> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gauntlet.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Audits, trust assumptions, and security properties for partner compliance and due diligence

This page covers the security properties you can reference for compliance and due diligence. Aera, a Gauntlet product, uses audited smart contracts, constrained roles, and on-chain enforcement to limit risk. The protocol has had zero exploits since launch.

## Audits

The Aera V3 protocol contracts powering Gauntlet vaults have been reviewed by multiple independent firms:

| Auditor          | Scope                  | Type              | Notes                                                                        |
| ---------------- | ---------------------- | ----------------- | ---------------------------------------------------------------------------- |
| **Spearbit**     | Aera V3 core contracts | Audit (June 2025) | Comprehensive review of BaseVault, hooks, provisioner, and guardian patterns |
| **OpenZeppelin** | Aera V3 contracts      | Audit             | Core vault and access control logic                                          |
| **Cantina**      | Aera V3 contracts      | Competitive audit | Community security competition with multiple independent reviewers           |
| **Immunefi**     | Ongoing                | Bug bounty        | Active bounty program for responsible disclosure                             |

<Info>
  Audit reports are published by the Aera protocol team. For the latest reports, see the [Aera security documentation](https://docs.aera.finance/the-protocol/security).
</Info>

## Gauntlet Risk Management

Aera is built and operated by Gauntlet, which has managed risk across 100+ DeFi protocols covering \$48B+ in digital assets. Gauntlet operates as the guardian for Aera vaults, bringing institutional-grade risk infrastructure to vault operations:

* **Real-time monitoring** -- Gauntlet's risk systems continuously evaluate market conditions, protocol health, and portfolio exposures to inform guardian operations.
* **On-chain enforcement** -- Risk constraints are enforced at the protocol level via the [guardian model](/guides/concepts/supported-protocols/aera-v3/guardian-model) and [hooks](/guides/concepts/supported-protocols/aera-v3/hooks). Constraint violations revert within the same transaction -- there is no delay between detection and enforcement.
* **Curation methodology** -- Markets and protocols are evaluated against smart contract risk, liquidity risk, oracle risk, and counterparty risk before inclusion in any vault's allocation set. See [Curation](/guides/concepts/curation).

## Trust Assumptions

| Participant     | Trusts                                                               | Verified On-Chain                          |
| --------------- | -------------------------------------------------------------------- | ------------------------------------------ |
| **Depositor**   | Vault owner to set safe constraints; guardian to operate competently | Hook validation, share accounting          |
| **Vault Owner** | Guardian to follow strategy; hooks to enforce rules                  | Hook execution, Merkle proof validation    |
| **Guardian**    | Hooks to validate correctly; DeFi protocols to behave as expected    | Operation execution through vault contract |

**What is not trustless:** Strategy quality depends on Gauntlet's off-chain risk analysis. Guardian liveness is required for active management (depositors can still withdraw if a guardian goes offline). Merkle tree updates are a governance action, not automated.

## Circuit Breakers

* **Pause** -- Vault owner or any guardian can halt all guardian operations within a single block, while preserving depositor withdrawals. No governance vote or timelock required.
* **Hook-level guards** -- Individual hooks can reject operations when prices or exposures deviate beyond thresholds. Enforcement is synchronous -- violations revert the transaction before any state change.
* **Multi-guardian isolation** -- Vaults support multiple guardians with independent permission sets. Compromising one guardian does not grant access to another's operations.

For the full contract security model, see [Aera V3 Guardian Model](/guides/concepts/supported-protocols/aera-v3/guardian-model), [Aera V3 Hooks](/guides/concepts/supported-protocols/aera-v3/hooks), and [Contract Reference](/contract-reference/overview).