defirisk.co
rubric v1.7.0

Admin has mint() with unlimited max

Aave v3's assessment for RD-F-042 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

GHO stablecoin has admin-callable mint() via Facilitator contracts. Each Facilitator has a governance-set bucket cap enforced at contract level. Increasing caps requires a timelocked AIP (Executor Lvl1, 1-day). Cap is governance-mutable but not unlimited by single admin action. Yellow per methodology: mint with governance-set cap (changeable but enforced).

Sources #

Methodology #

Determine whether an admin-callable `mint` on a protocol token has no supply cap or an unlimited maximum supply.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol aave-v3 factor RD-F-042 score yellow collected_at 2026-04-27 23:28:46