Aave reports v2 vulnerability, pauses v2 contracts, and funds are safe - but v2 forks may still be at risk