I personally opened Aave V3's core contract on-chain and found the audited code sits behind an upgradeable proxy — the logic pointer can be swapped with one click. With 2025's on-chain losses topping $17B, mostly from keys and social engineering rather than code bugs, here are the three questions to ask before any 'audited' badge reassures you.