Aave Publishes V4 Tokenization Spoke Audit, Completes 345-Day Security Program

• Aave’s latest V4 audit reviewed the ERC-4626 Tokenization Spoke, enabling standardized tokenized liquidity integrations.
• The V4 security program spanned 345 days, combining audits, formal verification, and extensive public testing.
• More than 900 bug bounty participants reviewed Aave V4, with no critical or high-severity vulnerabilities reported.

Aave has released a new security audit for its V4 Tokenization Spoke, adding another review to its broader V4 security program. According to Aave, ChainSecurity conducted the audit, which examined an ERC-4626 compliant vault that converts Liquidity Hub deposits into fungible ERC-20 share tokens, a feature designed to support integrations connecting to Aave V4.

The latest review focused on the Tokenization Spoke, a component within Aave V4’s architecture. According to Aave, the Tokenization Spoke wraps Liquidity Hub asset deposits into ERC-20 share tokens.

Those tokens provide liquidity providers with claims on the underlying liquidity. The structure follows the ERC-4626 vault standard. As a result, developers and external protocols can interact with tokenized liquidity through a standardized framework.

Aave founder and CEO Stani Kulechov highlighted the audit on social media. He said the vault interface is particularly important for integrations seeking access to Aave V4.

The newly published report forms part of a wider V4 security initiative that lasted 345 days. According to Aave, the review process included multiple audit rounds, formal verification efforts, and public security testing. The program focused on validating the protocol’s new Hub and Spoke architecture.

Certora led continuous formal verification throughout development. Meanwhile, ChainSecurity, Trail of Bits, and Blackthorn conducted manual security assessments across several review stages. Notably, Blackthorn’s final audit cleared the submitted codebase without reporting any findings.

Beyond private audits, Aave also opened the protocol to public testing. The project hosted a six-week bug bounty through Sherlock. More than 900 participants joined the contest and reviewed the code.

According to Aave, the program produced no critical or high-severity findings. The broader audit process also reported zero high-severity vulnerabilities after code finalization. However, auditors identified several minor and low-level issues during reviews.

Teams addressed those findings before publishing final reports. The latest ChainSecurity assessment adds another layer to that process. It specifically examines the ERC-4626 vault interface that connects Liquidity Hub deposits with fungible tokenized strategies inside the Aave V4 ecosystem.