aave / aave-protocol

Aave Protocol Version 1.0 - Decentralized Lending Pools

Aave Protocol ·

Open source implementation of the Aave Decentralized Lending Pools protocol. Version 1.0

Documentation

It is possible to find documention to integrate the Aave Protocol on developers.aave.com

For a deep explanation of the Aave Protocol, read the White Paper

Source code

The source code included is the final production version of the protocol. Eventual changes (smart contracts updates, bug fixes, etc.) will be applied through subsequent merge requests.

Audits report

• Trails of Bits Smart Contracts audit

• Open Zeppelin Smart Contracts

Bug bounty

The bug bounty program is live!

We want Aave protocol to be the best it can be, so we’re calling on our community to help us find any bugs or vulnerabilities.

More details about the bounty program and how to apply can be found here https://aave.com/bug-bounty.

Responsible disclosure

At Aave, we consider the security of our systems a top priority. But even putting top priority status and maximum effort, there is still possibility that vulnerabilities can exist.

In case you discover a vulnerability, we would like to know about it immediately so we can take steps to address it as quickly as possible.

If you discover a vulnerability, please do the following:

E-mail your findings to [email protected]; 

Do not take advantage of the vulnerability or problem you have discovered; 

Do not reveal the problem to others until it has been resolved; 

Do not use attacks on physical security, social engineering, distributed denial of service, spam or applications of third parties; and 

Do provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Complex vulnerabilities may require further explanation so we might ask you for additional information. 

We will promise the following:

We will respond to your report within 3 business days with our evaluation of the report and an expected resolution date; 

If you have followed the instructions above, we will not take any legal action against you in regard to the report; 

We will handle your report with strict confidentiality, and not pass on your personal details to third parties without your permission; 

If you so wish we will keep you informed of the progress towards resolving the problem; 

In the public information concerning the problem reported, we will give your name as the discoverer of the problem (unless you desire otherwise); and 

As a token of our gratitude for your assistance, we offer a reward for every report of a security problem that was not yet known to us. The amount of the reward will be determined based on the severity of the leak, the quality of the report and any additional assistance you provide.  

License

The Aave Protocol is under the AGPL v3 license

aave-protocol's Issues

G

[Question] Are there any migration/deployment script ?

Hello, I'm trying to deploy the aave-protocol from scratch for learning purposes but I'm not able to find any migrations or deployment scripts.

Is there any resource out there where I can check this? This is for a Remix plugin to allow users to deploy aave protocol easily.

Thanks

Huynh

[Aave-v3] Mumbai testnet addresses used by the dApp do not match the addresses on the dev doc

The addresses listed in the developper documentation for mumbai here
https://docs.aave.com/developers/deployed-contracts/v3-testnet-addresses
do not match the addresses that seem to be used by the dApp (also on mumbai). The dApp should either use the addresses of the doc, or the doc be updated to the dApp addresses:

"DAI": "0xc87385b5e62099f92d490750fcd6c901a524bbca",
 "USDC": "0xF61Cffd6071a8DB7cD5E8DF1D3A5450D9903cF1c",
 "WETH": "0x63e537a69b3f5b03f4f46c5765c82861bd874b6e",
 ...
 "aWETH": "0xCa003B920F1CEcb4fe0Fe91B657E58a8E1EED04a",
 "aDAI": "0x3D8477D93A0B036Ec3D180fA013848B628c5cb76",
 "aUSDC": "0xc78fd49C2bAd9C8f41ddcE069e34F6a6A627d37f",
 ...
 "addressProvider": "0x5343b5bA672Ae99d627A1C87866b8E53F47Db2E6"
 'poolproxy': "0xEce3383269ccE0B2ae66277101996b58c482817B"

also verifiying the deployed contracts would tremendously help debugging!

this test dai faucet is not longer on https://testnet.aave.com/faucet. where is it now?

this test dai faucet is not longer on https://testnet.aave.com/faucet. where is it now?

[thegraph][bug] deposit id/tx wrong

According to https://github.com/aave/aave-protocol/blob/master/thegraph/formatted/schema.graphql#L129 the id should be the tx, but running

{
  deposits{
    id
  }
}

returns

"data": {
    "deposits": [
      {
        "id": "0x00001b59a28c28623982fa110b2a27d4a9b018633c07b650f2c43244e8afc5b9d"
      }
   ],...
}

Where the tx is apparently suffixed with a d https://github.com/aave/aave-protocol/blob/master/thegraph/raw/mapping/lending-pool.ts#L167

AAVE Flash Loan Not Working

I'm following this tutorial on how to set up an AAVE flash loan: https://www.quicknode.com/guides/defi/how-to-make-a-flash-loan-using-aave and I'm on the very last part and running into a revert error when I go to run the flashloan() function. I've compiled the contracts and done the tutorial exactly as it says. I've run everything on the Kovan testnet and used Kovan DAI as well to fund my flash loan. I'm also inputting the asset address 0xFf795577d9AC8bD7D90Ee22b6C1703490b6512FD like it says in the tutorial. It should work but it's not. Any advice? Thanks.

missing files for testing

Hi there,
When I tried to run the tests, I noticed a great deal of implied dependencies but no package.json.
I also came across lines like this:

import {getTruffleContractInstance} from '../../utils/truffle/truffle-core-utils';

but none of truffle's libraries in any of their repos have this exported function (as far as I can tell).

This line

import {NIL_ADDRESS, ETHEREUM_ADDRESS} from '../../utils/constants';

looks very Aave specific since the source code contains that dummy ethereum address.

I think there's a toplevel utils folder that hasn't been committed.

the aToken balance will never reach zero

Regarding the question about aave aToken:

In the provided code, if you withdraw all of your collateral assets, which is represented by userBalance, the scaled balance used to calculate the liquidity index is NI_t_old. After the reserve.updateState() function is called, the liquidity index is updated to NI_t_new. This means that when burning the aToken, another interest accrual occurs, and the burned scaled amount will always be less than userBalance. As a result, the aToken balance will never reach zero.

  function withdraw(
    address asset,
    uint256 amount,
    address to
  ) external override whenNotPaused returns (uint256) {
    DataTypes.ReserveData storage reserve = _reserves[asset];

    address aToken = reserve.aTokenAddress;

    uint256 userBalance = IAToken(aToken).balanceOf(msg.sender);

    uint256 amountToWithdraw = amount;

    if (amount == type(uint256).max) {
      amountToWithdraw = userBalance;
    }

    ValidationLogic.validateWithdraw(
      asset,
      amountToWithdraw,
      userBalance,
      _reserves,
      _usersConfig[msg.sender],
      _reservesList,
      _reservesCount,
      _addressesProvider.getPriceOracle()
    );

    reserve.updateState();

    reserve.updateInterestRates(asset, aToken, 0, amountToWithdraw);


    if (amountToWithdraw == userBalance) {
      _usersConfig[msg.sender].setUsingAsCollateral(reserve.id, false);
      emit ReserveUsedAsCollateralDisabled(asset, msg.sender);
    }

    IAToken(aToken).burn(msg.sender, to, amountToWithdraw, reserve.liquidityIndex);

    emit Withdraw(asset, msg.sender, to, amountToWithdraw);

    return amountToWithdraw;
  }

[Feature Request] Migrate loans between addresses

Sometimes people wish to move addresses but there's no way to do that on AAVE without first closing your loans and withdrawing which is very inconvenient and expensive.

A simple move address button would be very helpful. I haven't yet gone through all the contracts to see where this exists but it should mostly be as simple as just updating the mapping of address with their deposits and open loans and moving the aTokens to that new address.

uploading source code without url for verification of contract ownership

I would appreciate assistance on steps to extract values from json data from Binance.com exchange . at end of first week of Mar. in 2018. in reference to tokens, using etherscan to view and the metamask wallet extension for chrome. Thanks in advance.

getting to aave protocol is just white screen nothing happens different browser as well still happens it made my liquidation risk level drop without me being able to do nothing about it and loss money help please

getting to aave protocol is just white screen nothing happens different browser as well still happens it made my liquidation risk level drop without me being able to do nothing about it and loss money help please

Coinbase Wallet

Request from CB biz dev --

For ETH and MATIC, change 'Coinbase' to 'Coinbase Wallet'

For AVAX, add Coinbase Wallet support (it currently is not supported)

Dev docs for WalletLink (the open protocol for Coinbase Wallet): https://docs.cloud.coinbase.com/walletlink/docs/getting-started

Thank you

Getting an error inputting asset in FlashLoan.sol

I'm following this tutorial loosely (by loosely I'm not using the Kovan network because I'm having issues with that as well, I'm testing on both the JavaScript VM (London) and Web3 Provider Mainnet Fork with HardHat): https://www.quicknode.com/guides/defi/how-to-make-a-flash-loan-using-aave

All the files are compiled fine. However, when I go to submit an asset like the Ethereum contract address "0x74b23882a30290451A17c44f4F05243b6b58C76d" in the flashloan() function, I get a "Transaction reverted without a reason string" Error. The address that deployed the contract already has a lot of test ETH in it so I'm not sure what could be the issue.

And just a sidenote why I'm not using Kovan like the tutorial, all the good faucets are down and the one that works only let me get like .0031 KETH for the day which was enough for one deployment and when the contract deployed it failed for some reason and ate all the Kovan ETH along with it. This failure may have been due to the fact that I had to adjust the gas price down just slightly to meet the amount I had, but I doubt it, I'm not really sure why it failed on the Injected Web3 and that worries me for future real deployments. Any insight into any of this would be super appreciated. Thanks!

AAVE V2 Mumbai testnet pointing to Mainnet

I went to url https://testnet.aave.com/faucet to get some testnet DAI but it got redirected to https://staging.aave.com/ and its making me switch to polygon mainnet to do any trasnsaction

some contracts on mumbai test chain are not verified

protocol-data-provider and lendingpool are not verified on mumbai test chain.

[thegraph] yarn codegen-raw: error Command failed with exit code 1

Hello Aave,
Inside the thegraph directory, when I run the following: yarn codegen-raw:

yarn run v1.22.10
$ TYPE=raw npm run prepare && graph codegen --output-dir ./raw/generated
npm WARN lifecycle The node binary used for scripts is /var/folders/nv/ztjvfck52z74nr526shd5kzw0000gn/T/yarn--1610207854304-0.6707123665558101/node but npm is using /usr/local/bin/node itself. Use the `--scripts-prepend-node-path` option to include the path for the node binary npm was executed with.

> [email protected] prepare /Users/riccardoanacar/TheGraph/aave_graph/aave-protocol/thegraph
> mustache ./config/${TYPE:-raw}.json ./config/${NETWORK:-dev}.json | mustache  - subgraph.template.yaml > subgraph.yaml

  Skip migration: Bump mapping apiVersion from 0.0.1 to 0.0.2
  Skip migration: Bump mapping apiVersion from 0.0.2 to 0.0.3
  Skip migration: Bump mapping apiVersion from 0.0.3 to 0.0.4
  Skip migration: Bump mapping specVersion from 0.0.1 to 0.0.2
✔ Apply migrations
✖ Failed to load subgraph from subgraph.yaml: Error in subgraph.yaml:

  Path: dataSources > 1 > mapping > abis > 0 > file
  File does not exist: ../build/contracts/LendingPoolAddressesProviderRegistry.json

Path: dataSources > 2 > mapping > abis > 2 > file
  File does not exist: ../build/contracts/IExtendedPriceAggregator.json

  Path: dataSources > 3 > mapping > abis > 0 > file
  File does not exist: ../build/contracts/ChainlinkUSDETHOracleI.json

  Path: templates > 6 > mapping > abis > 0 > file
  File does not exist: ../build/contracts/IExtendedPriceAggregator.json

  Path: templates > 7 > mapping > abis > 0 > file
  File does not exist: ../build/contracts/IUniswapExchange.json
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

Would you be able to give me some directions how to fix this error? are these missing files available? For example:

• File does not exist: ../build/contracts/IUniswapExchange.json - could IUniswapExchange.json copied in contracts dir?
  Thank you in advance for your help

Failed to fetch bridge expected yield for "Aave"

visit to https://zk.money and the error showed here.

Kovan + LINK + Lending - deposit() | UnhandledPromiseRejectionWarning: Error: VM execution error

I am trying to use the lending feature of AAVE. I was successful using ETH & aETH.
But I am facing issues with LINK.

Following is the error I am getting:

Attempting to deploy from account  0x3D356DCBAc29e69a7fc237f45F8318E099268a0e
lpAddress found:  0xE0fBa4Fc209b4948668006B2bE61711b7f465bAe
(node:19131) UnhandledPromiseRejectionWarning: Error: VM execution error.
Reverted 0x
    at Object._fireError (/home/pam/aave-testing/node_modules/web3-utils/lib/index.js:50:17)
    at sendTxCallback (/home/pam/aave-testing/node_modules/web3-core-method/lib/index.js:540:30)
    at /home/pam/aave-testing/node_modules/web3-core-requestmanager/lib/index.js:300:20
    at /home/pam/aave-testing/node_modules/@trufflesuite/web3-provider-engine/index.js:238:9
    at /home/pam/aave-testing/node_modules/@trufflesuite/web3-provider-engine/node_modules/async/internal/once.js:12:16
    at replenish (/home/pam/aave-testing/node_modules/@trufflesuite/web3-provider-engine/node_modules/async/internal/eachOfLimit.js:61:25)
    at /home/pam/aave-testing/node_modules/@trufflesuite/web3-provider-engine/node_modules/async/internal/eachOfLimit.js:71:9
    at eachLimit (/home/pam/aave-testing/node_modules/@trufflesuite/web3-provider-engine/node_modules/async/eachLimit.js:43:36)
    at /home/pam/aave-testing/node_modules/@trufflesuite/web3-provider-engine/node_modules/async/internal/doLimit.js:9:16
    at end (/home/pam/aave-testing/node_modules/@trufflesuite/web3-provider-engine/index.js:217:5)
    at Request._callback (/home/pam/aave-testing/node_modules/@trufflesuite/web3-provider-engine/subproviders/rpc.js:70:28)
    at Request.self.callback (/home/pam/aave-testing/node_modules/request/request.js:185:22)
    at Request.emit (events.js:198:13)
    at Request.<anonymous> (/home/pam/aave-testing/node_modules/request/request.js:1154:10)
    at Request.emit (events.js:198:13)
    at IncomingMessage.<anonymous> (/home/pam/aave-testing/node_modules/request/request.js:1076:12)
(node:19131) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 1)
(node:19131) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

Deploy script
Full code link

Can someone tell me what I am doing wrong?

do you have front-end open source for www.aave.com and app.aave.com?

[thegraph][feature request] fees & lend burn

As side-product of aave beeing utilized, lend is burned. As this is part of the protocol, I guess it should also be part of the aave graph.

What I think would be interesting (and doable by my understanding of what is possible with the graph)

totalBurnedLendByProtocol
As i get thegraph docs it's not possible to just monitor incoming transactions on a given address(so we cannot just monitor 0x0 for incoming lend)?, but it should be possible to monitor token burns initiated by the protocol and sum them up.

feesYetToBeCollected
Should be doable by summing up the fees to be collected by borrows() and subtracting the fees payed in repays()

totalCollectedFees
Should be doable by summing up the repayed fees and fees from the flashLoans

availableFees
Should be doable by totalCollectedFees - fees used to burn lend

Instruction to run tests

Hello, I'm wonder if there are any instructions to run the tests?

Thanks

Updating the rebalance feature of V1 to switch the loan to variable

As a safety measure for the liquidity providers against excessive stable rate borrowing, the Aave protocol implements a mechanism called rebalance.
The rebalance allows to rebalance the interest rates up (if there is need for liquidity) or down (if a borrower can obtain a more competitive stable rate).

In perspective of incentivizing the V1 -> V2 migration, as discussed in https://governance.aave.com/t/aave-protocol-v1-v2-migration-tool-and-transition-plan/2053/26, the first step is to disable stable rate borrowing.
To also facilitate the conversion of the outstanding debt to variable, the rebalancing function will be replaced with the rate swap. If stable rate borrowers will need to be rebalanced, they will be swapped to the variable mode.

Running Truffle tests "Unexpected token"

Trying to get Truffle to run tests and continue to get:

SyntaxError: /Users/mike/near/aave-protocol/test/actions/index.ts: Unexpected token (44:2)
  42 |
  43 | const almostEqualOrEqual = function(
> 44 |   this: any,
     |   ^
  45 |   expected: ReserveData | UserReserveData,
  46 |   actual: ReserveData | UserReserveData
  47 | ) {
    at Parser.pp$5.raise (/Users/mike/near/aave-protocol/node_modules/babylon/lib/index.js:4454:13)
    at Parser.pp.unexpected (/Users/mike/near/aave-protocol/node_modules/babylon/lib/index.js:1761:8)
    at Parser.pp$2.parseBindingAtom (/Users/mike/near/aave-protocol/node_modules/babylon/lib/index.js:3090:12)

Updated typescript to:
"typescript": "^4.0.2"

Would be great to get some help running the tests. Cheers
Tried node 12, 11
Truffle 5.1.43

Legacy.com

[thegraph][feature request] totalDepositUsers/totalBorrowUsers

I was wondering how to measure "health" of the protocol.

Not sure if this makes sense, but I think it might be interesting to measure how many users are invested into the lending pools and how many users are using the pools to exchange there assets(borrow sth). Of course this won't give a perfect picture as users could use different addresses, but I guess some information is better than none. Would you be interested in adding sth like this/Does it make sense?

Best regards,
Lukas

Get errors, when I tried to run `npm run codegen-raw`

Why do there files missing? how could I get them?

✖ Failed to load subgraph from subgraph.yaml: Error in subgraph.yaml:

  Path: dataSources > 1 > mapping > abis > 0 > file
  File does not exist: ../build/contracts/LendingPoolAddressesProviderRegistry.json

  Path: dataSources > 2 > mapping > abis > 2 > file
  File does not exist: ../build/contracts/IExtendedPriceAggregator.json

  Path: dataSources > 3 > mapping > abis > 0 > file
  File does not exist: ../build/contracts/ChainlinkUSDETHOracleI.json

  Path: templates > 6 > mapping > abis > 0 > file
  File does not exist: ../build/contracts/IExtendedPriceAggregator.json

  Path: templates > 7 > mapping > abis > 0 > file
  File does not exist: ../build/contracts/IUniswapExchange.json

[Feature] Provide a "Pre-Liquidation Liquidator" which can only be called by the investor himself

saving the investors from paying the 5 % liquidation fee when they e.g. have an own watcher running to ensure the health of their LTV ratio ...

I only found the "liquidationCall" function which is used by anyone:
https://github.com/aave/aave-protocol/blob/master/contracts/lendingpool/LendingPool.sol#L805

I think it would be fair for investors to give them the chance to trigger the non-costly own pre-liquidation clearing before the liquidation threshold is reached.

AAVE faucet for Matic testnet (Mumbai) is not working

I need to have some DAI, USDT, and USDC on Matic Mumbai testnet for testing my contract, but it seems that the faucet is not working.

Cannot choose all addresses when using AAVE V2 with Nano Ledger S

Previously I used AAVE v2 app with my Nano Ledger S and used the 6th or 7th address. Now when I try to connect my Ledger I can only choose from the first 4 addresses, there is no arrow or anything to load more addresses.

Docs are out of date

Hello Team,

Cloud you please update your docs at least regarding the flashloans?
https://developers.aave.com/?typescript#implementing-a-flashloanreceiver-contract

The solidity example is not working anymore since openzeppelin changed their github directory structure (import is not working), also they moved to solidity 0.6.0.

NetworkMetadataProvider.sol file dissapeared from the github repository.

And so on.

Thanks!

[general] Use of TypeScript as in return types

Hey guys - i've been poking around the repo & was curious when I saw the high use of TypeScript (which I use professionally).

Was generally wondering why there's such a high use of as when returning values in a few functions - it can definitely result in type errors that typescript won't catch? case in point is the line referenced below.

aave-protocol/thegraph/raw/initializers.ts

Line 32 in 99c7e4e

return protocol as Protocol;

[thegraph][feature request] average rates over time

While the rate displayed on aave.com is kinda nice, rates on aave are quite volatile.
As a user it would be interesting to know what's the average rate for a certain asset over the last 24h or 1month.

[feature request] import { LendingPool } from @aave/contracts

We had an excellent submission coming from the Hack Money hackathon (https://github.com/rtoken-project/rtoken-monorepo/pull/64/files), however I noticed lots of un-edited files were copy/pasted from this repo. Rather, I would like to be able to do this:

import { LendingPool } from @aave/contracts

We recently added this to the rToken contracts repo (see https://github.com/rtoken-project/rtoken-monorepo/blob/41cfd3b8be805f1ca19a4d9d49e4aae39e8db6c0/packages/contracts/package.json#L9) and its pretty simple to do. Happy to help guide the conversation here as it would be very useful and is becoming standard practice in the community.

Page Not Found

Error while switch tokens

While switching Polygon MATIC tokens, I am getting "There was some error. Please try changing the parameters" for gas estimation calculation.

Aave V2 Subgraph?

It looks like the subgraph on theGraph's explorer is for version 1 of Aave's protocol. Where can I find the version 2 subgraph?

[feature request] compound flash/borrows

It would be nice if the existing:

{
  reserves {
    totalBorrows
    totalLiquidity
    availableLiquidity
  }
}

was extended with lifetime numbers compounding since launch.

{
  reserves {
    lifetimeBorrows
    lifetimeFlashLoans
  }
}

I'm currently calculating these numbers manually, but i think this could be a nice addition to the official api.

[thegraph]Why there is no comment?

GraphQL Why there is no comment?
Every attribute, every interface does not know what it means.
It's all about guessing.