple](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/midapple/32/5221_2.png) [@midapple](https://governance.aave.com/u/midapple)\ **Post date:** [December 30, 2024, 9:20pm UTC](https://governance.aave.com/t/certora-monthly-update/20038/3 "2024-12-30T21:20:39Z")
Do you have links to the proposals that were rejected/modified/cancelled? ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [December 31, 2024, 10:02am UTC](https://governance.aave.com/t/certora-monthly-update/20038/4 "2024-12-31T10:02:54Z")
# December 2024 ## πŸŽΆβ„ Certora’s Holiday Cheer β„πŸŽΆ We wish the Aave fam so dear, Happy holidays, full of cheer! DeFi never takes a rest, And neither do weβ€”always our best. Through December, we’ve stayed on track, Safeguarding Aave, we’ve got your back. Code reviews and formal checks, Keeping security free from hacks. Here’s to success and spreading cheer, With Aave strong through every year! πŸŽ„πŸŽπŸ§πŸ§‘β€πŸŽ„πŸ·β„ ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **15** βœ… Proposals approved: **14** ✍ Proposals rejected/modified: **1** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **2** ### Code Reviews Completed πŸ“œ Total smart contracts reviewed: **31** πŸ•΅ Projects reviewed: **3** 1. **V3.3 - Deficit Assuming and Handling** β€” The review is finished after a second iteration. The report will be released soon. 2. **GhoDirectMinter** - [Link to Security Report](https://github.com/bgd-labs/GhoDirectMinter/blob/main/audits/Gho-Direct-Minter-Certora-Audit.pdf) 3. **Gho CCIP Token Pool Upgrade + Upgrade AIP** - review in progress ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [December 31, 2024, 10:47am UTC](https://governance.aave.com/t/certora-monthly-update/20038/5 "2024-12-31T10:47:58Z")
Hey @midapple, thanks for your question. We’re referring to AIP 165, 173-175, 177, 182, 204, 205, 212. You can browse and read the AIPs here: > **[Aave Governance](https://vote.onaave.com/)** > > List of governance proposals ---
**Author:** ![system](https://europe1.discourse-cdn.com/flex013/uploads/aave/original/2X/e/e11637c36f45ffa158f2146f5c19438d46e0824d.svg) [@system](https://governance.aave.com/u/system)\ **Post date:** [January 30, 2025, 10:48am UTC](https://governance.aave.com/t/certora-monthly-update/20038/6 "2025-01-30T10:48:28Z")
Closed on January 30, 2025, 10:48am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed. ---
**Author:** ![EzR3aL](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/ezr3al/32/10721_2.png) [@EzR3aL](https://governance.aave.com/u/EzR3aL)\ **Post date:** [January 31, 2025, 9:21am UTC](https://governance.aave.com/t/certora-monthly-update/20038/7 "2025-01-31T09:21:57Z")
Opened on January 31, 2025, 9:21am UTC ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [February 2, 2025, 5:04pm UTC](https://governance.aave.com/t/certora-monthly-update/20038/8 "2025-02-02T17:04:03Z")
# January 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **13** βœ… Proposals approved: **13** ✍ Proposals rejected/modified: **0** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **0** ### Code Reviews Completed πŸ“œ Total smart contracts reviewed: **12** πŸ•΅ Projects reviewed: **5** 1. **Gho CCIP Token Pool Upgrade (1.5.1) + Upgrade AIP** - The review was started in [December](https://governance.aave.com/t/certora-monthly-update/20038/4) and finished this month - [Link to Security Report](https://github.com/aave/ccip/blob/ccip-gho/contracts/src/v0.8/ccip/pools/GHO/audits/2024-12-24_GHO-CCIP-TokenPools_Certora.pdf) 2. **Umbrella Stake Token** – The review is finished. The report will be released soon along with the code. 3. **Gho CCIP Deployment on Avalanche** 4. **Collector operational upgrade + Upgrade AIP** – [Link to Security Report](https://github.com/aave-dao/aave-v3-origin/blob/kptk/new-collector/audits/2025-01-20_Certora_CollectorRev6.pdf) 5. **TransperentProxy Upgrade** 6. **Umbrella Rewards** – Review in Progress ### Development Announcement We are happy to announce we published and open-sourced [Quorum](https://github.com/Certora/Quorum) - an agile validation tool developed and used internally by our AIP reviewers to improve the efficiency and consistency of reviews. [An introductory blog post to Quorum](https://www.certora.com/blog/quorum-dao-governance-security) [A summary thread on Twitter](https://x.com/CertoraInc/status/1885020941840723970) We call involved community members who perform independent proposal reviews to collaborate with us on improving the tool by submitting feature requests. Help us make Aave decision-making the most secure process in DeFi! ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [March 3, 2025, 2:58pm UTC](https://governance.aave.com/t/certora-monthly-update/20038/9 "2025-03-03T14:58:38Z")
# February 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **21** βœ… Proposals approved: **20** ✍ Proposals rejected/modified: **2** ❌ Issues requiring proposal cancellation: **1** βš’ Proposals required actions other than cancellation: **2** ### Code Reviews Completed πŸ“œ Total smart contracts reviewed: **18** πŸ•΅ Projects reviewed: **5** 1. **Last Updates To Core V3.3** β€” A few last modifications to the V3.3 core code before commencing preparation for pool upgrade. The conclusions were amended to the V3.3 report - [Link to Security Report](https://github.com/aave-dao/aave-v3-origin/blob/main/audits/2024-11-07_Certora_Aave-v3.3.0.pdf) 2. **Umbrella Rewards** β€” The review is finished after a second iteration. The report will be released soon along with the code. 3. **Umbrella** β€” The review is finished after a second iteration. The report will be released soon along with the code. 4. **Clinic Steward** β€” [Link to Security Report](https://github.com/bgd-labs/aave-stewards/blob/main/audits/2025_02_17_ClinicSteward_Certora.pdf) 5. **Pool Exposure Steward** β€” The review is finished. The report will be released soon along with the code. 6. **Umbrella Rewards Amended Functionality + Helper Contracts** - in progress ### Independent Research - We performed a directed research effort focused on a specific section of the Aave core. Conclusions with concrete suggestions were submitted to BGD for evaluation. ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [April 1, 2025, 8:26am UTC](https://governance.aave.com/t/certora-monthly-update/20038/10 "2025-04-01T08:26:39Z")
# March 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **22** βœ… Proposals approved: **21** ✍ Proposals rejected/modified: **1** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **2** 🚨Notes - AIP 264 was approved by all parties involved in governance security, including ourselves. After execution, the proposal was found to contain a collision with AIP 263, which created an unintended grouping of assets in the same e-mode. After attending to the problem and resolving it in collaboration with the relevant providers, we performed a post-mortem along with @bgdLabs and concluded improvements that will strengthen the overall security process of the governance. More details on the incident can be found [in BGD’s post](https://governance.aave.com/t/arfc-onboard-rseth-to-arbitrum-and-base-v3-instances/20741/9) - On AIP 267 we identified a misconfiguration and reported to the relevant entities. The decision was to not cancel the proposal, but instead, resolve it using the steward. Official announcement on the subject can be found [here](https://governance.aave.com/t/arfc-deploy-statausdc-and-statausdt-gsms-on-ethereum/20682/8) ### Code Reviews Completed πŸ“œ Total smart contracts reviewed: **36** πŸ•΅ Projects reviewed: **4** 1. **The Complete Umbrella Component (Stake Token, Umbrella Rewards and Umbrella)** – The manual review was finished in February, however, in March we completed our formal verification for the project. [Link to Security Reports](https://github.com/aave-dao/aave-umbrella/tree/main/audits/Certora), [Formal Specifications](https://github.com/aave-dao/aave-umbrella/tree/main/certora/specs) 2. **Umbrella Helper Contracts** - The review started in February and finished on March - [Link to Security Report](https://github.com/aave-dao/aave-umbrella/blob/main/audits/Certora/Certora_UmbrellaBatchHelper_Report.pdf) 3. **SVR Steward** – [Link to Security Report](https://github.com/bgd-labs/aave-stewards/blob/main/audits/2025_03_10_SvrOracleSteward_Certora.pdf) 4. **Revenue Splitter** – Review was submitted and now awaits a second iteration following our feedback. 5. **Pendle CAPO** – The review is finished. The report will be released soon along with the code. 6. **Pool V3.4** - Review in Progress ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [May 4, 2025, 10:33am UTC](https://governance.aave.com/t/certora-monthly-update/20038/11 "2025-05-04T10:33:16Z")
# April 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **21** βœ… Proposals approved: **21** ✍ Proposals rejected/modified: **0** ❌ Issues requiring proposal cancellation: **1** βš’ Proposals required actions other than cancellation: **0** 🚨Notes - One of AIP 299’s payloads was found to be misconfigured by BGD post-deployment. Together with BGD we verified that partial cancellation of the proposal (1/3 payloads) isn’t creating any security issues and worked to cancel the misconfigured payload. ### Code Reviews Completed πŸ“œ Total smart contracts reviewed: **34** πŸ•΅ Projects reviewed: **3** 1. **Pool V3.4** - The review is finished. The report will be released soon along with the code. 2. **Risk Steward Additional Functionalities** - [Link to Security Report](https://github.com/aave-dao/aave-v3-risk-stewards/blob/901b3dc1601c4c4b190ed6eac980e7e1c7b1ed54/audits/20-04-2025-Certora_AaveV3-Risk-Steward.pdf) 3. **Operational Payloads Controller** - The review is finished. The report will be released soon along with the code. ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [July 1, 2025, 10:13am UTC](https://governance.aave.com/t/certora-monthly-update/20038/12 "2025-07-01T10:13:47Z")
# May - June 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **31** βœ… Proposals approved: **30** ✍ Proposals rejected/modified: **1** ❌ Issues requiring proposal cancellation: **1** βš’ Proposals required actions other than cancellation: **5** ### Code Reviews Completed πŸ•΅ Projects reviewed: **4** 1. **Pool V3.5** - Review in progress. 2. **Pool V3.4 - Re-audit** - The review is finished. The report will be released soon along with the code. 3. **Pool V3.4 Activation AIP** - The review is finished. The report will be released soon along with the code. 4. **Swap Steward** - The review is finished. The report will be released soon along with the code. ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [August 3, 2025, 10:59am UTC](https://governance.aave.com/t/certora-monthly-update/20038/13 "2025-08-03T10:59:01Z")
# July 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **16** βœ… Proposals approved: **16** ✍ Proposals rejected/modified: **0** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **1** ### Code Reviews Completed πŸ•΅ Projects reviewed: **3** 1. **Pool V3.5** - The review is finished. [Link to Security Report](https://github.com/aave-dao/aave-v3-origin/blob/v3.5.0/audits/2025-07-14_Certora_AaveV3.5.pdf) 2. **Remote GSM** - The review is finished. The report will be released soon along with the code. 3. **Permissioned Payload Controller V1.0.1** - The review is finished. The report will be released soon along with the code. ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [September 4, 2025, 2:55pm UTC](https://governance.aave.com/t/certora-monthly-update/20038/14 "2025-09-04T14:55:42Z")
# August 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **14** βœ… Proposals approved: **14** ✍ Proposals rejected/modified: **0** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **1** ### Code Reviews Completed πŸ•΅ Projects reviewed: **4** 1. **Umbrella V1.0.1** - The review is finished. The report will be released soon, along with the code. 2. **RewardsSteward** - The review is finished. The report will be released soon, along with the code. 3. **Clinic Steward V2** - The review is finished. The report will be released soon, along with the code. 4. **Re-configuration of Core’s GhoDirectMinter** - The review is finished. [Link to the forum post with our review](https://governance.aave.com/t/technical-maintenance-proposals/15274/110) ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [October 2, 2025, 7:34pm UTC](https://governance.aave.com/t/certora-monthly-update/20038/15 "2025-10-02T19:34:55Z")
# September 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **14** βœ… Proposals approved: **14** ✍ Proposals rejected/modified: **0** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **1** ### Code Reviews Completed πŸ•΅ Projects reviewed: 5 1. **Aave GHO CCIP Bridge** - The review is finished. The report will be released soon, along with the code. 2. **sGHO Vault** - The review is finished. The report will be released soon, along with the code. - The sGHO contract is a typical ERC4626 implementation with a few modifications. Users deposit assets and get shares based on the current yield index. Over time, the yield index will grow based on the target rate set by the yield manager which allows users to receive more assets than deposited. The vault works on a first-come-first-served basis as the contract might not have enough GHO balance to support all withdrawals with their interest included. 1. **V2 deprecation** - The review is finished. The report will be released soon, along with the code. 2. **GSM signature encoding** - The review is finished. The report will be released soon, along with the code. 3. **CAPO Update** - The review is finished. The report will be released soon, along with the code. ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [November 3, 2025, 11:59am UTC](https://governance.aave.com/t/certora-monthly-update/20038/16 "2025-11-03T11:59:42Z")
# October 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **20** βœ… Proposals approved: **20** ✍ Proposals rejected/modified: **0** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **4** ### Code Reviews Completed πŸ•΅ Projects reviewed: **1** 1. **Aave v3.6** - The review started this month (October) and is expected to finish in the first week of November. The report will be released soon, along with the code. ---
**Author:** ![EzR3aL](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/ezr3al/32/10721_2.png) [@EzR3aL](https://governance.aave.com/u/EzR3aL)\ **Post date:** [November 30, 2025, 10:22am UTC](https://governance.aave.com/t/certora-monthly-update/20038/17 "2025-11-30T10:22:38Z")
Closed on November 30, 2025, 10:22am UTC This topic was automatically closed after 303 days. New replies are no longer allowed. ---
**Author:** ![EzR3aL](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/ezr3al/32/10721_2.png) [@EzR3aL](https://governance.aave.com/u/EzR3aL)\ **Post date:** [November 30, 2025, 10:53am UTC](https://governance.aave.com/t/certora-monthly-update/20038/18 "2025-11-30T10:53:26Z")
Opened on November 30, 2025, 10:53am UTC ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [December 1, 2025, 3:59pm UTC](https://governance.aave.com/t/certora-monthly-update/20038/19 "2025-12-01T15:59:10Z")
# November 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **16** βœ… Proposals approved: **15** ✍ Proposals rejected/modified: **1** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **3** ### Code Reviews Completed πŸ•΅ Projects reviewed: **1** 1. **Aave GHO on Aptos** - The review is finished. The report will be released soon, along with the code. ---
**Author:** ![Certora](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/certora/32/6230_2.png) [@Certora](https://governance.aave.com/u/Certora)\ **Post date:** [January 4, 2026, 4:49pm UTC](https://governance.aave.com/t/certora-monthly-update/20038/20 "2026-01-04T16:49:18Z")
# December 2025 ## Executive Summary ### Governance Proposal Reviews πŸ‘€ Total proposals reviewed: **10** βœ… Proposals approved: **10** ✍ Proposals rejected/modified: **0** ❌ Issues requiring proposal cancellation: **0** βš’ Proposals required actions other than cancellation: **1**