Lending protocol · AAVE. Full quantitative scorecard under Methodology v1.1 — normalized bands, weighted scoring, fatal-flaw notching caps, and a stress-tested Solvency grade across four standardized shocks.
Aave still earns far more than it emits: protocol revenue of $87.1M over twelve months against about $10.4M of AAVE rewards. The grade moves from AA to A for two reasons. TVL is 52% lower than a year ago, and the April 2026 rsETH incident showed a dependency risk that the July 21 rating did not score.
| Input | July 21 | November 13 | Source Or Basis |
|---|---|---|---|
| Sustainability ratio | 13.4x | 8.3x | Protocol revenue $87.1M over 12 months; about 92,800 AAVE of staking and farming rewards, about $10.4M (DefiLlama). July used a blended $402M revenue figure. On total fees of $611M the ratio is higher; both are above the 5x top band. |
| Treasury runway | 999 mo | 999 mo | Not re-checked. Estimate carried over from July 21. |
| TVL stability | 35% (90-day) | 52% | Methodology v1.1 scores the worse of the 90-day drawdown (21.3%) and the 12-month decline (52%: $15.6B now, $32.5B a year ago). Peak to trough inside the year was 66.6% (DefiLlama). |
| Collateral cushion | 74.8% | 74.2% | Borrowed $11.6B against $15.6B of net deposits (DefiLlama). |
| Unlock pressure | 0.5% | 0% | No scheduled unlocks remain in DefiLlama's schedule. |
| Oracle & dependency risk | 9 / 10 | 6 / 10 | Analyst judgment. The rsETH loss came through collateral Aave had accepted at high loan-to-value. DefiLlama's hacks database also lists a March 12, 2026 oracle misconfiguration on Aave V3 ($862K). |
| Exploit financial impact history | 10 / 10 | 6 / 10 | Analyst judgment. Estimated bad debt of $124M to $230M in April 2026, later resolved through the DeFi United recovery. |
These scenarios were run on the July 21 inputs and have not yet been re-run on the refreshed scorecard. They are shown as published. April 2026 is now a real observation to set beside them: Aave's TVL fell from $26.4B on April 18 to $14.2B by April 26, about 46% in eight days (DefiLlama), and WETH utilization reached 100%. The S2 bank-run scenario assumed a 60% drawdown and 90% utilization.
| Scenario | Revenue Δ | Treasury Δ | Drawdown | Utilization | Score | Grade |
|---|---|---|---|---|---|---|
| Base (July 21) | 0% | 0% | 35% | 74.8% | 89.3 | AA |
| S1 · Market crash | -40% | -30% | 50% | 88% | 81.8 | AA |
| S2 · Bank run | -50% | -10% | 60% | 90% | 78.0 | A |
| S3 · Stablecoin depeg | -20% | -10% | 45% | 80% | 80.5 | AA |
| S4 · Dependency failure | -30% | -10% | 40% | 78% | 76.5 | A |
Team transparency and the live bug bounty program both score a full 10/10 — Aave Labs is fully doxxed with a track record since 2017. The softest spot is governance activity: forum and Snapshot/AIP participation is real, but voting power is delegate-concentrated.
Legitimacy inputs were not re-scored in this refresh and are carried over from July 21. The April 2026 response (rsETH markets frozen within 85 minutes, a recovery led by Aave, a published post-mortem) is consistent with the 9 / 10 exploit-response score.
Aave is still the largest lender we rate, with 33% of DefiLlama's Lending category, and has the deepest integration surface in DeFi. The outlook stays BB and the score falls from 58.5 to 46.5: TVL and borrows are both about half what they were a year ago, and revenue is down 32%.
Sources (DefiLlama, November 13, 2026): TVL $15.6B against $32.5B a year ago; $15.6B of the $46.9B Lending category; protocol revenue $87.0M against $127.2M in the prior twelve months; borrows $11.6B against $23.6B. Active users, integrations and retention were not re-checked and are carried over from July 21.
DeFiScoreAudit publishes all three axis grades separately by design. The Solvency grade is the credit grade. Legitimacy is published beside it, and Growth is shown as a separate outlook on adoption; neither is averaged into the credit grade.
The credit grade answers one question: can Aave survive stress and pay its users back. It did in April 2026, with outside help. The grade is A because that help was needed and because deposits are half what they were a year ago.
Growth is Aave's weakest axis: Solvency is A and Legitimacy is AA, but TVL, borrows and revenue are all down on the year. It shows where Aave is most exposed; it is not a statement about Aave's ability to pay its users back.
