Aave Labs puts 66.2% of its budget into code and audits

Aave Labs assigned 43.7% of its 180-day budget to core development and another 22.5% to security audits, according to its 180-day report on the Aave Governance Forum. The report covers Q2 and Q3 2026 and is the first update issued under the Aave Will Win Framework, which governance approved in April 2026.

The two categories account for 66.2% of the budget: 43.7% + 22.5% = 66.2%. The report does not state the total dollar budget behind those percentages, so the allocation can be compared by share but not converted into a cash amount from the document.

That split puts product delivery and code review ahead of the report’s other spending categories. Aave Labs says its approximately 97-person team put an estimated 100,000 hours into work for the Aave DAO over the period, completed 6,096 tracked issues and 36 projects, and shipped 28 products, features and protocol deployments.

V4 took the operating spotlight

The report records four new chain deployments and four new Aave V4 Liquidity Hubs. It also says Aave Labs prepared and implemented the DAO-approved onboarding of 33 unique assets.

Aave V4 deposits rose from $212.6 million to $1.34 billion in Q3 2026. The increase works out to $1.1274 billion, using the report’s figures: $1.34 billion − $212.6 million = $1.1274 billion. V4 passed its first $1 billion in deposits on September 16, 2026.

The report attributes other governance and execution work to the same 180-day period: Aave Labs authored 26 onchain governance proposals and 20 Snapshot votes. In Q3, it implemented Aave V4 deployments on Avalanche, Arc and Base. Deposits across all versions of the Aave protocol grew by $9.69 billion in Q3 alone, while protocol revenue totaled $44.58 million across the full 180 days.

Security spending was paired with specific V4 work. Certora completed formal verification of core Aave V4 and Stable Vaults contracts, and three new V4 security audits were published during the period. For traders and depositors, that leaves the report’s main operational signal in the code path: capital growth was accompanied by a stated audit and formal-verification program, while the report itself remains Aave Labs’ account of the work.

GHO operations move onto Ethereum

The report’s V4 focus sits alongside a November funding update that deals with GHO stability, runway management and asset consolidation. The November 2026 funding update, authored by @TokenLogic, includes acquiring GHO to support the runway and consolidating assets onto Ethereum.

Around 1.18 million GHO held by Collectors on Plasma, Monad and Arbitrum will be bridged to Ethereum.

The same update identifies around 1.3 million of USDtb, USDG, EURC and sUSDe held by the Collector that the MainnetSwapSteward cannot currently swap. It also identifies around 121 ETH$1,903.32▼0.49% held without yield. That ETH will be wrapped into WETH and deposited into the Core instance.

The GHO GSMs on Plasma and Monad have accrued Merkl rewards of 613,000 WXPL and 1.46 million WMON. Those rewards will be transferred to the AFC and sold. The update also includes a 1,000 USDC$0.9996▲0.00% bug bounty payment to a security researcher and a 100 USDC fee to Immunefi.

For Aave V4’s audit controls, the funding update says the audit Safe’s aEthLidoGHO allowance will be refreshed down to 250,000. The concrete consequence is a lower stated allowance for that asset in the audit Safe, while the GHO, reward and idle-asset actions are directed toward consolidation, conversion or sale.

The total amount reserved for the “ongoing growth initiatives” referenced in the funding update is not stated in the fact pattern, and the update does not identify confirmed price feeds for USDtb, USDG, EURC and sUSDe. Those omissions matter for anyone trying to translate the operational plan into an exact runway or execution-risk figure.

The report follows a protocol shock

Aave Labs’ 180-day period also followed the April 18, 2026 exploit of the rsETH cross-chain bridge. The incident released 116,500 rsETH on Ethereum without a matching burn on the source chain, after which the Aave Protocol Guardian froze the affected reserves.

Governance executed AIP 478 on May 6 to liquidate rsETH attacker positions, and the asset’s backing was fully restored on May 26. That sequence is the clearest comparison point in the report’s own recent history: the new spending profile covers a period that included both the bridge response and the buildout of V4 infrastructure.

Aave Labs also assumed roughly 40 technical and supporting functions previously performed by BGD Labs and Aave Chan Initiative during Q2. Against that transfer of responsibilities, the report’s 100,000-hour estimate, 6,096 tracked issues and 36 projects describe the operating load the lab says it carried for the DAO.

The framework requires quarterly updates. The current document combines the first two quarters, Q2 and Q3 2026; the next reporting obligation is therefore the framework’s continuing quarterly cadence, while the November funding update sets out the immediate asset-consolidation and payment actions.