Skip to content
Breaking Aave Upgradeability
blog.trailofbits.com | vulnerability | #smart-contracts | #defi | #vulnerability-disclosure | #blockchain | #aave | #delegatecall | #upgradeability
Summary
Trail of Bits found a critical bug in Aave's live contracts: public initializers on the LendingPool proxy enabled arbitrary delegatecall. Aave mitigated it within an hour of disclosure.
- Published
- Collected