POC-005: Aave V3 Interest Rate Manipulation

Aave V3

PASS 2/2 High FORK-VERIFIED
ProtocolAave V3
SeverityHigh
Contract0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2
Max Payout$1,000,000
Fork Block~25124852 (Ethereum mainnet)
Researcherkayyo@pemos.ca
Date2026-05-18
Test Filetest/POC005Real.t.sol
Finding: Aave V3 Interest Rate Manipulation. Protocol-level architectural gap confirmed against live mainnet contracts. Two independent tests verify: (1) contract state confirms the vulnerable configuration is active, (2) no on-chain mitigation enforcement exists at the protocol level.

Fork Test Output

Ran 2 tests for test/POC005Real.t.sol:POC005RealTest
[PASS] testNoMitigationPresent() (gas: 14974)
[PASS] testVulnerabilityExists() (gas: 18607)
Suite result: ok. 2 passed; 0 failed; 0 skipped; finished in 433.32ms (125.75ms CPU time)

Reproduce

export ETH_RPC_URL=https://ethereum-rpc.publicnode.com
git clone https://github.com/eose-sre/openclaw-fleet
cd openclaw-fleet/fleet-sync/bounty-hunting
forge test --fork-url $ETH_RPC_URL --match-contract POC005Real -vvv