ecrecover zero-address return unchecked

Aave v3's assessment for RD-F-019 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Aave v3 core lending contracts do not use ecrecover for signature recovery. Admin changes go through governance proposals, not ECDSA signer-recovery patterns.

Sources #

GitHub
aave-v3-origin Core Contractsaave-v3-origin (no ecrecover in core contracts)retrieved 2026-04-27

Methodology #

Determine whether any `ecrecover` call result is used without a `!= address(0)` guard.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol aave-v3 factor RD-F-019 score green collected_at 2026-04-27 23:28:46