Aera V3

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED ON NO REGULATORY REGISTRATION ANYWHERE, AN UNCLEAR GAUNTLET RELATIONSHIP, AND NO BOUNDED REDEMPTION TIMELINE, NOT ON A DISCLOSURE FAILURE. Aera V3 is genuinely well-disclosed relative to its closest comparator, Mellow Core, already rejected in this registry: its Terms of Service were fetchable and name the operator plainly, Aera Foundation, governed under Cayman Islands law, with Spearbit, OpenZeppelin, and Cantina audit coverage plus an active $500,000 Immunefi bug bounty. But that same Terms of Service document states Aera Foundation is not registered with the SEC, CFTC, or the Cayman Islands Monetary Authority in any capacity — not as an investment adviser, broker-dealer, commodity pool operator, or virtual asset service provider. DefiLlama’s own description states Aera was ”built by the team at Gauntlet,” but this review could not independently confirm from any source whether Aera Foundation is currently a fully spun-out, independent entity or remains Gauntlet-affiliated — the claim traces only to Aera’s own marketing. And for multi-depositor vaults, the redemption mechanism is solver-filled and asynchronous with no disclosed bounded settlement time.

Kill criteria: the events that revoke this verdict
• Aera Foundation’s current relationship to Gauntlet — fully independent or still affiliated — is independently confirmed
• A bounded maximum settlement time for multi-depositor vault redemptions is disclosed
• Any regulatory registration relevant to the products offered is obtained and disclosed
• Protocol-level fee, oracle, and guardian-whitelist authority is placed under a disclosed multisig with a meaningful timelock

The research file

Mechanism

A vault owner deposits assets and appoints one or more Guardians — off-chain actors who submit on-chain transactions constrained by a Merkle-tree whitelist enumerating exactly which contract calls each guardian may make, validated by pre- and post-execution hooks. Any transaction outside the whitelist or violating a hook reverts on-chain. Guardians cannot deposit or withdraw funds, modify their own permissions, or appoint other guardians. Single-depositor vaults allow instant owner-initiated withdrawal; multi-depositor vaults route deposits and redemptions through a solver-filled Provisioner contract rather than settling atomically.

No regulatory registration and an unclear Gauntlet relationship

Aera Foundation’s Terms of Service explicitly disclaim registration with the SEC, CFTC, or the Cayman Islands Monetary Authority as an investment adviser, broker-dealer, commodity pool operator, or VASP, and state Aera does not hold custody or broker trades — a standard unregulated-DeFi posture, disclosed plainly rather than buried. DefiLlama and Aera’s own site both describe the protocol as ”built by Gauntlet,” employing Gauntlet’s economic research team and Auditless’s smart-contract engineers, but no independent source confirmed whether Aera Foundation is currently a fully separate entity or remains operationally tied to Gauntlet — a material ownership question this review could not resolve.

Control

The vault owner holds ultimate control — appointing and removing guardians, configuring hooks, and pausing the vault. But protocol-level authority sits centrally with the Aera team: setting the protocol fee recipient, managing the oracle registry, and maintaining the guardian whitelist contract, with oracle updates subject to a 21-day delay but many other parameters not similarly protected. Aera’s own documentation acknowledges guardians confined to whitelisted contracts can still act negligently or self-interestedly within those bounds, including atomically sandwiching a transaction they themselves initiated.

Eligibility and redemption

The Terms of Service require users to represent they are not on OFAC, UK, or Cayman Islands sanctions lists, and Aera reserves the right to restrict availability ”to any person, geographic area, or jurisdiction” in its sole discretion — a broad, undefined reservation rather than a specific eligibility rule. Single-depositor vaults settle instantly for the owner; multi-depositor vault redemptions are solver-filled and asynchronous, with unfilled requests refundable past a deadline but no disclosed maximum settlement time in any source this review could access.

Track record and comparison

Tracked TVL is roughly $142M across Base and Ethereum (Morph shows no current balance), grown from a small base in early 2025. No hack or exploit specific to Aera was found on DefiLlama’s hacks tracker, though this review’s incident-history search was not exhaustive. Against Mellow Core, Aera’s jurisdiction and entity disclosure is materially better — a real, fetchable Terms of Service naming a specific entity and law, versus Mellow’s unreadable, IP-blocked document — but Aera still lacks any confirmed regulatory registration, a settled ownership relationship with Gauntlet, and a bounded redemption guarantee for the multi-depositor structure most clients would actually use.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Aera — Terms of Service · primary · accessed 2026-08-19
  Supports: Aera Foundation Cayman Islands entity, no SEC, CFTC, or CIMA registration disclaimer, sanctions representation and sole-discretion access restriction
• Aera documentation — protocol mechanism · primary · accessed 2026-08-19
  Supports: guardian merkle-whitelist and hook design, single versus multi-depositor vault mechanics, protocol-level fee and oracle authority
• Immunefi — Aera bug bounty program · primary · accessed 2026-08-19
  Supports: active $500,000 bug bounty, covered chains
• DefiLlama — Aera V3 protocol data · secondary · accessed 2026-08-19
  Supports: built-by-Gauntlet description, current TVL by chain
• Aera — mission and team page · secondary · accessed 2026-08-19
  Supports: Gauntlet and Auditless team origin claim

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.