Aave Loses Chaos Labs Risk Manager Amid V4 Budget Dispute and Governance Crisis

Chaos Labs, the primary risk management firm for Aave since November 2022, has terminated its engagement citing a fundamental disagreement over risk management strategies for the upcoming V4 architecture. The firm declined an offer to increase its budget to $5 million, arguing that $8 million was the minimum required to manage the simultaneous operation of V3 and V4 systems. This departure marks the third exit of a core contributor in two months, following the departures of BGD Labs and the Aave-Chan Initiative.

The conflict centered on a significant budget disparity and philosophical differences regarding the new V4 codebase. Chaos Labs CEO Omer Goldberg noted that the firm operated at a loss for three years and that the proposed funding fell short of the 6-10% allocation typical for compliance in traditional finance. According to reports, the firm also highlighted undefined legal liability for DeFi risk managers, which creates a high-risk environment without clear safe harbor provisions.

Aave founder Stani Kulechov confirmed that the protocol will transition primary risk management responsibilities to LlamaRisk to maintain its two-layer economic risk model. The firm emphasized that the transition will not disrupt smart contracts, token listings, or network integrations. However, the loss of the team responsible for zero material bad debt over three years raises concerns about operational continuity during the critical migration period.

What Drives the Budget and Strategic Split Between Aave and Chaos Labs?

The termination of the engagement stems from a fundamental misalignment on how risk should be prioritized as the protocol scales. While Aave Labs proposed increasing the budget to $5 million, Chaos Labs estimated that $8 million was necessary to cover V3, V4, and institutional go-to-market work. The firm argued that the new V4 architecture required significant new investment in tooling and simulations that could not be achieved with the offered funds.

Chaos Labs managed pricing for over $2.5 trillion in deposits and $2 billion in liquidations, achieving zero material bad debt during its tenure. Despite this track record, the firm stated that subsidizing the protocol was no longer viable given the operational losses and the expanded scope of oversight. The disagreement also involved a push by Chaos to become the sole risk provider, which Aave Labs rejected in favor of a multi-vendor model anchored by partners like Chainlink.

Aave's stance remains that its two-layer economic risk model blends on-chain risk pricing with external data, a design philosophy that precludes a single-provider monopoly. Chaos Labs contended that its purpose-built Risk Oracle infrastructure could not simply be ported to the entirely new V4 architecture without substantial reinvestment. The firm noted that the transition requires operating both V3 and V4 simultaneously, effectively doubling the workload without a corresponding increase in resources.

How Does the Departure Impact Aave V4 Migration and Governance Stability?

The exodus of Chaos Labs exacerbates a governance crisis as it marks the third loss of a core contributor in a short timeframe. The departure follows earlier exits driven by centralization concerns, compressing the institutional knowledge base inside the DAO. Aave founder Stani Kulechov acknowledged the challenge, stating the protocol will proceed with a security-first approach while seeking new risk service providers.

The structural exposure is critical as Chaos Labs managed the system determining collateral factors, liquidation thresholds, and interest rates for a platform holding over $50 billion in TVL. The V4 upgrade involves rewriting underlying architecture and liquidation logic, requiring both systems to run concurrently. This dual-layer approach aims to preserve risk responsiveness during the migration where both systems must be managed simultaneously.

The exit leaves Aave with a risk management vacuum during a critical transition period as it navigates the V3 to V4 migration. The lack of legal protections for DeFi risk managers creates a high-liability environment where the team bears the downside of potential failures without clear safe harbor provisions. A March 2026 oracle misconfiguration triggering $26.9 million in erroneous liquidations highlighted the risks of the current regulatory ambiguity.

What Are the Operational and Legal Risks for DeFi Risk Managers?

Chaos Labs highlighted undefined legal exposure, noting the absence of a regulatory safe harbor for DeFi risk managers who face potential blame if protocols fail. The firm argued that potential blame for failures outweighed the rewards of success given the current regulatory environment. This lack of clarity contributes to the difficulty in retaining expertise as core contributors depart.

The firm operates at a loss, allocating just 2% of Aave's projected $142 million revenue to risk functions, compared to the 6-10% typical in traditional finance. The departure underscores the operational complexity of migrating legacy systems while maintaining parallel operations, with risks of knowledge loss and undefined liability for external providers.

Aave confirmed the transition will not disrupt smart contracts, token listings, or network integrations. The protocol plans to work closely with LlamaRisk to ensure a smooth transition while maintaining its two-layer economic risk model. This move signals broader issues in DeFi contributor retention and regulatory uncertainty.

LlamaRisk will assume expanded duties with increased funding and team support to fill the gap left by Chaos Labs. The protocol is also introducing a technical risk layer managed directly by Aave Labs to complement the existing economic risk model. This dual-layer approach aims to preserve risk responsiveness during the V3 to V4 migration where both systems must be managed simultaneously.

The departure highlights deep divisions within the ecosystem regarding the allocation of resources for risk management versus development. The firm emphasized that the $5 million budget was insufficient to cover the expanded scope of Aave V4's new smart contract codebase and liquidation logic. Chaos Labs determined the engagement was no longer viable given the combination of financial and operational constraints.