Other helpful links include:
- [https://uploads-ssl.webflow.com/62cd150e5e9efc960319c44d/6346c4525380f8fa6435c2b5_Aera_Whitepaper.pdf](https://uploads-ssl.webflow.com/62cd150e5e9efc960319c44d/6346c4525380f8fa6435c2b5_Aera_Whitepaper.pdf)

Scalable strategies onchain require best-in-class infrastructure to realize edge. Aera provides a platform from which a variety of strategies can be built.

Theft of unclaimed yield

Permanent freezing of unclaimed yield

Temporary freezing of yield for less than 1 week

Temporary freezing of funds for less then 1 week

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Aera Documentation

Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope. The final classification however takes into consideration the likelihood of the impact being achieved based on the table. When submitting a bug report, select the original assigned impact level, but please be aware that its severity level may be reassigned based on the likelihood according to this table.


| | Low Impact | Medium Impact | High Impact |
|--------|--------|--------|--------|
| High Probability | MEDIUM | HIGH | CRITICAL |
| Medium Probability  | LOW | MEDIUM | HIGH |
| Low Probability  | LOW | LOW | MEDIUM |

In addition to Immunefi’s Vulnerability Severity Classification System, Gauntlet classifies vulnerabilities using the Common Vulnerability Scoring System (CVSS). In case of discrepancy, final determination is done by Gauntlet.

__Repeatable Attack Limitations__

In cases of repeatable attacks for smart contract bugs, only the first attack is considered if the smart contracts where the vulnerability exists can be upgraded, paused, or killed. If the attack impacts a smart contract directly holding funds that cannot be upgraded or paused, the amount of funds at risk will be calculated with the first attack being at 100% of the funds that could be stolen and then a reduction of 25% from the amount of the first attack for every 300 blocks the attack needs for subsequent attacks from the first attack, rounded down. For avoidance of doubt, if a second attack would happen at 600 blocks and then a third at 900 blocks, the funds at risk would be counted at 50% and 75% of the reward from the first attack, respectively.

__Out of Scope__

In addition to previously discovered bugs acknowledged in published audits or bug bounty competitions linked here, the following are out of scope:
- Risks of MEV in executed or submitted transactions
- Risks associated with an untrusted guardian, accountant or solver
- Risks associated with faulty oracles or third-party ERC20/ERC4626 asset implementations
- Risks associated with use of `execute` by treasury
- Risks associated with unsanctioned collusion of different roles (e.g., guardian and owner of asset registry)