Audit status

Effective 2026-07-18 · Canonical source: aere.network/audits.html

Honest status: as of 2026-07-18, no external smart-contract audit has been completed on any AERE Network contract. This page exists so external developers, partners, and prospective users can know that fact directly rather than discovering it via inference.

What's been audited

Nothing externally. All contracts have been reviewed only by the development team and by internal multi-agent verification passes. Findings from those internal reviews are tracked publicly in the SDK repo and addressed in the deploy log.

Planned audits

Contract bundle	Status	Target
Passkey wallets (Tier 1.15 + 1.16): MultiOwnable, AerePasskeyAccountV2, AereEntryPointV2, WebAuthn.sol	Not started	Not booked. No firm engaged, no date set. Candidate shortlist: Spearbit / Cantina / yAudit / Pashov
zkVerify stack (Tier 1.14): SP1VerifierGateway, RiscZeroVerifierRouter, AereProofRegistry	Inherits upstream	Concrete verifiers are byte-equivalent to audited upstream sources (succinctlabs/sp1-contracts, risc0/risc0-ethereum). AereProofRegistry needs its own audit.
Paymaster stack (Tier 1.3)	Not started	After consumer-app launch decision
Batch-auction DEX (Tier 1.9): AereSettlement + AereVaultRelayer + AereSolverRegistry	Not started	Before permissionless solver entry

Fuzz and property testing

Internal The contract repo ships internal Hardhat property and fuzz suites, for example saere-sink-fuzz, compliance-pool.fuzz, and AereThresholdAccount.fuzz, plus 19 invariant-property suites (covering solvency, custody, netting, bridge conservation, and authorization invariants across the contract set). The 2026-07-14 internal self-audit campaign additionally ran Slither, Aderyn, Semgrep, Mythril, SMTChecker, Halmos, and Medusa over the contracts. There is no continuous external fuzzing service and no third-party review yet.

Formal verification

Partial Machine-checked z3 SMT proofs cover the key solvency and no-theft invariants, 120-plus proved properties across the contract set, each with counterexample controls (the same figure stated on the security page). Halmos and SMTChecker symbolic analysis were run over the contracts during the 2026-07-14 internal self-audit campaign. No Certora specs and no K-framework. This is internal formal verification of contract logic, not a substitute for external human review, which remains planned.

Bug bounty

Deployed, not yet funded. AereBugBountyVault is deployed on-chain at 0x253fDCb2…69cD3 (permissionless claim, Foundation triage, 5% maximum single payout in WAERE). The reward pool is not yet funded, so no payouts can be made yet; the Foundation will fund it and formally open the program around the first external audit. In the meantime, vulnerability reports are accepted via the security.txt contact; the Foundation acknowledges reports within 72 hours and commits to coordinated disclosure with reporter credit.

Recommended action for external partners

If you are evaluating AERE for integration:

Treat the platform as Foundation-operator alpha: contracts are deployed, end-to-end paths verified internally, but external review is pending.
Do not custody user funds via AERE-issued asset wrappers. Aere issues no wrapped representations of off-chain assets (the former AereUSDC bridge was removed). AERE is the only native token; WAERE is only its 1:1 ERC-20 wrapper, not a separate asset.
For high-value flows, wait for the first external audit report (target Q3 2026) which will be published at this URL with the auditor's identity, scope, and findings.

This page is intentionally honest about gaps. We update it when status changes.