Aave governance is considering an upgrade to the Pendle PT risk oracle stack for PT-srUSDe-22OCT2026 that would move the system onto protocol-owned infrastructure built on Chainlink CRE. The proposal says the full risk management pipeline is already deployed on Ethereum and would keep governance in control while automating how key parameters are calculated and written on-chain.
The plan does not change Aave’s core risk methodology for this asset. Instead, it changes how updates are delivered, replacing the current off-chain sender and on-chain write path with a new router-based setup that records parameters and tuning choices on-chain and lets governance own the supporting contracts.
What the upgrade changes
Under the proposal, Aave Governance would own every new contract involved in the PT risk oracle flow. A risk manager would still be able to propose changes, but the system is designed so that parameter settings and methodology adjustments are visible on-chain rather than handled through a less direct operational path.
The existing linear discount-rate model would remain in place, as would the Risk Agents middleware already used by the protocol. The shift is focused on infrastructure: the proposal replaces the current reporting and update route with a protocol-owned pipeline that is intended to be automated, on-chain, and easier to verify.
How the new pipeline works
The design uses three Chainlink CRE workflows. One handles the smoothed implied rate through an EMA process, another computes the discount rate, and a third determines the risk parameters used for liquidation threshold, loan-to-value, and liquidation bonus.
Each workflow produces a signed report. A newly introduced router validates those reports and writes the results on-chain, while a ParameterRegistry contract stores the methodology inputs behind those calculations. According to the proposal, this lets the update path execute atomically, meaning a single signed report can update the oracle and trigger execution through the Risk Agents middleware in one transaction.
The same structure is also meant to support additional oracle families over time by consolidating them under a shared router, oracle, and registry framework.
New contracts and control framework
The proposal adds three upstream contracts: LlamaguardRiskOracle, LlamaguardRiskOracleRouter, and ParameterRegistry. These would sit alongside existing components such as the risk agents, AaveOracle, and PendlePriceCapAdapter, which are preserved rather than replaced.
Governance ownership and access controls are central to the design. Signed CRE workflow outputs would be checked by the router before any on-chain write occurs, and the proposal says safety checks and multisig governance for changes remain in place. Auditing is concentrated on the new pieces, with Certora expected to cover both the on-chain contracts and the CRE workflow surfaces tied to them.
Why Aave says the model is being kept
Aave’s proposal says the onboarding approach and dynamic risk parameters stay aligned with the protocol’s current dynamic risk model for Pendle principal tokens. In practice, that means the central valuation still relies on a smoothed discount-rate mechanism rather than reacting directly to every AMM price movement.
The stated aim is to remain aligned with the AMM over time while using a smoothed price history, cooldown periods, and guarded update conditions. The proposal frames this as a way to keep the oracle behavior transparent and predictable while maintaining a defensive setup for positions that may carry high leverage.
What happens next
The forum post is at the ARFC stage, so the immediate next step is community discussion and feedback. If governance participants reach consensus, the proposal could move forward to a Snapshot vote and then to the AIP process for formal activation.
The short approved summary tied to the proposal says activation would register two predeployed agents, assign them RISK_ADMIN roles, and limit individual changes to 100 basis points for the discount rate and 50 basis points for eMode parameters, with 48- to 72-hour delays and the ability for governance to disable either agent. Those steps remain subject to the governance process.
Source: governance.aave.com