Aave V3.8: a transient-storage reentrancy guard for Pool operations

Aave Labs posted the proposal, titled ARFC Aave V3.8, in the Aave governance forum on 21 October 2026. After one community question, Aave Labs escalated it to a Snapshot vote in Aave's aavedao.eth space, which runs from 28 to 31 October 2026. The change itself is small, a single reentrancy guard added to Pool operations, but it would apply to every active Aave V3 instance the proposal lists, across 15 networks.

What it changes

• Adds a reentrancy guard based on transient storage (EIP-1153) that protects Pool accounting consistency, including cases where a single transaction's execution flow touches the Pool more than once.
• Checks the guard in flashLoan() and flashLoanSimple() without either function setting the lock, so what it blocks is starting a flash loan from inside an already-open Pool action.
• Targets the active Aave V3 instances on Ethereum (Core and Lido), Plasma, Avalanche, BNB, Monad, Base, Arbitrum, Mantle, X Layer, Polygon, Linea, Optimism, Gnosis, MegaETH and Celo. Instances where every asset is frozen and caps are set to zero are excluded.
• V3.8 will ship as its own version of the Licensed Work under a Business Source License. Its Change Date is recorded at the v38.aavelicense.eth text record once Aave Governance sets one; until then it stays under the Business Source License. The V3.8 IP is to be transferred to the Aave Foundation through a separate governance proposal.
• The code will go through a round of audits by Certora and third parties before an AIP is submitted.

The case for it

Aave Labs frames V3.8 as hardening against what it calls "theoretical reentrancy exploits", not a response to an incident. "Aave V3.8 aims to make the system more robust and predictable." The firm argues the usual reason to skip this kind of guard no longer applies: "Gas costs are no longer the concern they once were, and recent developments such as transient storage allow the protocol to be strengthened with little downside in efficiency or gas costs."

The objections

A forum participant posting as futuramo raised the one substantive question in the thread, in a reply: "If the guard covers the flash-loan callback from Pool.flashLoanSimple(), then this would prevent using an Aave flash loan to trigger an Aave liquidation inside that callback." Aave Labs answered, in its reply, that both flash loan functions are checked by the guard but do not set its lock, so a flash loan can still be executed atomically with other Pool actions, including a liquidation triggered from within the same callback. Existing integrations that compose Aave flash loans with other Pool actions this way are expected to keep operating as they do today. Aave Labs edited that answer on 27 October 2026 to match the latest development work on V3.8.

Where it stands

Forum discussion produced one technical question, which Aave Labs answered. On 27 October 2026, Aave Labs announced it had raised the proposal to Snapshot. The vote runs from 28 October 2026, 12:34 UTC, to 31 October 2026, 12:34 UTC. The proposal's stated next step, once the Snapshot vote concludes and the Certora and third-party audits are complete, is for Aave Labs to submit an onchain AIP to upgrade the listed Aave V3 instances to V3.8.