aere-contracts

Solidity smart contracts for Aere Network (chain ID 2800) and their Hardhat test suites.

This repository is part of the Aere Network "verify yourself" core. The deployed contract bytecode is already public on-chain (readable via eth_getCode and the block explorer), so publishing the source here lets anyone read, compile, and re-test the exact logic that runs on mainnet. Nothing in this repository can move funds or impersonate the network: there are no private keys, no mnemonics, and no deployment credentials. Every network account is supplied at runtime through environment variables (see hardhat.config.js).

Scope, stated up front

Aere Network runs post-quantum signature verification natively on mainnet: Falcon-512 (0x0AE1), Falcon-1024 (0x0AE2), ML-DSA-44 (0x0AE3), SLH-DSA-128s (0x0AE4) and SHAKE256 (0x0AE5) have been live as precompiles since block 9,189,161. You can call them yourself against https://rpc.aere.network without asking us for anything.

Consensus on chain 2800 is classical secp256k1 ECDSA QBFT. The post-quantum work lives at the signature, precompile, account and transport layers. Nothing in this repository makes the consensus post-quantum, and nothing in it should be read as claiming so. Where you see post-quantum consensus discussed, it is research about what a future activation could look like, not a description of the running chain.

Two further limits worth knowing before you judge anything else here:

• 0x0AE6 (ML-KEM-768) and 0x0AE7 (Falcon HashToPoint) are testnet only. They are not active on mainnet.
• The on-chain zero-knowledge verifiers are classical BN254. They are broken by Shor's algorithm like any other elliptic-curve construction, and we do not describe them as quantum-safe.

The network is operated by seven Foundation-run validators, so its Nakamoto coefficient is effectively one today. That is a real limitation, it is on the roadmap, and it is not fixed by any code in this repository.

Layout

• contracts/ the Solidity sources, grouped by domain (pqc, pqfinality, settlement, lending, governance, paymaster, oracle, mpc, zkverify, and more).
• test/ the Hardhat test suites, including unit tests, fuzz/invariant/property tests, and the cryptographic known-answer test (KAT) vectors under test/fixtures/ and test/*.json.
• hardhat.config.js the compiler and network configuration. Keys and RPC URLs are read from environment variables only; the sole literal mnemonic present is the well-known public Hardhat default (test test ... junk) used for local test signers.
• package.json the dependency manifest.

Verify

npm ci            # installs the exact locked dependency tree
npx hardhat compile
npx hardhat test

Use npm ci, not npm install. ci installs the exact tree recorded in package-lock.json and fails if the lockfile and package.json disagree, so you are running against the same dependency versions we measured. install is free to resolve newer versions and will quietly give you a different tree.

Step-by-step instructions with the expected output at each step, the measured pass and coverage numbers, and the required tool versions are in REPRODUCE.md. The same three commands run on every push through .github/workflows/ci.yml.

To reproduce against the live chain, point AERE_RPC_URL at the public RPC (https://rpc.aere.network, chain ID 2800) and compare compiled bytecode to the on-chain code. The full reproducibility manifest lives in the aere-docs repository (REPRODUCE.md).

What is deliberately not here

Deployment scripts, deploy keys, .env files, infrastructure configuration, and business or operations material are intentionally excluded. This repository is source plus tests only.

License

MIT. See LICENSE.