Aave plans to end its Aptos vulnerability bounty program

Key Points

Aave is reviewing existing security settings for its Aptos deployment.

The Aptos version of Aave V3 uses the Move language and has an independent technical scope.

Another governance proposal involves lending activities and possible restrictions on new uses.

A July market snapshot showed a sharp decline in liquidity and negligible revenue.

Both measures require governance approval to have an impact on the agreement.

Aave's latest ARFC requests the DAO to terminate Aave V3 vulnerability bounty program on Aptos and end Cantina's role as its provider.

The Vulnerability Bounty Program pays independent researchers effective vulnerability reporting fees. The program provides a continuous feedback channel for safety issues after a product is launched.

The request comes as Aave is discussing separately the future of its Aptos lending market. These discussions involve the market itself and its supporting services.

Two governance requests cover different parts of Aptos

Discussions on Aptos involve two Aave proposals.

Market Proposal: The July ARFC on low-adoption markets recommended limiting new uses of Aave V3 on Aptos while gradually reducing existing positions.

Bounty Proposal: The new ARFC asked Aave whether he should continue to fund a vulnerability bounty program that targets Aptos only through Cantina.

Market proposals involve deposits, borrowings and available liquidity. The bounty proposal covers rewards for researchers who report security issues.

Both requests are awaiting governance approval. Unless subsequent governance actions implement any of these measures, the agreement configuration will remain unchanged.

Why Aptos has a dedicated vulnerability bounty program

Aave launched a stand-alone version of V3 on Aptos. Aptos uses the Move language, while Ethereum smart contracts usually use Solidity.

According to Aave's announcement, Move-based deployments have gone through audits, Cantina Mainnet security competitions, and a vulnerability bounty program that provides up to 500,000 GHO (Aave's stablecoin).

Each measure has a different purpose: audits check code before and after release; security competitions give researchers time limits to test projects; and the vulnerability bounty program rewards valid reports during operation.

The scope of Aptos announced by Cantina covers Move modules, front-end components, APIs and deployment configurations. The plan covers the complete Aptos product setup.

Aave outlined this arrangement in its 2026 bounty plan reorganization proposal, allocating Aave V3 on Aptos to Cantina, while other Aave products use a different provider.

Aptos market activity has dropped significantly

July market proposals described a sharp decline in Aptos activity. As of release, it is estimated that supply assets are approximately $1.7 million and liabilities are approximately $719,000. Available liquidity dropped to $1 million from approximately $18 million in the past six months, while quarterly revenue was below $1000.

These numbers reflect market conditions reported in July. The proposal proposes freezing Aptos reserves and setting supply and borrowing caps to 1. Once approved, meaningful new deposits and borrowings will be discouraged, while existing suppliers and borrowers will gradually reduce their positions.

The document does not disclose the cost of the bounty program, so the relationship between the fee and the market decline cannot be directly calculated. However, the low level of activity provided the context for Aave to review Aptos exclusive security plans.

What these proposals mean for users and researchers

For Aave users: Bounty proposals affect reward programs for external researchers. Lending parameters, withdrawal rights and borrowing conditions remain relevant to real-time protocol configurations and any separately approved market changes.

Users holding Aptos positions should pay attention to market proposals and subsequent governance decisions. These measures will determine the schedule and limits of activities on Aave V3.

For security researchers: Eligibility follows the active terms issued by Aave and Cantina. The ARFC requires the program to be terminated, and the scope of the release and any approved termination terms will determine which reports are eligible for rewards.

Closing the bounty program will close public reporting and reward channels for Aave V3 on Aptos.

Two Aptos projects are now advancing simultaneously

Aave Labs documented the release of Aave V3 on Aptos in its June 2025 development update. This release introduces the first deployment of Aave outside of an Ethereum-compatible network and requires its own code base and security settings.

Approval of both proposals would narrow Aave's business in Aptos. Markets will reduce new lending activity and the exclusive public bounty program through Cantina will also close.

These decisions involve Aave's own Aptos deployment, its level of activity, and the work needed to maintain operations.