DeFi Lending Risks Explained for Institutions

By Daniel GelfandPublished November 12, 202611 min read

Quick answer. Lenders and borrowers on Aave and Morpho face linked risks: contract bugs, bad collateral or oracle prices, thin exit liquidity, failed liquidations that leave bad debt, governance changes, and curator or counterparty choices. Judge each market separately, not the brand.

Watch: DeFi Lending Risks Explained for Institutions 1:54

Video transcript

Lending on Aave or Morpho carries linked risks, from contracts and oracles to liquidations, governance and curators. Judge each market, not the brand.

In April 2026, stolen rsETH reached Aave as collateral. LlamaRisk found Aave's contracts were not compromised. Seven months on, rsETH is still frozen, backing 605.7 million dollars of WETH debt in users' leveraged loops.

WETH suppliers carried that risk without holding rsETH. Your counterparties include every issuer and bridge behind the collateral borrowers can post.

Aave relies on adjustable controls like LTV, caps and isolation mode. Morpho Blue markets are immutable, and anyone can create one with its own oracle and LLTV.

Morpho states that anyone can liquidate an unhealthy position, but no one has to. Gas costs, thin swap routes and generous oracle prices can stall it.

Larger Aave changes need a three-day vote and one-day timelock, but Risk Stewards can adjust caps, LTVs and rates within set bounds, and a Freezing Steward can freeze a reserve, without one. A four-of-seven multisig holds emergency powers. Morpho vault timelocks can be set to zero, and every shareholder absorbs losses.

Monitoring turns each risk into an owned alert. Set thresholds before capital moves, watch health factor and utilization, track oracles and governance, and test that alerts reach someone who can exit or repay.

Read the article for the risk table and checklist. Or talk to Guardian about the Digital Asset Assurance Pilot, which maps the oracle, bridge and privileged-control routes you inherit risk from.

Why Lending Risk Matters Now

In April 2026, stolen rsETH reached Aave as collateral, and the attacker borrowed WETH against it. LlamaRisk's incident report found Aave's contracts were not compromised. Aave Governance Forum

rsETH is still frozen on Aave V3 Core. As of November 9, LlamaRisk counts $661.8M of rsETH backing $605.7M of WETH debt, in users' leverage loops of 12 to 14 times.

WETH suppliers carried that risk without holding rsETH.

Risk	What fails	Who bears it	Evidence
Smart contract	Bug in lending, wrapper or vault code	Depositors in that contract	Not Aave's April cause, per LlamaRisk
Collateral	Token loses its backing	Lenders of the borrowed asset	116,500 rsETH released without a source burn
Oracle	Price sits above market value	Suppliers, once liquidation stops paying	Morpho: overpriced collateral makes liquidation unprofitable
Liquidity	Utilization reaches 100%	Suppliers waiting to withdraw	WETH at 100% on five chains, April 2026
Rates	Utilization spike raises borrow cost	Borrowers	Morpho IRM: 100% utilization sets rate at 4x target
Liquidation	No one liquidates in time	Suppliers or vault shareholders	Morpho: anyone may liquidate, no one must
Governance	Freezes, LTVs or reserve factors change	Borrowers and suppliers	rsETH LTV set to zero, April 18
Curator	Vault allocates to a weak market	All vault shareholders, pro rata	Vault V2 socializes realized losses

Smart Contract Risk

Contract risk is a bug in the lending code, or in the wrappers and vaults built on it.

Morpho Blue markets cannot be changed after deployment. No one can swap the rules under a deposit, or fix a badly configured market. Morpho

Aave relies on adjustable controls instead: LTV, liquidation thresholds, reserve factors, supply and borrow caps, and isolation mode. Aave

Across 321 current public Guardian reports, 40 match the keyword lending in a November 12, 2026 analyzer run. Those 40 hold 1,766 findings, including 50 Critical and 160 High, a report sample rather than a loss rate. Guardian

Our lending protocol audit checklist covers the code checks behind collateral, oracles, interest and liquidations.

Oracle and Collateral Risk

A loan is only as sound as its collateral and the price an oracle reports for it. Both sit outside the lending contract.

On April 18, 2026, an attacker exploited Kelp's Unichain to Ethereum LayerZero route, releasing 116,500 rsETH with no matching source burn. Aave Governance Forum

The attacker supplied 89,567 rsETH to Aave and borrowed 82,650 WETH and 821 wstETH.

Anyone can create a Morpho market. Each one picks its own collateral, loan asset, oracle, LLTV and interest rate model. Morpho

So two Morpho markets with the same assets can carry different risk. The oracle address belongs in the diligence file.

Our Kelp DAO breakdown covers how the rsETH route failed, and our Aave safety review covers Aave on its own.

Thin or forged prices drove three other 2026 lending incidents. Borrowed or extracted amounts below are not final net losses. Stellar, AllezLabs on Venus Community, Bonzo Finance Labs

YieldBlox, February 22: a manipulated USTRY feed let an attacker borrow about 61.3M XLM and 1.01M USDC against inflated collateral.
Venus, March 15: thin THE liquidity, price manipulation and a cap bypass enabled about $14.9M of borrowing, leaving just over $2M bad debt.
Bonzo, July 11: an oracle verifier accepted a SAUCE price without a valid signature; about $9.05M of principal was extracted.

Liquidation and Bad Debt Risk

Aave computes a health factor from collateral value, liquidation thresholds and total borrows. Below 1, a position may be liquidated. Aave

Aave's risk docs name liquidity and volatility as liquidation drivers. Less liquid assets get higher incentives to attract liquidators.

Morpho states that anyone can liquidate an unhealthy position, but no one has to. Dust positions, gas costs, thin swap routes and generous oracle prices can stall it. Morpho

Bad debt is what remains after all collateral is seized. Unrealized, it accrues unbacked interest, so early withdrawers exit at an inflated share price.

In April, WETH reserves on five chains hit 100% utilization. Liquidators received aWETH instead of WETH, which slowed liquidations. Aave Governance Forum

Liquidations still recovered 106,993 rsETH by May 9, through Aave and Compound. About 5,211 rsETH the attacker sold was left for the DeFi United coalition.

Backstops are narrow. Umbrella covers bad debt only in the asset and network where funds are staked: USDC, USDT, WETH and GHO on Ethereum.

A pause can block liquidations too. Guardian's public RAAC Core Contracts report found pausing the LendingPool reverted the only live liquidation settlement path (Medium, resolved). Guardian

That is RAAC's code, not Aave's or Morpho's. Ask any lender whether liquidations stay live during a pause.

Our guide to bad debt in DeFi compares who pays under each backstop design.

Governance and Admin Key Risk

Governance can change a position's terms after you enter it. The power that protects lenders can cut a borrower's capacity.

Aave began freezing rsETH and wrsETH reserves at about 19:00 UTC on April 18. LTV went to zero, but repayment and liquidation stayed open. Aave Governance Forum

Listings and larger parameter changes take a three-day vote, then a one-day timelock. Risk Stewards adjust caps, LTVs and rates within set bounds without a vote; a Freezing Steward freezes reserves at once. Aave

A 4-of-7 Protocol Emergency Guardian multisig holds emergency powers, including the V3 EMERGENCY_ADMIN role.

LlamaRisk's November proposal would freeze more Core assets and raise reserve factors to 99% on frozen reserves with over $20k of debt. On November 12 it was still under forum discussion.

Morpho governance has approved one interest rate model and nine LLTV tiers for new markets. Morpho

Our admin key census traces who can upgrade, pause or freeze at top DeFi protocols.

Curator and Counterparty Risk

Lenders can reach Morpho through a curated vault. The curator sets the allocation strategy and risk limits behind each deposit. Morpho

In Vault V2, realized bad debt lowers share value. Every holder absorbs the loss in proportion.

Cap increases and adapter changes wait out per-function timelocks. Those delays can be set to zero, so check each vault's actual settings.

Sentinels can deallocate assets, cut caps and revoke pending curator actions. Cap decreases take effect immediately.

Morpho suggests curators set maxRate to 0 while bad debt is unrealized, and run their own liquidation bots. Ask whether yours does both.

Direct Morpho Blue suppliers carry one market's risk. They can withdraw only when that market has liquidity to spare.

On Aave, your counterparties include every issuer and bridge behind collateral borrowers can post against your supply. In April, that included Kelp's bridge. Aave Governance Forum

Our vault curator risk guide scores curators, and our Morpho safety review lists past vault losses.

How Institutions Monitor Exposure

Monitoring turns each risk above into an alert with an owner. Set thresholds in policy before capital moves.

Reconcile alerts daily against position limits. Our DeFi risk scoring template sets those limits and a review cadence.

Test that each alert reaches someone with authority to exit, repay or escalate.

Check	Red flag	Response
Health factor or LLTV headroom	Buffer nears Aave's 1.0 or the market's LLTV	Add collateral or repay before liquidation
Utilization	Your supply market nears 100%	Stage your exit; withdrawals wait for repayments
Collateral backing	Issuer or bridge exploit, or unbacked supply	Check freezes and your market's collateral list
Oracle freshness and deviation	Stale feed, or a gap to market price	Halt new exposure; confirm liquidations still pay
Liquidation coverage	Unhealthy positions left open	Ask who runs bots, or run your own
Debt concentration	Top 3 positions held 69% of rsETH-backed WETH debt, Nov 9	Size your exit for a slow unwind
Governance and stewards	Freeze, LTV or reserve factor proposals, or steward changes	Reassess at proposal; freezes and steward changes need no vote
Contract changes	Upgrades, role grants or new integrations	Re-review your integration before adding exposure
Curator allocation	New market, raised cap or zero-delay timelock	Read the new market's oracle and collateral
Backstop scope	Cover excludes your asset or network	Treat the position as uncovered

Frequently Asked Questions

Is Aave safe after the rsETH exploit?

Guardian gives no verdict. By November 9, rsETH supply on Aave V3 Core had fallen 45% since the freeze, to 290.7k. LlamaRisk now proposes moving Core toward liquid bluechip collateral. Judge your own instance, collateral list and utilization. Aave Governance Forum

Is Morpho lending safe?

Morpho's docs explain how markets work, not a safety rating. Approved LLTV tiers reach as high as 98%, so a market's tier sets how thin its buffer is. Read each market's LLTV, oracle and collateral. Morpho

Do lenders get repaid after a lending exploit?

Not automatically. On March 20, 2026, Venus proposed repaying about $2.2M, including earlier debt, from Treasury and Risk Fund; it reported repayment by May 7. Bonzo provisionally estimates 81% aggregate recovery, not per account; claims targeted for the week of November 9 were unconfirmed as open on November 12. Venus Community, Bonzo Finance Labs, HARD

Does staking in Aave's Umbrella carry its own risk?

Yes. Stakers can be slashed if a deficit hits their asset and pool. The DAO covers a first-loss offset, such as 100,000 USDT for USDT. Exits need a 20-day cooldown and a 2-day window, and funds stay slashable meanwhile. Aave

Sources

Map the dependencies behind your lending exposure

Guardian's Digital Asset Assurance Pilot maps the oracle, bridge and privileged-control routes you inherit risk from, and turns the properties that must hold into executable invariant suites.

Talk to Guardian Explore the service