Summary
Ketju does not approve Aave Horizon: Aave’s statements conflict over who controls it, and it shares code with markets that took $177-200M of bad debt. Horizon shares its code, oracles and governance with Aave’s core markets, which took that bad debt in April 2026. Horizon itself has recorded no bad debt. It is a permissioned deployment of the audited Aave V3.3 code. Institutions borrow USDC, RLUSD and GHO against allowlisted tokenized RWAs, including Superstate USTB and USCC, Centrifuge JTRSY and JAAA, Circle USYC and VanEck VBILL. LlamaRisk sets risk parameters and Chainlink NAVLink supplies prices, both real institutional safeguards. Aave’s blog says, "Aave Labs does not control or operate any version of the Aave Protocol," while its governance forum gives Aave Labs an "Executive role" over Horizon’s risk parameters, oracles and listings. In April 2026, a LayerZero bridge exploit let attackers mint unbacked rsETH and borrow against it in Aave’s core markets. Horizon TVL also fell 28% in a month in a July 2026 snapshot.
Review triggers
- Aave's own public materials state Aave Labs' authority over Horizon consistently, resolving the conflict between "does not control the Protocol" and "Executive role"
- Horizon shows no correlated exposure through a later exploit or bad-debt event across the Aave system
- TVL and active-loan volume recover and stabilize, ending the multi-month decline documented through July 2026
- A primary Certora (or equivalent) audit report specific to the Horizon deployment is published and reviewed
Facts
- Verdict
- Not approved
- Type
- Other
- Chains examined
- Ethereum
- Reviewed
- Last confirmed