Aave Labs has clarified that its proposed V3.8 security upgrade would preserve flash-loan liquidations. The response, posted October 23, addresses how a reentrancy guard would interact with existing integrations.
Guard Design and Flash-Loan Exclusion
The proposal, posted October 21, adds a guard to Pool operations that constrains the ability of external callbacks to enter protected contract functions before earlier calls finish. Aave Labs says flashLoan() and flashLoanSimple() would be excluded from the guard, allowing their callbacks to continue invoking Pool actions, including liquidations.
Why the Exclusion Matters
A smart contract receiving a flash loan needs time within the transaction to execute actions with the borrowed assets. Aave's system transfers assets, calls the receiver contract, and then checks settlement conditions. For a simple flash loan, the receiver must make the borrowed amount plus the required fee available for repayment.
A liquidation integration may need to borrow an asset, repay an unhealthy position, and complete its transaction before settlement. Indiscriminately blocking subsequent Pool interactions would interfere with that sequence. The security boundary must account for transaction patterns that integrations depend on, including calls that occur after assets have left the Pool but before repayment is checked.
Technical Implementation
The proposed implementation uses transient storage introduced through Ethereum's EIP-1153. This storage remains available during a transaction and is discarded when the transaction ends, carrying temporary lock state to track whether a protected operation is already running.
For a heavily used DeFi protocol, the design must balance the protection added by the guard against the cost imposed on ordinary transactions.
Governance and Review Process
Aave's proposed path includes feedback, a Snapshot vote, security review, and an on-chain improvement proposal. Certora and additional reviewers are expected to assess the changes before that final step. For integrators on Ethereum and other affected networks, the clarification provides a compatibility point to check against the eventual code.
