Research / Aave V3 Core

Aave V3 Ethereum Core: level 0-5 of every role read on chain (2026-10-13)

MethodNot readRerunRepository folder

Summary. The Technical Asset Listing Framework adopted by Aave governance (July 2026) classes each privileged role of a listed asset from level 0 (single key, no delay) to level 5 (on-chain DAO governance with timelock); levels 0 and 1 are "weak". This folder reads those roles on chain for 25 of the 67 reserves of Aave V3 Core (Ethereum), plus BTC.b and USDe, at block 26,184,127, with two negative witnesses run once for the whole pass (listed under Witnesses) and a self-check of the hash function at load; a single call does not carry its own. Read this way, five listed assets are at level 0 or 1: USDC and cbETH (single keys), USDT (MultiSigWallet 3 of 6), BTC.b (a single key, second pauser a Safe 2 of 11), USDe (single keys inside its minter contract; level 1 without it). Several assets expose no role through standard getters and six route their power through Aragon, the Vat or a registry: they are left unclassified, not called safe. PAXGy, a method witness, is at level 3 for its owner chain but at 0 (+ unclassified) once the roles of its RolesAuthority are counted (read by hand, outside the script: see "Manual correction outside the script"). Not read: 40 reserves, Aragon ACLs, the freeze status of reserves; the script itself does not read the RolesAuthority of PAXGy. Rerun: python3 mesure-aave-niveaux.py --block 26184127 --compact (standard library, public RPC).

Status. 27 of the 67 Core reserves are read here (the first 25 in list order, plus BTC.b and USDe) at block 26,184,127; the other 40 are not read yet.

Rendered page: https://realspap.github.io/oracle/research/aave-levels/

Level per asset

Frozen block: 26184127 (0x18f89bf), read with eth_blockNumber on Tenderly on 2026-10-13 around 14:20 UTC. Every call (eth_call, eth_getStorageAt, eth_getCode, eth_getLogs up to that block) carries this block. Read-only measurement: no key, no transaction. Script: mesure-aave-niveaux.py (in this folder, standard library only). Volume of the final pass: 1,248 eth_call, 290 eth_getStorageAt, 135 eth_getCode, 70 eth_getLogs. NOT READ: 0.

What was read

• Core Pool 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2, getReservesList(): 67 reserves. The first 25 in list order are measured. That order is the order of listing: the first 25 are mostly the historical assets (WETH to KNC). The frozen or active status of each reserve was not read.
• In addition, flagged as such in the table: BTC.b (reserve no. 63) and USDe (no. 30), listed on Core but outside the first 25, and USAT and PAXGy, not listed on Core, measured as method witnesses because they have a LlamaRisk sheet on Ethereum written under the framework.
• For each token: EIP-1967 slots (implementation, admin, beacon), ZeppelinOS slots (admin, implementation), getters owner(), admin(), minter(), controller(), authority(), masterMinter(), pauser(), blacklister(), guardian(), RISK_COUNCIL(). For AccessControl: every RoleGranted event of the contract (block 0 to the frozen block), then hasRole(role, account) at the frozen block to keep current holders only, cross-checked with getRoleMemberCount when the contract exposes it (no mismatch). For Maker-style tokens: wards through Rely and LogNote rely events. For FiatTokens (USDC, cbETH): besides the named roles, the minters through MinterConfigured then isMinter().
• For each holder: eth_getCode (empty = EOA; prefix 0xef0100 = EOA delegated by EIP-7702, none met), getThreshold()/getOwners() (Safe) or required()/getOwners() (legacy MultiSigWallet, the one Tether uses), getModulesPaginated (no measured Safe has a module), getMinDelay() (OpenZeppelin TimelockController, then its PROPOSER, EXECUTOR and admin roles through RoleGranted), delay() + admin()/owner()/authority() (Compound Timelock or DSPause), votingPeriod() (Governor), hat() (DSChief), kernel() (Aragon app). A contract that is none of these is followed one step up through its own controllers, up to 5 steps.

Classification rules applied (read before quoting a number)

• 0 = EOA; 1 = multisig whose threshold s satisfies s ≤ n/2; 2 = multisig with s > n/2 and no delay; 3 = a 2 behind a timelock < 48 h; 4 = same with ≥ 48 h; 5 = on-chain DAO with a timelock.
• An Aave Executor (lvl1 0x5300…192a, lvl2 0x17Dd…6957) counts as 5 only if its owner() read at the block is the PayloadsController 0xdAba…aEc5 (checked for both). A Governor that holds a role with no timelock in front is "outside the grid" (no case met: the two Governors seen, UNI and ENS, sit behind a 48 h timelock).
• Timelock: every proposer and every admin of the timelock is classified. If the EXECUTOR role is restricted, a proposer only goes through with an executor, so the higher of the two levels is taken (the weakest counting executor). An EOA or a minority multisig behind a timelock keeps its level 0 or 1: the grid does not cover this case, and I chose the conservative reading.
• Asset level = the lowest of all roles read. "unclassified" = at least one holder whose mechanism cannot be derived by these reads (Aragon, registry, contract with no readable controller): it is neither a 0 nor a 5.
• 0x0 = renounced or empty role (MKR owner(), 1INCH owner()), not a holder.

Table (output of the script's --compact mode: holders of the same role and type are grouped)

Levels 0 and 1: what the framework would class as "weak security configuration" today

Among the first 25 reserves read:

1. USDC: level 0. The proxy admin 0x807a96288a1a408dbc13de2b1d087d10356395d2, the owner 0xfcb19e6a322b27c06842a71e8c725399f049ae3a, the pauser 0x4914f61d25e5c567143774b76edbf4d5109a8566 and the blacklister 0x0a06be16275b95a7d2567fbdae118b36c7da78f9 have empty code at the frozen block (re-read with a separate curl, outside the script).
2. cbETH: level 0, same FiatToken pattern (proxy admin, owner, masterMinter, pauser, blacklister: EOAs).
3. USDT: level 1. Owner 0xc6cde7c39eb2f0f0095f41570af89efc2c1ea828, a MultiSigWallet, required() = 3, getOwners() = 6 addresses (re-read with curl).

Reserves listed outside the first 25 and measured: BTC.b (0) and USDe (0 through the minter() contract; 1 even without it, through the Safe 5/10 that proposes to the timelock).

Reading: a level 0 or 1 only says that a privileged role is held by a single key or by a minority multisig. For USDC and cbETH the custody may be off chain (HSM, procedures): the framework classes the on-chain configuration, and that is what is read here. The framework also states that pause and blacklist may call for faster paths than mint or upgrade; it does not take them out of the grid.

Reserves 25 to 66 (42) were not run, except BTC.b and USDe: 40 remain to be measured with --limit 67.

Differences with the LlamaRisk and Aave Labs sheets

Sheets read on governance.aave.com (Discourse JSON API), all published by LlamaRisk under the framework:

Manual correction outside the script:

• ENS: the script gives 4 because the timelock 0xfe89…44b7 (48 h, execution open to anyone) has two proposers, the ENS Governor 0x323a…b7e3 and the contract 0x2acbf518b3759f6e1fa163294eda55bf1d0ae051 (owner Safe 5/8, expiration() = 1847389751). The bytecode of that second contract contains the selectors of veto(bytes32) and cancel(bytes32), not those of schedule; it can only cancel. Real level: 5. Searching for selectors in bytecode is a heuristic (a selector shifted by via-IR can slip through), hence a correction written separately and not coded.
• PAXGy: the script reads the owner chain (level 3: owner() of the vault and of the RolesAuthority 0xc444..99dd is a 24 h timelock whose proposer is a Safe 3/5) but not the roles held inside the RolesAuthority. Read by hand at the same block 26,184,127, on Tenderly and drpc (same values; holders replayed from the UserRoleUpdated logs on Tenderly, each re-checked with doesUserHaveRole; negative witness doesUserHaveRole(0x...dEaD, role) = 0 for roles 4, 6, 9 and 10):

- role 4, updateExchangeRate(uint96) on the Accountant 0x397e..c1fd: EOA 0x1755..4b56 and the Safe 3/5 0x0000..3f2f; - role 6, pause() on the Accountant and on three other contracts: EOA 0xe5cc..cd9e, the same Safe 3/5, and the contract 0x07f9..d5f7 (not classified here; the sheet calls it the shared Pauser); - role 9, processOrders(uint256): EOA 0xaa0e..3372; - role 10, setFreezeList(address[],address[]) on 0x9124..870a, through a second RolesAuthority 0xfadd..0727: EOA 0x363c..a464. With the rule above (asset level = the lowest role read), PAXGy is 0 (+ unclassified), the unclassified part being the contract 0x07f9..d5f7 that holds role 6. Level 3 is the level of the path that changes roles (owner chain); it is not the level of the operational roles. Not read: the code of the Accountant (the sheet states that the rate write outside the timelock is at most 0.04% per update, with one hour between two updates; this was not re-read), the code of 0x07f9..d5f7, and the exact effect of processOrders and setFreezeList. An EOA holding a role is a level 0 by the grid; it says nothing about how that key is custodied.

Limits (what a green or a number here does not prove)

• Mechanisms outside the standard getters are not read: RolesAuthority (PAXGy: not read by the script, read by hand for PAXGy), Aragon ACL (CRV, LDO), the Maker Vat (DAI), Balancer authorizer (BAL), RocketStorage (rETH), the WBTC custodian and Factory, GHO facilitators. "no role read" is not "no power".
• USDe: the MINTER_ROLE holders of the minter() contract (Ethena's mint contract, name not re-read on chain) submit orders bounded per block; level 0 is mechanical and does not measure those bounds.
• The classification of a timelock (executor rule, conservative reading for an EOA behind a delay) is a reading choice of the grid, written above.
• The frozen or active status of each reserve was not read.
• Adoption of the framework: thread t/24988 announces the move to Snapshot on 2026-07-09; the adoption date (2026-07-13) was given to me and was not re-read at the source.

Witnesses

• getThreshold() on 0x...dEaD -> ok 0x : as expected
• hasRole(FACILITATOR_MANAGER_ROLE, 0x519a3fedec3659ad4c36e1d11386f1bb68944e77) on GHO -> False : as expected
• keccak256 in pure Python is checked when the script loads, against keccak(""), keccak("PAUSER_ROLE"), owner() = 0x8da5cb5b and the topic0 of RoleGranted.
• Two full passes of the script at the same block give the same levels for the 29 assets.

NOT READ

Final pass: 0 calls in error. Provider errors (Tenderly "rate limit exceeded" code -32005, HTTP 429) were absorbed by the script's retries before any classification. While building the script: a trial pass had eth_getCode 0xca06411bd7a7296d7dbdd0050dfc846e95febeb7 (WBTC Controller) NOT READ (HTTP 525 on eth.llamarpc.com); the retry logic was fixed and the call re-read afterwards (contract, owner MultiSigWallet 6/10). A cross-check on a second provider failed: publicnode HTTP 403 and llamarpc HTTP 525 when this report was written; the cross-checks cited above were therefore made with a separate curl on Tenderly, not on an independent provider.

Rerun

python3 mesure-aave-niveaux.py --block 26184127 --compact

Options: --limit 67 for all reserves, --no-extra without BTC.b, USDe, USAT and PAXGy, --json out.json for every row with full addresses. About 5 minutes. Endpoints tried in order: Tenderly, eth.llamarpc.com, ethereum-rpc.publicnode.com; the environment's HTTPS proxy is used if one is set.

Source of this page: the README of research/aave-levels-2026-10-13, rendered without changes. Not an audit, not investment advice. All readings · Back to the dashboard.