The composability of Aave V4 architecture represents a shift in how lending protocols can be structured. By introducing multiple primitives and more flexible parameter differentiation, the protocol moves away from a rigid, singular deployment model toward a modular Hub & Spoke design. This architecture allows for a variety of configurations, each presenting distinct trade-offs regarding capital efficiency, risk isolation, and systemic complexity.
At LlamaRisk, we have analyzed the potential configurations that this flexible infrastructure enables. The objective of this analysis is not to predict the final implementation of Aave V4 but to map the theoretical design space available to the protocol. This ensures that governance participants and stakeholders understand the implications of how liquidity, risk, and asset integration can be organized. The following sections detail four unique architectural model choices, the strategic role of Hub-to-Spoke credit lines, and the expansion of the modularity through generalized utility spokes.
The Fundamental Shift: From Monolithic to Modular
In previous iterations of the protocol, liquidity was pooled into a single pool or a strictly disjoint set of pools (different instances on the same chain). While this maximized liquidity depth, it also meant that the entire protocol shared a unified risk profile. If a single asset within the pool experienced a catastrophic failure, the contagion could theoretically affect all stablecoin depositors. The V4 architecture introduces the concept of a “Hub”—a liquidity container—and “Spokes”—functional modules that interact with that liquidity.
This separation allows for the creation of multiple Hubs, each governed by different risk parameters, operated by different entities, or dedicated to specific asset classes. The core question for protocol architects and governance is how to arrange Hubs, Spokes, and Credit Lines to balance the competing needs of safety, growth, and efficiency.
Model A: The Monolithic Hub (Enhanced V3 Model)
The first and most familiar model is the Monolithic Hub. In this configuration, the protocol maintains a single, primary Hub where the vast majority of protocol liquidity and assets reside. All functional Spokes draw from this unified pool, either directly or by tapping into the liquidity via Credit Lines. This model is essentially an evolution of the Aave V3 paradigm but rebuilt on the V4 infrastructure.
Note: Specific assets/issuers are mentioned for illustrative purposes only.
From a liquidity perspective, Model A offers the highest degree of efficiency. By pooling all assets into a centralized Hub, the protocol avoids fragmentation. Borrowers can access the full range of strategies, which tends to stabilize interest rates and reduce utilization spikes. For lenders, a unified pool generally offers the most consistent yield generation, as capital is not stranded in underutilized pockets of the system.
However, the primary drawback of the Monolithic Hub is the concentration of risk. Because all assets coexist within the same liquidity bucket, there is no structural isolation. If a long-tail asset listed in the Monolithic Hub were to suffer a critical exploit or a total collapse in value that exceeded risk parameters, the solvency of the entire pool could be threatened. In this model, Umbrella—the protocol’s safety module—must cover the entire system. This necessitates a conservative approach to asset listing and draw caps setup. To protect the collective liquidity and make all assets share a similar risk profile, governance must reject assets that introduce excessive volatility or centralization risk, effectively restricting the protocol’s ability to service newer, more experimental markets that may have higher demand but an unjustifiable risk profile.
Nonetheless, additional levers arrive with Aave v4 to introduce better risk differentiation:
- Risk Premium, which ensures that higher-risk strategies bring incremental revenues to the LPs, boosting overall attractiveness of deposits and potentially even subsidizing the low-margin nature of bluechip asset- related borrowing strategies;
- Credit Lines, which enable any isolated Hub to subsidize other non-connected Spokes to tap into the liquidity, specifically necessary during the bootstrapping phase of new markets and strategies. This allows a temporary, strictly defined liquidity allocation in cases where asset listing on the Main Hub would not be justifiable from the risk perspective.
Model B: Risk-Profiled Hubs (Segregation by Risk-Return)
Model B represents a reimagination of the protocol, shifting it closer to a platform of distinct credit funds. In this arrangement, the protocol is divided into multiple, distinct Hubs, each catering to a specific risk profile. For example, the system could feature a Low-Risk Hub focused on bluechip assets tranches, a High-Yield Hub accepting slightly riskier borrowing strategies, and a High-Risk Hub designed for volatile or emerging assets that are of the highest risk.
Note: Specific assets/issuers are mentioned for illustrative purposes only.
The defining characteristic of this model is risk isolation. Each Hub operates with its own independent liquidity and, crucially, potentially its own dedicated Umbrella module. A catastrophic failure in the High-Risk Hub would have no direct financial impact on the liquidity or safety of the Low-Risk Hub. This separation allows users to self-select their risk exposure. A risk-averse depositor can supply liquidity solely to the Low-Yield Hub, confident that their funds are not exposed to the volatility of speculative assets.
This model allows for targeted parameterization. Risk managers can tailor collateral efficiency parameters and interest rate curves specifically for the risk profile of each Hub. However, this segregation comes at the cost of liquidity fragmentation. Splitting liquidity into multiple distinct pools results in shallower markets for each. This can lead to increased interest rate volatility and reduced capital efficiency compared to the monolithic model. Furthermore, the viability of the Umbrella becomes a challenge for higher-risk Hubs. While a Low-Yield Hub acts similarly to the current Umbrella module for the V3’s Core market, attracting stakers to backstop a High-Risk Hub would likely require extremely high premiums, potentially making the economics of such a Hub unsustainable.
In order to solve the liquidity bootstrapping problem, a waterfall of credit lines could be created, each strictly limiting the maximal possible exposure to lower tranches. That way, even if liquidity of the Low-Risk Hub indirectly flows to the High-Risk Hub, the bad debt risk is exponentially smaller, covered by the Umbrella module of the intermediate risk tranche.
Model C: Asset-Centric Hubs (Segregation by Asset Profile)
Taking the concept of segregation further, Model C organizes Hubs not by risk level but by asset category or ecosystem. This model foresees highly specialized Hubs, each dedicated to a specific asset type or strategy, such as RWAs, specific stablecoin ecosystems (like an Ethena Hub), or LSTs. Each Hub functions as a standalone market with its own liquidity and potentially its own (or shared) Umbrella module. Effectively, it is a more granularly split representation of Aave’s current ecosystem, together with a Prime market instance targeting ETH-correlated borrows, the Horizon instance targeting RWAs, and other white-label instances focusing on a small subset of asset types.
Note: Specific assets/issuers are mentioned for illustrative purposes only.
The primary advantage of Asset-Centric Hubs is the ability to facilitate permissionless innovation and ecosystem integration. New asset types can be onboarded rapidly within their own isolated environments without requiring a risk reassessment for the entire protocol. This can foster a deeper partnership approach, allowing external protocols to have a dedicated, Aave-powered credit market for their assets. It allows the protocol to serve as infrastructure for distinct financial ecosystems without exposing one central Hub to their idiosyncratic risks.
However, Model C suffers from “Null Internal Diversification.” Within a Hub dedicated to a single asset class or protocol, risk is highly concentrated. For instance, in a Hub dedicated entirely to a specific stablecoin ecosystem, a de-peg event would likely wipe out the entire Hub, as all collateral and borrow demand are correlated. Additionally, capitalizing an Umbrella for a single-asset Hub is exceptionally difficult. Backstopping such a Hub effectively needs an isolated risk perception of that specific asset class, which may also demand high risk premiums, hence higher borrow rates. Creation of shared Umbrella modules for multiple Hubs would be possible with the assumption that the risk profile would be balanced between the covered Hubs. Finally, a proliferation of asset-specific Hubs creates complexity for the user experience, requiring lenders to perform due diligence on dozens of individual Hubs rather than a single central liquidity Hub.
Model D: The Hybrid Model
The models described above are not mutually exclusive and can be constructed in conjunction. For example, Model D proposes a hybrid approach that combines the stability of a monolithic core with the flexibility of isolated, satellite spokes. In this configuration, the protocol maintains a primary Main (Low-Risk) Hub (similar to Models A & B) focused on top-tier, blue-chip assets with the highest liquidity and security. This serves as the foundation of the protocol.
Note: Specific assets/issuers are mentioned for illustrative purposes only.
Alongside this core, the architecture enables the creation of specialized satellite Hubs. These function as sandboxed environments for specific ecosystem integrations or assets with unique risk profiles. This structure preserves the benefits of a unified protocol—deep liquidity for major assets—while allowing for expansion into new markets without compromising the solvency of the main pool.
The interaction between these layers is key. The Main Hub can act as a senior lender, cautiously extending credit lines to select satellite Spokes connected to separate Hubs. This allows the Main Hub to generate additional yield while maintaining a conservative primary risk profile, effectively separating the stable core from the higher-than-benchmark risk exposure, albeit at a cost of higher liquidity fragmentation. However, this model may ultimately result in higher complexity and a worse user experience due to the mixing of completely isolated and interdependent Hubs.
Comparative Analysis of Architectural Models
To synthesize the trade-offs inherent in these designs, the following comparison highlights how each model performs across key dimensions of risk and efficiency.
| Dimension | Model A: Monolithic Hub | Model B: Risk-Profiled Hubs | Model C: Asset-Centric Hubs | Model D: Hybrid Model |
|---|---|---|---|---|
| Liquidity Depth | Maximum. A nified pool ensures deep markets and stable rates. | Moderate. Liquidity is split across yield tiers, resulting in shallower markets. | Low. Highly fragmented into isolated asset pools. | Moderate. Maintains a deep core while allowing fragmentation at the edges. |
| Risk Isolation | Moderate. Contagion can affect all LPs, albeit risk is contained via careful parameterization. | High. Failure in a High-Risk Hub does not impact the Low-Risk Hub. | High. Risk is contained entirely within the specific asset ecosystem. | Balanced. Core is protected from Satellites; Satellites are isolated from each other. |
| Capital Efficiency | High. Assets are fully fungible, and utilization is maximized. | Medium. Fragmentation may lead to idle capital in specific tiers. | Low. Capital is trapped in specific silos and cannot cross-pollinate. | Medium. Core ensures efficiency, while satellites allow for targeted capital deployment. |
| Asset Listing Scale | Slow. Conservative listing process creates a bottleneck. | Medium. Easier to onboard assets to risky tiers, but still categorized. | Fast. Isolated creation of hubs for any asset class. | Fast. Satellites allow for rapid experimentation without putting the core at risk. |
| User Experience | Simple. One pool, one set of rates. | Moderate. Users must choose their risk tolerance/hub. | Complex. Users must navigate many distinct Hubs. | Complex. Users must understand the distinction between Standard and Satellite Hubs. |
The Strategic Role of Inter-Hub Credit Lines
A novel feature of the V4 architecture is the ability to establish credit lines between Hubs. This mechanism allows liquidity to flow from a parent Hub to a Spoke of a secondary Hub, introducing new possibilities for surgical risk management and capital allocation. The rationale for these credit lines generally falls into three categories: liquidity bootstrapping, spoke stabilization, and yield enhancement.
Liquidity Bootstrapping
When a new, specialized Hub is launched—for example, a Hub dedicated to a new asset type—it faces a “cold start” problem, exactly like any new instance on Aave V3. Without existing liquidity, there is no utility for borrowers; without borrow demand, there is no yield for lenders. A credit line from the Main Hub allows the new Spoke to draw initial liquidity to service early borrow demand. This kickstarts the market, allowing the Spoke to function immediately while it works to attract organic deposits.
However, this introduces a core challenge: if the Main Hub provides cheap, abundant liquidity, there is little incentive for the new Hub to build its own deposit base. Users and integrators may simply rely on the credit line. To mitigate this, risk premiums must be applied. The borrowing cost from the Main Hub’s credit line should logically be set higher than the new Hub’s native borrowing rate (e.g., Main Hub Cost + 2%). This pricing structure incentivizes borrowers to prioritize borrowing directly from the new Hub to capture better yields, eventually rendering the credit line a secondary, rather than primary, source of capital.
Spoke Stabilization
Markets are rarely static, and smaller, specialized Hubs may face periods of significant withdrawal pressure or transient utilization volatility. In such scenarios, a credit line from a parent Hub can act as a stabilizer. If a specific Hub experiences a liquidity crunch, the credit line provides an immediate source of deeper liquidity, allowing it to retain users instead of unwinding or migrating positions. This function is analogous to a “lender of last resort” mechanism within the protocol’s own internal economy.
Yield Enhancement and Risk Transfer
For the Main Hub, extending credit lines serves as a method of yield enhancement. By lending to a higher-risk environment, the senior Hub can capture a risk premium. Ideally, these loans are structured as “Senior Debt.” This means the credit line should be subject to more restrictive parameters than native borrowing within the Spoke, enforced by tightly defined draw caps of the credit line. In the event of a shortfall, the Main Hub’s capital would theoretically be better protected than the Spoke’s native, higher-risk deposits, especially if an Umbrella module covering the riskier Hub exists and can act as a layer of junior defense.
Conflict of Interest and Risk Alteration
Despite the utility, extending credit lines introduces a conflict between the protocol’s stability goals and user expectations. When a conservative Hub lends to a risky Spoke, it alters its own risk profile. Depositors in the Main Hub become indirectly exposed to the assets in the riskier satellite Hub. Even if the credit line is small relative to the total pool, this transmission of risk must be carefully managed. Transparency is critical; users must understand that their exposure is not limited to the assets in their specific Hub but extends to the counterparties (other Hubs) that their Hub lends to.
Expanding the Ecosystem: Generalized Spokes
Beyond the organization of liquidity into Hubs, the modular nature of the architecture allows for the generalization of Spokes. A Spoke is not merely a connection point for borrowers; it is any module that interacts with the liquidity layer. This flexibility allows for the integration of diverse functionalities that were previously difficult or impossible to implement directly on the core protocol.
The Umbrella Spoke
The Umbrella module itself would be implemented as a Spoke. This allows for flexibility in how coverage is applied. As noted in the analysis of different models, the Umbrella can be configured to cover a single Hub, a specific set of Hubs, or the entire network. This modularity is essential for the Model B and Model C configurations, where risk profiles vary drastically. The Umbrella Spoke defines the conditions under which safety funds are slashed and used to recapitalize a Hub, allowing for distinct insurance markets to develop around distinct risk pools.
GHO Direct Minting Spoke
The protocol’s native stablecoin, GHO, can be integrated via a dedicated Direct Minting Spoke. In previous iterations, stablecoin minting was often tied to specific facilitators. A dedicated Spoke allows the protocol to control GHO minting capacity and parameters directly at the architectural level. This Spoke can interact with specific Hubs to allow users to mint GHO against their collateral with greater efficiency, or it can serve as a facilitator that manages the supply based on the algorithmic market state.
Vaults Spoke: Segregated Collateral
One of the most significant additions for institutional adoption is the Vaults Spoke. Traditional DeFi lending usually relies on pooled collateral—User A’s WBTC sits in the same contract as User B’s ETH. While efficient, this creates regulatory and custodial challenges for institutional actors who require asset segregation.
A Vaults Spoke allows for the creation of isolated positions where collateral is not commingled with the general pool. Instead, the collateral is held in a segregated vault, yet the user can still borrow against it by accessing the protocol’s liquidity. This structure satisfies the strict custody and bankruptcy-remoteness requirements of many institutional investors and CeFi services. In essence, this would mean enforcing and facilitating individual borrowing conditions for such actors in order to maximize the protocol’s revenue.
Debt Trading Spoke
The architecture supports the creation of a Debt Trading Spoke, conceptually similar to mechanisms seen in protocols like Fluid. In a typical lending market, a borrower who wishes to exit a position must repay the debt. A Debt Trading Spoke changes this dynamic by allowing users to trade their debt positions.
By leveraging the deep liquidity of Aave, this spoke enables users to swap their debt obligations—for example, swapping a variable-rate USDC debt for USDT debt, or transferring a debt position to another user (along with the collateral) without unwinding the underlying assets. This introduces a new revenue stream for the protocol in the form of swap fees generated directly at the protocol level. Furthermore, it increases market efficiency and competitiveness by allowing borrowers to actively manage their liabilities in response to changing interest rates as well as providing the needed tools to execute more flexible actions.
CDP Spokes
The modular design facilitates the creation of Collateralized Debt Position (CDP) Spokes that can integrate deeply with external DEXs, specifically those supporting concentrated liquidity ranges.
In this setup, LPs can use their LP positions as collateral within a CDP Spoke to borrow assets from Aave. This unlocks the value of the liquidity positions without requiring the LP to remove their funds from the DEX. The integration goes beyond simple collateralization; the Spoke can manage the specific risks associated with impermanent loss and the volatility of LP tokens. This symbiosis creates a more capital-efficient market where liquidity on the DEX is supported by the lending capacity of the credit protocol, and vice versa.
Conclusion
The Aave V4 architecture offers a vast design space that goes beyond the binary choice of pooled versus isolated choices. By utilizing Hubs, Spokes, and Credit Lines, the protocol can theoretically mimic the structures of traditional finance—ranging from universal banking (Monolithic) to specialized hedge funds (Risk-Profiled) and prime brokerage services (Vaults).
While Model A provides the continuity of deep liquidity that DeFi relies on, the limitations regarding risk contagion are real. Conversely, while Model C offers maximum containment, it fragments liquidity to a degree that may harm utility. As governance weighs these or even more options, the focus must remain on the interplay between capital efficiency and the containment of systemic risk. These are the primary directions LlamaRisk will focus on when participating in the Aave V4 architecture definition process.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk firm funded partly by the Aave DAO, and is published solely within the scope assigned by the Aave DAO. Other than any compensation payable by the Aave DAO for that assigned scope, LlamaRisk has not received any direct or indirect compensation or other consideration for this work from any Aave DAO service provider, delegate, contributor, affiliated entity, or any third party, including any protocol(s) discussed herein. The information is provided for informational purposes only and should not be construed as legal, financial, tax, or other professional advice.
