[ARFC] Renew LlamaRisk as Risk Service Provider - epoch 4

Summary

It has been one year since LlamaRisk’s last renewal. LlamaRisk submits this proposal to renew its role as Aave’s Risk Service Provider.

Aave’s risk layer recently lost critical infrastructure operated by a departing risk provider, including automated risk-oracle infrastructure, parameter automation pipelines, and Risk Steward coverage. LlamaRisk stepped in with Aave Labs to assume control of the Risk Steward and maintain operational continuity across Aave markets.

The immediate issue is continuity.

The structural issue is ensuring Aave does not depend on risk infrastructure the DAO cannot inspect, verify, or replace without disruption.

This proposal renews LlamaRisk’s mandate and expands its scope across Aave V3, Aave V4, and Horizon, with a focus on protocol-owned risk infrastructure built on Chainlink CRE. The goal is to move Aave’s risk layer toward infrastructure owned and controlled by the DAO, with off-chain logic independently verifiable through cryptographic workflow IDs.

LlamaRisk will deliver:

• Protocol-owned risk infrastructure on Chainlink CRE.
• Risk-managed price feeds for Pendle PTs, CAPO assets, USDe, RWA NAV, and related integrations.
• Dynamic parameter automation for supply caps, borrow caps, interest rates, Umbrella calibration, credit lines, risk premiums, and liquidation configuration.
• Safety mechanisms including freeze guardians and V4 per-Spoke circuit breakers.
• Risk Steward co-ownership and operational accountability.
• AIP and governance payload review.
• Guardian signer duties.
• Monitoring, dashboards, escalation playbooks, and incident response support.
• Continued Horizon cooperation and LlamaGuard NAV expansion.
• R&D for V4-native risk systems, including RWA liquidation infrastructure and instant settlement infrastructure.
• Legal and regulatory research covering stablecoins, custody, counterparty risk, DeFi lending compliance, and tokenized RWA structuring.

LlamaRisk is currently a team of 16 contributors and expects to scale to 20+ contributors during this engagement. LlamaRisk also proposes to phase out remaining non-Aave work over six months and become Aave-exclusive by the midpoint of the engagement.

The proposed compensation is structured as:

• 1.5 million GHO paid upfront.
• 1.5 million GHO streamed linearly over one year.
• 5,000 AAVE streamed linearly over one year.

The current GHO stream with ID 100071 will be terminated.

Motivation

1. LlamaRisk’s role has evolved

LlamaRisk began serving Aave as a lean risk supplement.

That is no longer the role it performs.

Across Aave V3, LlamaRisk now provides risk frameworks, parameterization methodologies, quantitative models, market monitoring, Guardian signer duties, and governance review support across active deployments.

Across Aave V4, LlamaRisk has produced research and frameworks for Hubs and Spokes, the Reinvestment Controller, Umbrella coverage logic, credit line limits, liquidation configuration, and cross-pool contagion modeling. This work has been conducted in coordination with Aave Labs and other service providers and directly informs V4’s launch strategy and risk architecture.

Across Horizon, LlamaRisk supports due diligence, parameterization, and risk monitoring. LlamaRisk also developed LlamaGuard, a bounded dynamic NAV model for RWA integration that is being extended through Chainlink CRE as protocol-owned infrastructure.

LlamaGuard makes off-chain computation values publicly verifiable through the on-chain Parameter Registry. LlamaRisk does not retain privileged access controls, and parameter updates are cryptographically verifiable through CRE workflow IDs.

LlamaRisk also provides independent legal and regulatory research for Aave, covering stablecoin regulation, custody and counterparty risk, DeFi lending compliance, tokenized RWA legal risk, and institutional structuring.

The scope has outgrown the prior mandate and now requires a broader renewal.

2. What changed

The departure of Aave’s primary risk provider created a concentration of operational risk that must be resolved structurally.

This is not only a staffing issue.

It is an ownership and verification issue.

On March 10, the wstETH CAPO oracle failed, resulting in approximately $1.03 million in borrower damages, 47 wrongful liquidations, and more than four hours of depressed pricing.

Separately, LlamaRisk’s analysis of the WETH utilization spike and Slope2 Risk Oracle performance identified a significant divergence in risk-oracle behavior during a utilization spike.

Both incidents point to the same issue: critical risk logic was operated through proprietary systems with limited independent verification. Aave should not rely on closed infrastructure for protocol-critical risk decisions.

This proposal addresses that gap by moving Aave’s risk layer toward infrastructure owned, controlled, and verifiable by the DAO.

3. Proposed scope

The core of this renewal is protocol-owned risk infrastructure.

LlamaRisk will work with Chainlink on CRE workflow design, Certora on audit coverage, and TokenLogic where risk parameters intersect with growth, incentives, and treasury operations.

LlamaRisk also commits to private escalation with Aave Labs and service providers before public communication on sensitive matters.

LlamaGuard and risk oracles

LlamaRisk will progressively deploy a suite of risk oracles for Aave.

Aave DAO retains control through co-ownership of the CRE admin panel, cryptographic verification through workflow IDs, and no update or shutdown without Aave DAO explicit consent.

Priority integrations include:

#	Integration	Scope
1	Pendle PT Price Oracles on CRE	On-chain methodology for PT exposure.
2	Aave V3 and V4 Interest Rate Analysis	IRM coverage across Slope1, Slope2, base rate, and optimal utilization.
3	Dynamic Supply and Borrow Caps	Automated cap management across active deployments.
4	SVR Monitoring and Configuration	Parameter inputs from SVR auction data and MEV recapture analysis.
5	Aave Umbrella	Coverage calibration and risk monitoring.
6	CAPO Risk Oracle	CRE-based validation for LST, LRT, and stablecoin pricing.
7	USDe Oracle and Freeze Guardian	Circuit-breaker design for Ethena and related yield-bearing stablecoin exposure.
8	Dynamic RWA NAV Feeds	LlamaGuard NAV expansion for Horizon and future RWA use cases.

V4-native risk work

V4 introduces new parameter surfaces that require dedicated modeling from inception.

LlamaRisk will cover:

#	Integration	Scope
1	Credit Lines and Draw Caps	Hub and Spoke exposure limits.
2	V4 Liquidation Configuration	Target HF calibration and liquidation bonus modeling.
3	Freeze Agents	Per-Spoke circuit breakers.
4	Dynamic Risk Premiums	User-level pricing based on collateral risk.
5	Reinvestment Controller Limits	Allocation limits that protect supplier withdrawal guarantees.

V3, V4, and Horizon coverage

Aave V3 remains critical infrastructure during the V4 migration period. LlamaRisk will continue V3 market monitoring, parameter recommendations, cap management, oracle design, Umbrella calibration, SVR monitoring, AIP payload review, and governance participation.

For Aave V4, LlamaRisk will support parameterization of Hubs, Spokes, credit lines, isolation pools, liquidation configuration, risk premiums, and related controls.

For Horizon, LlamaRisk will continue supporting due diligence, NAV methodology, parameterization, RWA monitoring, LlamaGuard development, and the Horizon Vision 2026 roadmap.

R&D and tooling

LlamaRisk will continue investing in simulation, monitoring, and incident response tooling for Aave’s risk operations.

This includes stress testing for V4 cross-Spoke contagion and credit line utilization, RWA simulations for settlement friction and NAV deviation, expanded SVR monitoring, off-hour protection modules for tokenized equities, corporate event handling automation, and updated incident response SOPs.

R&D tracks include a liquidator Spoke for RWAs and self-custodied integrations with limited secondary-market liquidity, and an instant settlement bridge aligned with the goal of internalizing looping infrastructure.

4. Fee and team scaling

The proposed renewal uses the following payment structure:

Component	Amount	Payment Method
Upfront payment	1.5 million GHO	Immediate payment
Streamed payment	1.5 million GHO	Linear stream over one year
Streamed payment	5,000 AAVE	Linear stream over one year

The upfront payment funds immediate absorption of departing scope, contributor scaling, and infrastructure buildout required for continuity.

The streamed component aligns compensation with delivery over the engagement.

LlamaRisk is currently a team of 16 contributors and plans to scale to 20+ contributors during the engagement.

Planned hires include:

Role	Primary Assignment
Backend Engineer	CRE risk oracle deployment pipeline and monitoring infrastructure.
Quantitative Researcher	V4 parameter modeling, credit line calibration, and risk premium methodology.
Smart Contract Developer	Risk Steward integration, governance payload review, and Spoke development.
Team Lead, Risk Oracles	CRE risk oracle engineering and deployment coordination.

Specification

Proceed with the immediate payment of 1.5m GHO, and create a payment stream of 1.5m GHO and 5,000 AAVE to address 0x9eE16dBDE572886342fc1e2Db8525DEFB007b27c a LlamaRisk-controlled multisig for 1 year. Terminate current GHO stream (ID = 100071).

Next Steps

If the ARFC snapshot outcome is YAE, escalate to the AIP stage.