> For the complete documentation index, see [llms.txt](https://docs.aeralend.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aeralend.app/security/audit-status.md).

# Audit status

**Aera has not been audited. No security firm has reviewed the code.**

That is the whole headline, and it is not softened anywhere else in this space.

## What exists instead

* Several hundred integration tests, run against the real program in a local validator
* Property and fuzz tests over the liquidation split and the oracle's breaker bounds
* Invariants asserted after every state transition in the harness
* An internal findings report, written by the people who wrote the code

## Why that is not an audit

Tests check the faults their author imagined. An auditor is paid to find the ones the author did not.

Every meaningful category of protocol exploit — reentrancy through an unexpected callback, an account substituted for one that looks like it, an arithmetic edge in a path nobody thought to exercise, an economic attack that is individually rational at every step — is by definition a fault the author did not anticipate. A test suite written by the same people cannot cover the class of mistake that comes from their own assumptions.

## What Aera does instead

Since it cannot claim to be verified, it is built to fail small:

* **Caps.** 1,000,000 COOK of supply, 600,000 of borrowing, 250,000 per wallet. The maximum loss is bounded by numbers rather than by demand.
* **Ceilings in the code.** The origination fee, the protocol's liquidation share and the accepted stake-pool withdrawal fee all have hard maximums an administrator cannot exceed.
* **Circuit breakers.** The oracle stops rather than repricing the book on a number it does not trust, and every restricted state leaves repaying open.
* **One market, two assets.** No isolated markets are live, so there is no path from an untested asset into Core.

None of that substitutes for a review. It is what limits the damage if the review would have found something.

## Reporting a vulnerability

Privately, through a [GitHub security advisory](https://github.com/aeralend/aera/security/advisories/new). Never a public issue. The full policy, including scope and safe harbour, is in `SECURITY.md` in the repository.

There is no bug bounty programme yet.

If an audit is commissioned, this page will name the firm, the scope, the date and the report.

{% content-ref url="/pages/t7LXQCcQWJrLM6ymIahu" %}
[Risks](/security/risks.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aeralend.app/security/audit-status.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.