---
id: 1826
title: "Breaking Aave Upgradeability"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2020/12/16/breaking-aave-upgradeability/"
published_at: "2020-12-16T16:01:55Z"
tags: ["smart-contracts", "defi", "vulnerability-disclosure", "blockchain", "aave", "delegatecall", "upgradeability"]
phying_url: "https://phying.com/item/1826"
lang: en
---

# Breaking Aave Upgradeability

## Summary

Trail of Bits found a critical bug in Aave's live contracts: public initializers on the LendingPool proxy enabled arbitrary delegatecall. Aave mitigated it within an hour of disclosure.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2020-12-16T16:01:55Z
- **Original:** https://blog.trailofbits.com/2020/12/16/breaking-aave-upgradeability/
- **Phying News:** https://phying.com/item/1826