How to secure $70 billion in DeFi: Aave's approach to Web3 security at scale | Ernesto Boado (BGD Labs)

What happens when you're responsible for $70 billion in user funds and every code change requires approval from hundreds of token holders? Ernesto Boado discovered that managing AAVE's security feels identical whether it's $10 million or $70 billion at stake—the key is abstract thinking that prevents paralysis while maintaining rigorous procedures.

As co-founder of BGD Labs and former CTO of Aave, Ernesto reveals how they've kept the world's largest DeFi protocol secure through systematic auditor evaluation, strategic upgrade decisions, and a hands-on approach to security research relationships. His contrarian take on bug bounties and practical insights into decentralized governance offer a blueprint for scaling security in the trillion-dollar DeFi ecosystem.

Topics Discussed

 

• Systematic auditor evaluation introducing "wildcard" security firms rather than relying on traditional "big three" vendors to avoid dependency and test new partnerships.
• Psychological scaling approach where $70 billion TVL feels identical to $10 million in development decision-making to prevent analysis paralysis while maintaining security rigor.
• Security researcher relationship building through consistent code engagement over multiple submissions and honest bounty evaluation rather than adversarial dynamics.
• Decentralized upgrade governance requiring documentation clear enough for unfamiliar auditors to understand, using explanation clarity as the ultimate readiness test.
• Development tooling evolution from Truffle/Remix in 2018 to Foundry adoption in 2022, reflecting DeFi's maturation from experimental to production-ready infrastructure.
• Strategic formal verification approach targeting specific system components while avoiding generalized application that delivers diminishing security investment returns.
• Contrarian perspective on bug bounty programs as currently broken due to adversarial relationships between security researchers and protocol teams.
• AI impact predictions for systematic vulnerability detection and improved documentation while recognizing limitations in finding complex multi-component exploits.