# Aave (AAVE) Quantum Readiness Report

> Aave has a QRI score of 1/100 and is assessed at Stage 1 (Quantum Risk Assessed) with high evidence confidence.

Evaluation date: 2026-06-11. Review status: draft. Evaluated scope: Aave protocol smart contracts (V3/V4), AAVE ERC-20 governance token, governance multisigs, oracle dependencies, and cross-chain deployments.

Aave is a production DeFi lending protocol with approximately $10B+ in TVL across 19+ networks and no quantum readiness whatsoever. The protocol inherits Ethereum's ECDSA-based security model for all user operations and relies on ECDSA multisigs for all governance, emergency, and risk-management functions. Aave has published no quantum risk assessment, no cryptographic inventory, no PQC migration roadmap, and deploys no post-quantum or hybrid cryptography. Extensive classical security audits (345+ cumulative days of review for V4) confirm strong classical security but provide zero quantum assurance. Third-party analyses (PQBeat Stage 1, StablePQC, Google Quantum AI March 2026) independently confirm Aave's governance keys are among the highest-value quantum-exposed targets on Ethereum. The protocol's ERC-1271 compatibility means it could theoretically accept PQ smart accounts in the future, but this provides no current protection. QRI Score of 1 reflects minimal baseline credit for having identifiable value-at-risk combined with the complete absence of quantum security assessment, protection, migration mechanisms, or algorithm assurance.

## Core resources

- [Aave QRI report](https://qrindex.org/projects/aave/): Human-readable assessment with score, stage, evidence, blockers, risks, and assurance notes.
- [Aave structured report data](https://qrindex.org/projects/aave/report.json): Complete report as JSON for deterministic machine processing.
- [QRI methodology](https://qrindex.org/methodology/): Scoring model, evidence handling, readiness stages, confidence, assurance, and report status.
- [All QRI project reports](https://qrindex.org/llms.txt): Score-ranked index of every published project assessment.
- [Aave official website](https://www.coingecko.com/en/coins/aave): Project-maintained website.



## Evidence sources

- [Evidence source 1](<https://github.com/aave-dao/aave-v3-origin>): Public source cited by the Aave QRI assessment.
- [Evidence source 2](<https://aave.com/security>): Public source cited by the Aave QRI assessment.
- [Evidence source 3](<https://aave.com/docs>): Public source cited by the Aave QRI assessment.
- [Evidence source 4](<https://github.com/aave/aave-v3-core>): Public source cited by the Aave QRI assessment.
- [Evidence source 5](<https://github.com/aave/aave-v4>): Public source cited by the Aave QRI assessment.
- [Evidence source 6](<https://etherscan.io/token/0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9>): Public source cited by the Aave QRI assessment.
- [Evidence source 7](<https://aave.com/docs/aave-v3/aptos/smart-contracts/acl-manager>): Public source cited by the Aave QRI assessment.
- [Evidence source 8](<https://aave.com/docs/resources/addresses>): Public source cited by the Aave QRI assessment.
- [Evidence source 9](<https://governance.aave.com/t/aave-emergency-guardian-protocol-signer-rotation/24944>): Public source cited by the Aave QRI assessment.
- [Evidence source 10](<https://aave.com/help/governance/aave-community>): Public source cited by the Aave QRI assessment.
- [Evidence source 11](<https://github.com/ZKNoxHQ/PQbeat>): Public source cited by the Aave QRI assessment.
- [Evidence source 12](<https://stablepqc.com/>): Public source cited by the Aave QRI assessment.
- [Evidence source 13](<https://governance.aave.com/>): Public source cited by the Aave QRI assessment.
- [Evidence source 14](<https://aave.com/blog>): Public source cited by the Aave QRI assessment.
- [Evidence source 15](<https://aave.com/blog/aave-v4-security-by-design>): Public source cited by the Aave QRI assessment.
- [Evidence source 16](<https://sherlock.xyz/case-studies/aave>): Public source cited by the Aave QRI assessment.