diff --git a/src/addresses.ts b/src/addresses.ts index 13b311f..9422ec9 100644 --- a/src/addresses.ts +++ b/src/addresses.ts @@ -1,6 +1,40 @@ /** * Canonical AERE Network mainnet contract addresses (chain 2800). - * Last updated: 2026-06-01 · SDK v0.16.1 (Tier 1.17 AereUSDC removed — AERE is the only token) + * Last updated: 2026-07-17 (OUTBOUND zk BRIDGE VERIFIER FIXED AND ACTIVATED. The forgeable + * AereOutboundVerifier 0x8E89…074e is SUPERSEDED by AereOutboundVerifierV2 + * 0x08b68bd553116Dffb99E648cb764AA93930da96F, which binds the guest's newly-committed + * validatorSetRoot to the IMMUTABLE live N=7 anchor 0x5fa93ba7…dd79 (plus a constant + * chainId, a MIN_SOURCE_BLOCK window and exactly-once replay). Both the guest and the + * contract were rewritten: the guest now COMMITS validatorSetRoot and pins chainId to a + * compile-time constant instead of echoing the prover's. REAL vkey + * 0x00a71f7d…08d0 (deterministic from the compiled ELF). PROVEN BOTH WAYS on mainnet: + * (+) a real Groth16 proof of a genuine Outbox log in block 10,073,141 (5-of-7 quorum) + * DELIVERED via tx 0xc27f0936…2b2b (gas 471,507); (-) a real Groth16 proof of a FORGED + * header (attacker's own 7 keys, self-sealed, attacker-built receiptsRoot) was REJECTED + * with ValidatorSetMismatch — the same forgery that the live SP1 gateway VERIFIES as a + * valid proof and that the V1 design accepts. V1 stays inert forever (programVKey==0x0, + * immutable, unfixable in place). See zk-light-client/OUTBOUND-VERIFIER-FIX-2026-07-16.md. + * Prior update 2026-07-16 (outbound zk QBFT light client REBUILT AGAINST THE LIVE 7-VALIDATOR SET: + * AereZkQbftLightClient is now 0xCaDA54FA…6488 — bound to the REAL guest vkey + * 0x00c80283…adc1 and the live N=7 anchor 0x5fa93ba7…dd79, and PROVEN end-to-end on + * mainnet (real Groth16 proof of a 5-of-7 committed-seal quorum on block 9,989,005, + * submit tx 0xc606be93…2903, gas 313,462, finalizedNumber 9,312,565 -> 9,989,005). + * The old 0xc9A2…B1c2 is marked DEPRECATED/STALE-ANCHOR: its immutable anchor is the + * historical N=3 set and it can never verify current finality. AereOutboundVerifier + * re-scoped from "PENDING CONFIG" to "INERT AND MUST STAY INERT" — its guest takes the + * validator set as private input and commits no validator-set root, so pinning a vkey + * would activate a forgeable verifier; see its entry. Prior update 2026-07-14 + * (address-book catch-up: added AereThresholdAccountFactory + * 0xf8fCC337…79E8 and AereZkQbftLightClient 0xc9A2…B1c2; both were already + * live and functioning on mainnet, confirmed directly via eth_getCode/eth_call + * against https://rpc.aere.network, but had no entry in this file; see their + * entries below for what was independently re-verified versus taken from other + * docs). Prior update 2026-07-12 (corrected-contract session added the CANONICAL AereGovernorV2 / AereGovLockV2 / AereGovernorV2Timelock governance stack, AereRewardDistributorV2, sAEREv2, AereSpokePoolV2Corrected / AereERC7683V2Corrected / AereMessengerBridgeFixInert, AereDelegate7702V2, AerePasskeyAccountFactoryV2Fixed, AereSettlementHubV2, AereHistoryStateRootAnchorV2, AereEVMValidityBatch, all FRESH/INERT corrected forks; every flawed original is left on-chain and marked DEPRECATED/FLAWED in its entry below) · SDK v0.16.12 (added AerePQCAccount + AerePQCAccountFactory — roadmap #270: a POST-QUANTUM-secured ERC-4337 v0.7 smart account whose SOLE owner is a NIST Falcon-512 public key (897 bytes, no classical ECDSA fallback), with validateUserOp AND EIP-1271 isValidSignature both decided by the LIVE on-chain AereFalcon512Verifier 0x4E8e…D8fFC. DEMONSTRATED live with a REAL reference-generated Falcon-512 keypair: isValidSignature ACCEPT=0x1626ba7e / tampered→0x0 (re-verifiable by RPC), and a full userOp through AereEntryPointV2.handleOps FIT the EIP-7825 2^24 per-tx cap [gasUsed 10,278,313 < 16,777,216, tx 0xd2e38baf…, opSuccess=true] and executed end-to-end. HONEST SCOPE: Falcon-512 (NIST level 1) not 1024; ~10.5M gas/PQC-auth [heavy but under cap; a native SHAKE precompile would cut it, separate roadmap item]; non-token). SDK v0.16.11 (added AereSphincsVerifier: on-chain NIST FIPS 205 SLH-DSA-SHA2-128s / SPHINCS+-SHA2-128s-simple STATELESS hash-based signature verifier, official NIST ACVP SLH-DSA-sigVer KAT-validated bit-for-bit 14/14, demonstrated live via eth_call; a full verify is ~1.81M gas so verifyAndRecord is RECORDED on-chain UNDER the EIP-7825 2^24 cap (unlike view-only Falcon-1024 / ML-DSA-44); completes AERE's PQC verification suite; non-token). SDK v0.16.10 (CAMPAIGN CLOSED 13/13 — last two CONFIRMED audit findings fixed, both latent liveness bugs, no theft: F12 AereLendingOracle NavOracle feed was a DEAD PATH [called latestForAsset(bytes32) on the deployed AereNavOracle, which only holds Merkle reserve-snapshot roots and has no per-asset price] -> fixed with a purpose-built owner-attested AereNavOracleAdapter [Foundation-owned] that a NavOracle-type feed points at, no LendingOracle redeploy; F13 AERE402Facilitator replay key consumed[agentId][nonce] was GLOBAL per agent so two providers with colliding per-provider nonces blocked a valid settlement -> fixed in AERE402FacilitatorV2 [consumed[agentId][payee][nonce]] cross-wired with AereAgentV2 [debit is facilitator-gated]. Both V1s deprecated below, left on-chain [F12 latent: no NavOracle feed was configured; F13 liveness only]. Live-DEMONSTRATED on mainnet with V1-reproduces/V2-corrects tests + on-chain demos [F12 byte-identical LendingOracle twin; F13 V1 collision reproduced + V2 two-payee same-nonce both settle + true replay reverts].) + * SDK v0.16.9 (bug-fix redeploys: AereRaaSFactoryV2 + its AereRollupSettlementV2 template fix F6 last-block challenge grief [DEFENSE_GRACE + slash defeated challenger to AereSink], F7 rejected-epoch finalisation freeze [re-proposable rejected epoch], the isFinalised-ancestor medium [ancestor-aware finality], and the settleRevenue residual low [flushResidualToSink]; AereCompliancePoolV2 fixes F8 unrecoverable challenge bond [UPHELD challenger reclaims the bond + root rejected; only a DISMISSED bad challenge is burned]. Both V1s deprecated below [V1 factory 0 rollups, V1 pool 0 deposits], left on-chain, harmless. Live-DEMONSTRATED on mainnet with V1-reproduces/V2-corrects tests + immutable-masked byte-identity proofs.) + * SDK v0.16.8 (bug-fix redeploy: AereStakingV2 fixes five confirmed bugs in the live AereStaking [F2 HIGH reward drain on delegate top-up; F3 HIGH locked validator self-stake; F4 MED re-register bricks delegator unbond; F5 MED APY ~5x underpay from a 0.1s-block reward constant; LOW commission credited nowhere]. V1 deprecated below, left on-chain [0 validators/0 staked/0 balance]. Reward accrual is now timestamp-based and rewardRateBps is Foundation-settable, default 800=8% APY — FOUNDER should confirm the intended live APY. Proven by a 12-test V1-reproduces/V2-corrects suite; bytecode-identical twin drove the owner-only path live on mainnet.) + * SDK v0.16.7 (bug-fix redeploys: AereFeeMonetizationV2 fixes finding #1 HIGH fee-stream squat + permanent DoS [register now requires the caller controls the contract: self or Ownable.owner(); adds unregister + reassignPayout]; AereOracleV2 fixes finding #11 single-fresh-reporter median [getPrice reverts InsufficientQuorum below a fresh-reporter quorum, minContributors default 3]. Both V1s deprecated below, left on-chain; the legacy oracle stays the live-read source until the Foundation repoints AereOracleAdapter/AereTokenPaymasterV2. Live-demonstrated on mainnet.) + * SDK v0.16.6 (bug-fix redeploys: AereDACommitteeV2 fixes finding #9 fail-open [removeMember-to-threshold-0 + attest([]) forged availability]; AereSlashingInsuranceV2 fixes finding #10 griefing [cancelCoverage now blocked once a claim matures]. Both V1s deprecated below, left on-chain with 0 usage. Live-demonstrated on mainnet.) + * SDK v0.16.5 (added AereMLDSA44Verifier — on-chain NIST ML-DSA-44 / Dilithium2 (FIPS 204) module-lattice signature verifier, official NIST ACVP KAT-validated bit-for-bit 15/15, demonstrated live via eth_call; view-only; non-token) * * EVM ruleset: Pectra + Fusaka — full functional parity with Ethereum mainnet. * Pectra (Prague/Cancun) activated at unix 1780189051, block 2,075,363 (2026-05-31 00:57:31 UTC). @@ -29,8 +63,16 @@ * 420M Team Reserve (0x7968…CCdf) * 140M Airdrop Reserve (0x2619…28B1) * - * Consensus: Hyperledger Besu QBFT, 1-second blocks, sub-second finality, 3 validators. - * All Ownable contracts owned by Foundation `0x0243A4f47D44b40b65D33f20329dE20D00c6f3C3`. + * Consensus: Hyperledger Besu QBFT, classical secp256k1 ECDSA, 7 validators (Byzantine-fault + * tolerance f=2, commit quorum 5 of 7), all Foundation-operated on a single client (Besu), + * 0.5s (500ms) target block period, sub-second deterministic finality. Consensus is NOT + * post-quantum; the PQC precompiles/verifiers below are application-layer only. + * Ownership is NOT uniform. The original 2026-05-07 core contracts (WAERE, treasury, identity, + * faucet, etc.) are owned by the Foundation key `0x0243A4f47D44b40b65D33f20329dE20D00c6f3C3`, + * which is itself a single-key EOA (0 bytes code on-chain), NOT a threshold multisig. Many later + * corrected forks and frontier primitives are ownerless or owned by the deployer key + * `0xbeB3…6465`, and several are deployed INERT (hold no value, not wired live). Check each + * entry's own owner/status note below; do NOT assume one owner across the whole book. * Source of truth: https://aere.network/docs.html */ export const AERE_MAINNET = { @@ -42,105 +84,240 @@ export const AERE_MAINNET = { indexer: 'https://api.aere.network', // ── Genesis wallets ─────────────────────────────────────── - StrategicInvestor: '0xaee2f3989f0AB23296Fa3b92247fe67587141311', - Foundation: '0x0243A4f47D44b40b65D33f20329dE20D00c6f3C3', - MiningReserve: '0x038f59A40ceeCd599A4588E4B0ff4642a0fbfFB8', - EcosystemReserve: '0xB6a364F47d21DC2CbEB803565c111c1026e11C75', - TeamReserve: '0x7968C438204a78B4e032fcFFd9A56Edb15fdCCdf', - AirdropReserve: '0x261913fA73D6F109382F1aE98Ff6822ff03628B1', + StrategicInvestor: '0xaee2f3989f0AB23296Fa3b92247fe67587141311', // [@status GENESIS] + Foundation: '0x0243A4f47D44b40b65D33f20329dE20D00c6f3C3', // [@status GENESIS] + MiningReserve: '0x038f59A40ceeCd599A4588E4B0ff4642a0fbfFB8', // [@status GENESIS] + EcosystemReserve: '0xB6a364F47d21DC2CbEB803565c111c1026e11C75', // [@status GENESIS] + TeamReserve: '0x7968C438204a78B4e032fcFFd9A56Edb15fdCCdf', // [@status GENESIS] + AirdropReserve: '0x261913fA73D6F109382F1aE98Ff6822ff03628B1', // [@status GENESIS] // ── Core contracts (deployed 2026-05-07, owner = Foundation) ── - WAERE: '0x7e84d7d66d5da4cfE46Da67CDEeB05B323e1f5e8', - AereTreasury: '0x687933AE7ea4927867AC227F1b60d476003e6119', - AereOracle: '0xf0A13823A4bFa86358Fe30aaf1f44A36AcbCf399', - AereIdentity: '0x658dD2CD1F798AAb19fEc8FF69A270B2d192CaD1', - AereFaucet: '0xDdBe942aD9eB0F3E7C541BdCF7CC2cfA29d35aE4', - AereCardEscrow: '0xD1f7f12830AdCFd1B7676C8460B9e30602b1f059', - AereSecurity: '0xaD305e4D91e0a9160Bd338Fd1ecb2Ee1645daC44', - AereStaking: '0xAbDb01d9A4f41792129b2654Fb6DDB9689360DEc', // delegated, 8% APY, 7-day unbonding - AereConsensus: '0xF8bDDad4aDACF9d38711e8f9aFC8a2697aBF0d47', + WAERE: '0x7e84d7d66d5da4cfE46Da67CDEeB05B323e1f5e8', // [@status CANONICAL] + AereTreasury: '0x687933AE7ea4927867AC227F1b60d476003e6119', // [@status CANONICAL] + // DEPRECATED — BUGGY V1 (finding #11: single fresh reporter controls the median). Superseded by AereOracleV2 (Tier-1.6 section). NOTE: this address is STILL the live-read source for AereOracleAdapter (0xb28A…4Fe6, no Pyth feeds registered -> reads legacy) and AereTokenPaymasterV2 (0x217f…7243, immutable oracle ref) until the Foundation repoints them. + AereOracle_v1_DEPRECATED: '0xf0A13823A4bFa86358Fe30aaf1f44A36AcbCf399', // BUG(finding #11): getPrice returned the median even with contributors==1 (runs live at reporterCount==1); one fresh reporter (others stale) fully controlled the price, and V1 has NO on-chain minimum-quorum setter to raise. Superseded by AereOracleV2. [@status DEPRECATED @reason median-with-one-contributor-no-quorum-floor @replacement AereOracleV2] + AereIdentity: '0x658dD2CD1F798AAb19fEc8FF69A270B2d192CaD1', // [@status CANONICAL] + AereFaucet: '0xDdBe942aD9eB0F3E7C541BdCF7CC2cfA29d35aE4', // NOT FUNDED: balance 0, claim() always reverts. No public way to obtain AERE today. [@status CANONICAL] + AereCardEscrow: '0xD1f7f12830AdCFd1B7676C8460B9e30602b1f059', // [@status CANONICAL] + AereSecurity: '0xaD305e4D91e0a9160Bd338Fd1ecb2Ee1645daC44', // [@status CANONICAL] + // DEPRECATED — BUGGY V1 (five confirmed bugs). Left on-chain (0 validators / 0 staked / 0 balance, harmless); do NOT use. Superseded by AereStakingV2 below. + AereStaking_v1_DEPRECATED: '0xAbDb01d9A4f41792129b2654Fb6DDB9689360DEc', // BUGS: F2(HIGH) delegate() top-up did NOT reset the reward anchor -> freshly-added stake earned a full period of retroactive rewards; F3(HIGH) validator self-stake was locked forever (no deregister/withdraw path); F4(MED) re-registering a slashed validator zeroed totalDelegated while delegations persisted -> delegator unbond underflowed (panic 0x11) + duplicated validatorList; F5(MED) reward math divided by a hardcoded 315,360,000 blocks/year (0.1s blocks) so realized APY was ~1.6% vs 8% intended (5x underpay) at the chain's ~0.5s blocks; LOW commission deducted from delegators was credited nowhere. Superseded by AereStakingV2. [@status DEPRECATED @reason reward-drain-on-topup-and-locked-self-stake @replacement AereStakingV2] + AereStakingV2: '0x1D95eF6D17aeAB732dF914Ba2d018c270BC155FC', // CANONICAL. Delegated stake pool, native AERE, 7-day unbonding, owner=Foundation (matches V1). FIXES: F2 _settle() accrues + advances lastClaimTime BEFORE any amount change (top-up earns 0 retroactive reward); F3 deregisterValidator() queues self-stake into the same unbonding queue -> claimUnbonded recovers it (works post-slash; slashed value stays in the pool, not orphaned); F4 re-register PRESERVES totalDelegated/commissionAccrued/delegations + pushes validatorList once; F5 TIMESTAMP accrual (reward = amount*rewardRateBps*secs/(10000*365d)), block-time-immune, and rewardRateBps is OWNER-SETTABLE default 800=8% APY (range 1..10000 bps); LOW commission credited to validators[v].commissionAccrued + claimCommission(). Deploy tx 0x50ed73c2…a0a17ef, block 8905995. Proven by test/audit-fix-v2-staking-2026-07.test.js (12 passing: each bug V1-reproduces + V2-corrects). Bytecode canon==twin==artifact (no immutables, 5789 bytes); twin 0x037f9470…71C8 (owner=deployer) drove setRewardRateBps 800->500->800 live; non-owner setRewardRateBps -> "Ownable: caller is not the owner" via on-chain eth_call. FOUNDER FLAG: V2 default APY 800 bps (8%, whitepaper) vs V1 effective ~160 bps (~1.6%); Foundation can change via setRewardRateBps — confirm the intended live APY. [@status CANONICAL] + // RETIRED — DECORATIVE STAKING TRAP. It is NOT the chain's consensus and never was; it invites + // 100,000 AERE per caller and has exit paths that can close for good. DO NOT SEND IT ANY VALUE. + AereConsensus_DEPRECATED: '0xF8bDDad4aDACF9d38711e8f9aFC8a2697aBF0d47', // RETIRED 2026-08-02, previously listed here as plain "AereConsensus [@status CANONICAL]" with no warning of any kind. Live, 4,321 runtime bytes, owner() == Foundation 0x0243A4…f3C3, balance 0x0 and storageHash 0x269fcdee…8f496 via eth_getProof at block 11,951,436 (not the nonce). WHAT IT IS NOT: chain 2800 consensus is Besu QBFT with a validator set carried in the block header extraData and read via qbft_getValidatorsByBlockNumber; this contract is wired to NOTHING in consensus and nothing on the chain reads it. Measured live: getActiveValidatorCount() == 0, totalStaked() == 0, currentRound() == 0 — it has never had a user. WHY IT IS A TRAP: joinValidator() is payable and permissionless and requires msg.value >= MINIMUM_STAKE, measured live at 100000000000000000000000 wei = 100,000 AERE, and the ONLY exit is leaveValidator(). (1) LOCK BY SLASH — slashValidator() is onlyOwner and, once it drops a stake below MINIMUM_STAKE, sets isActive = false while LEAVING the remaining stake in the contract; leaveValidator() requires isActive, so the remainder is unreachable forever. There is no rescue, sweep or owner-withdraw path: a full PUSH4 walk of the deployed runtime bytecode yields exactly 21 selectors, all 21 of the compiled ABI and not one more (the only other PUSH4 is 0x4e487b71, Panic(uint256)), so the absence of a recovery function is proven positively from bytecode, not inferred from a revert. (2) LOCK BY GAS STIPEND — leaveValidator() pays out with Solidity `.transfer()`, a 2,300-gas stipend; any smart-contract account (Safe, ERC-4337 account, AerePasskeyAccountFactoryV2Fixed, AereDelegate7702V2) that staked here could never withdraw. (3) REWARDS ARE FICTION — finalizeRound() credits validators[p].rewardsEarned at calculateBlockReward(), measured live at 16 AERE, and NO function anywhere pays rewardsEarned out. (4) FALSE CONSTANT — BLOCK_TIME() reads 12 seconds; the measured live block is 0.5175 s. (5) proposeBlock() does `block.number % validatorList.length` and panics 0x12 on an empty list. Immutable, no upgrade path, cannot be paused, cannot be emptied. Left on-chain because it holds 0 and nothing can be done about it. The real staking contract is AereStakingV2 0x1D95eF6D…155FC; the real validator set is the QBFT header set. NEVER call joinValidator(). [@status DEPRECATED @reason decorative-non-consensus-staking-trap-100k-aere-with-closable-exit @replacement AereStakingV2] // ── Audit-pass-stack (deployed 2026-06-09 via Foundation MetaMask) ──────── - sAERE: '0xA2125bE9C6fd4196D9F94757Df18B3a2A5e650b0', // R6-hardened ERC-4626 with 7-day drip - AereSink: '0x69581B86A48161b067Ff4E01544780625B231676', // Immutable 3-bucket router 15/40/45 - AereBugBountyVault: '0x253fDCb248649396CBDaD320F81869A570d69cD3', // 5% max payout - AereSanctionsRegistry: '0xb7d235718D99560F6EA4Fc5eAea2F8a306A3Cacf', - AereTravelRuleHashRegistry: '0xcF0E2e010E6e4506672019b1e570874AEeBC4c84', - AereStateChannels: '0x64488eda27fA5b55A277ac8D386E169DC78cd7b6', // 24h challenge window - AereRaaSFactory: '0x8C1b0018ab8C4299a75621a4BdD3cF26971B26Cd', // 1000 AERE bond, 10% sink share, 6h window - ChainalysisOracleWrapper: '0x1B7Be82C80f368f75Cb3807B1bc05E86A498f85c', - AereForensicEventRegistry: '0x4a7526A068e5DDE9788f6571E4A99095b14C6fff', - AereZKScreen: '0xE9da9c5F40c2CDfda368885832C59609286e04ee', // SP1Gateway-backed - AereAIProof: '0xFf92c669AbF4C1DAE31eBFCC017764036d9D97e6', - AereAttestationGateway: '0x9bdacA8dfF39Fc688e8D3c4bbA13bCFC0580c325', - AereBestExReceipt: '0x3c80BD6fa0d9a2274c7fBD5943B5EC03313D92d7', // MiCA Article 78 - AereSettlementHub: '0x2a02fD80c16293D2B5D8a295F31D1a6E6a582c02', - AereCoinbaseSplitterV2: '0x8C1A48eFA57b66fEE743A00E3899c29ad3Fd27b4', - AereAgent: '0xE96396B4b596B3A74e4195Be12aADd5257863536', - AERE402Facilitator: '0xbA6e6700D629a5E3C885778a42885a944CA84E56', - AereDelegate7702: '0x5673D92080efbd0987402E9335c14200d0a5EaeF', - AereDelegationRegistry: '0x6c25c07D134713b6C2F8E19D807423f022903D63', - AereInsuranceFund: '0x5Ab95C549c2A2b07913Df7edD4a16fd108B7CAAC', // 7-day cooldown - AereNavOracle: '0xC8D12E44f10b03477330b35115b432750831fEBD', - // ── PENDING (blocked on Hyperlane USDC.e bootstrap post-MEXC payment) ──── + // FLAWED LIVE VAULT — R7 HIGH drip double-count / totalAssets-clamp inflation bug. Superseded by sAEREv2 below. + // Left LIVE and referenced (lending market 0x2C2d…4bb0 reads it) until the FOUNDER-SUPERVISED migration runs + // (see aerenew/docs/SAERE_V2_MIGRATION_RUNBOOK.md). Do NOT point new integrations / AereSink staker-yield here. + sAERE: '0xA2125bE9C6fd4196D9F94757Df18B3a2A5e650b0', // FLAWED (R7). R6-hardened ERC-4626 w/ 7-day drip, BUT: OZ 4.9.6 reads previewRedeem/maxWithdraw/share-price from totalAssets() BEFORE _withdraw runs sync(), so a raw un-synced WAERE.transfer into the vault is (1) instantly counted in totalAssets() [defeats the 7-day drip] AND (2) re-booked into the drip reserve by the same redeem's sync() [double-count]; a large redeem leaves undistributed > balance, totalAssets() clamps to 0 with live shares, re-opening the ERC-4626 inflation attack. ~0.80 WAERE at risk (unlisted). Superseded by sAEREv2. [@status DEPRECATED @reason erc4626-unsynced-donation-double-count @replacement sAEREv2] + sAEREv2: '0x9B580f9118AF4421b270cDb279CF18c03E1573a2', // CANONICAL corrected staking-receipt vault. FRESH + INERT (deployer 0xbeB3…6465, ownerless, nothing points at it yet; the flawed live vault is NOT migrated/re-pointed by this deploy — that is a founder-supervised step). FIX(R7 drip double-count): totalAssets() now measures assets against the SYNCED balance (min(balance,lastObservedBalance)) so an un-synced WAERE arrival is invisible to share-price math on EVERY read path, and deposit/mint/withdraw/redeem sync() at the START before OZ's preview math. Consequence (proven by test/saere-v2-fix.test.js A-D): undistributed <= balance and totalAssets() > 0 hold at all times with shares outstanding, so the reserve can never be double-counted into both payout and drip and totalAssets() can never be driven to 0. 7-day anti-sandwich drip (R5 HIGH-1) + dead-seed + _decimalsOffset=6 inflation guard (R5 HIGH-4) preserved unchanged. Underlying = live WAERE. Deploy tx 0xa1099fa4…5a81, block 9155529, 6818 bytes runtime (eth_getCode non-empty). Live R7 proof: a raw 1000-wei un-synced WAERE arrival jumped totalAssets() by 0 in-block (donate tx 0x2120f757…a311) and totalAssets() stayed > 0. Migration: aerenew/docs/SAERE_V2_MIGRATION_RUNBOOK.md (NOT executed). [@status INERT @reason corrected-vault-deployed-ownerless-nothing-points-at-it-yet] + AereSink: '0x69581B86A48161b067Ff4E01544780625B231676', // Immutable 3-bucket router 15/40/45. [@status CANONICAL] + AereBugBountyVault: '0x253fDCb248649396CBDaD320F81869A570d69cD3', // 5% max payout. [@status CANONICAL] + AereSanctionsRegistry: '0xb7d235718D99560F6EA4Fc5eAea2F8a306A3Cacf', // [@status CANONICAL] + AereTravelRuleHashRegistry: '0xcF0E2e010E6e4506672019b1e570874AEeBC4c84', // [@status CANONICAL] + AereStateChannels: '0x64488eda27fA5b55A277ac8D386E169DC78cd7b6', // 24h challenge window. [@status CANONICAL] + // DEPRECATED — BUGGY V1 template (findings F6/F7 + isFinalised-ancestor + settleRevenue-residual). 0 rollups registered (no live per-rollup settlement existed), left on-chain, harmless. Superseded by AereRaaSFactoryV2 below. Do NOT register new rollups here. + AereRaaSFactory_v1_DEPRECATED: '0x8C1b0018ab8C4299a75621a4BdD3cF26971B26Cd', // 1000 AERE bond, 10% sink share, 6h window. BUGS in its per-rollup AereRollupSettlement template: F6 a challenge in the LAST in-window block could not be defended (resolveChallenge reverts WindowClosed at window-end) so a valid root was rejected via resolveChallengeExpired with the griefer's bond FULLY REFUNDED (grief costless); F7 a rejected epoch permanently froze latestFinalisedEpoch (contiguous walk stops at the gap) AND could never be re-proposed (strict epoch==latestEpoch+1); isFinalised(epoch) was purely LOCAL so a descendant of a rejected epoch read as final; settleRevenue's best-effort sink flush had no recovery path. Superseded by AereRaaSFactoryV2. [@status DEPRECATED @reason last-block-challenge-grief-and-frozen-finalisation @replacement AereRaaSFactoryV2] + AereRaaSFactoryV2: '0xB7F8c754AC3155197d76f01857172bBd5a5F39Ab', // CANONICAL. Permissionless RaaS registry (deployer 0xbeB3…6465). BOND_TOKEN=WAERE, SINK=AereSink, FOUNDATION=Foundation account (single-key EOA, NOT a multisig; immutable, baked into runtime bytecode at deploy), REGISTRATION_BOND=1000 AERE, MIN_SINK_BPS=1000 (10%), DEFAULT_CHALLENGE_WINDOW=6h, DEFAULT_DEFENSE_GRACE=1h. Deploys the fixed AereRollupSettlementV2 per rollup. FIXES: F6 DEFENSE_GRACE lets the sequencer resolveChallenge AFTER window-end; a defeated/false challenger's bond is SLASHED to AereSink (resolveChallengeExpired only callable after the grace); F7 proposeStateRoot may REPLACE a rejected epoch so advanceFinalisation resumes (one griefing challenge can no longer permanently freeze finalisation); isFinalised is ancestor-aware (epoch<=latestFinalisedEpoch, contiguous) with the local notion as isEpochSettled(); flushResidualToSink() recovery. Deploy tx 0xf9693953…1308ea, block 8909449. Proven by test/audit-fix-v2-raas-compliance-2026-07.test.js (V1-reproduces/V2-corrects) + on-chain: F6 defended a challenge at ts 1783679152 > windowEnd 1783679150 (root survived, bond slashed to sink, epoch finalised, defendTx 0x568c6b4d…); F7 re-proposed a rejected epoch and advanceFinalisation moved 0->2 (advanceTx 0xfb292764…). Byte-identical (immutable-masked) to the AereRollupSettlementV2 artifact and to a deployer-owned demo factory. [@status CANONICAL] + ChainalysisOracleWrapper: '0x1B7Be82C80f368f75Cb3807B1bc05E86A498f85c', // [@status CANONICAL] + AereForensicEventRegistry: '0x4a7526A068e5DDE9788f6571E4A99095b14C6fff', // [@status CANONICAL] + AereZKScreen: '0x3A097A459FD26aC79573aCB5adB51430e473C2f1', // v3 — root-binding soundness fix + rotation + revoke (v1 0xE9da9c…04ee dead; v2 0x140572…8aFa7 self-clear hole). [@status CANONICAL] + AereStorageProofVerifier_DEPRECATED_POISONABLE: '0xF9a1A183bEb3147D88dA5927301683fEbFb9362E', // DEPRECATED — CANONICAL RECORD POISONING; SUPERSEDED by AereStorageProofVerifierV2 0x487021f9…a1Dd + AereStateRootAnchorV2 0x0b959402…e488. Its documented scope (proves V against a GIVEN root; canonicity is the caller's job) was always honest — the BUG is that it wrote anchored and unbound submissions into ONE mapping keyed only by (blockNumber, account, slot), so an unbound submitProof() SILENTLY OVERWRITES a canonically-anchored record for the same key. Its live record (AereTreasury 0x687933…6119 slot0 == Foundation at block 8,915,939, canonical stateRoot 0x515fce04…4a92f3) is currently HONEST and was re-verified live 2026-07-17 — but it is overwritable by anyone, and getProven() cannot distinguish an anchored record from an unbound one (demonstrated live: the same real proof through submitProof reads as canonical on V1, stays non-canonical on V2). Immutable — cannot be fixed in place. Left on-chain: no owner, no funds. DO NOT read getProven() as canonical; repoint to V2. See docs/ZK-ANCHOR-FIXES-2026-07-17.md. [@status DEPRECATED @reason canonical-record-poisoning-shared-mapping @replacement AereStorageProofVerifierV2] + AereStorageProofVerifierV2: '0x487021f9aE018657B7335ADC6Fc254717751a1Dd', // CANONICAL zk storage-proof coprocessor. REPLACES 0xF9a1A183…9362E (below). KNOWN + ALREADY DOCUMENTED (not the bug): it proves V against a GIVEN prover-supplied stateRoot and cannot itself show that root is canonical — the intended scope of a storage-proof primitive. THE NEW FINDING (2026-07-17): V1 wrote EVERY submission — anchored or not — into ONE shared mapping keyed only by (blockNumber, account, slot), so a record established through the trust-minimized path (AereStateRootAnchor.proveAgainstAnchor, whose root comes from the BLOCKHASH opcode) could be SILENTLY OVERWRITTEN by anyone calling the unbound submitProof() with a proof against a state root of their OWN making for the same key. NOT THEORETICAL: the live V1 holds exactly such a record — AereTreasury 0x687933…6119 slot0 (owner) == Foundation 0x0243A4…f3C3 at block 8,915,939 vs canonical stateRoot 0x515fce04…4a92f3 (re-verified live 2026-07-17) — an attacker builds a trie where that slot holds THEIR address, proves it honestly against their own root (the guest cannot know which root is canonical; that is exactly its documented scope) and overwrites it, after which every reader of getProven() sees the attacker as Treasury owner with exists==true and no way to tell. THE FIX — SEPARATE TRUST DOMAINS: anchored records (key = blockNumber/account/slot) are writable ONLY by the IMMUTABLE CANONICAL_ANCHOR 0x0b959402…e488; unbound records are keyed by (SUBMITTER, blockNumber, account, slot) so every submitter has their own namespace and can overwrite neither the anchored record nor anyone else's; getProven() — the V1-shaped read — returns the ANCHORED record ONLY (FAIL-CLOSED). The unbound API is NOT dropped (it has legitimate uses) — just made clearly non-canonical and non-overwriting, readable via getUnboundProven/provenanceOf/isAnchoredProven/anchoredValue. WHY PROVENANCE COMES FROM THE CALLER: submitProofWithExpectedRoot is NOT self-securing — the CALLER supplies expectedStateRoot, so an attacker passes their own fabricated root and the check passes trivially; canonicity comes from WHO calls (the anchor derives its root from BLOCKHASH), so Anchored is granted strictly to CANONICAL_ANCHOR. GUEST UNCHANGED: PROGRAM_VKEY 0x0015e599f5115a444c6ee141dbebabd03581e8b97c971c74c6224b703d8eb659 read live from V1 and reused — no reproving. MUTUAL REFERENCE RESOLVED DETERMINISTICALLY: the anchor's constructor takes the verifier and vice versa, so the deploy script PREDICTED the anchor's CREATE address from the deployer nonce (144402 -> anchor at nonce 144403), deployed the verifier with it, deployed the anchor at exactly that nonce, and VERIFIED BOTH DIRECTIONS on chain (prediction held; V2.CANONICAL_ANCHOR == 0x0b959402…e488 && anchor.VERIFIER == 0x487021f9…a1Dd) — the script aborts otherwise. Deploy tx 0x5d5ed264fadc983681bb895fc27dba44e3015d9b5b6b8c1790f92295dee4a50b (block 10,084,209, gas 743,055, deployer 0xbeB33D20…6465). PROVEN LIVE (2026-07-17): (+) REAL ACCEPT — the REAL 356-byte storage-proof Groth16 proof recovered from V1's own submitProofWithExpectedRoot tx 0xe541c52b…6c54 is ACCEPTED by V2.verify() through the REAL gateway (block 8915939, value == Foundation). (-) THE FIX — that same real proof submitted through the same unbound submitProof (tx 0xc98ac487649b708f3923527b0df5ca3820f537393cc0b68eed5c84ef71325055, block 10,084,211, gas 370,402) lands in the SUBMITTER'S namespace only: V2.getProven(target) stays exists=false and provenanceOf==0 (None) — FAIL-CLOSED — while V1.getProven on the identical key serves it as canonical (exists=true). HONEST RESIDUAL: the anchored-record OVERWRITE itself is NOT reproduced live, because the anchor's BLOCKHASH reach is 256 blocks (~128s at 0.5s blocks) and the target block is ~1.17M blocks old, so a live anchored record would need a NEW SP1 storage proof — it IS proven in test/storage-proof-verifier-poisoning-fix-2026-07-17.test.js (19/19) against the REAL AereStateRootAnchor logic and the REAL AERE genesis header (canonical hash 0xd86d57a8…7f1a reconstructed exactly): V1 gets poisoned, V2 does not. CANONICAL_ANCHOR is a SINGLE immutable address: CORRECTED 2026-08-01: EIP-2935 IS DEPLOYED on chain 2800. This comment previously asserted the opposite and was the source the error propagated from. MEASURED at head block 11,810,041 on https://rpc.aere.network: eth_getCode at 0x0000F90827F1C53a10cb7A02335B175320002935 returns 83 bytes, live since the AerePQC fork at block 9,189,161, and the serve window was measured end to end (offsets of 1/255/256/8190 blocks behind head each return the canonical hash reported by eth_getBlockByNumber; 8191 and beyond revert). So the ~8191-block history-anchor path is NOT inert on this chain: its consumer AereHistoryStateRootAnchorV2 0x4C1F9daD…330C is deployed and registered at line 391 below. What remains true and unchanged: adding a second canonical writer to THIS verifier would still require a FRESH verifier deployment, because the anchor wiring is immutable. verify() remains intentionally unbound — it is the primitive the anchor itself calls to read a proof BEFORE judging its root; the canonical read is getProven(). Immutable, no owner, no funds. APPLICATION layer; classical Groth16/BN254, NOT quantum-safe. Full report: docs/ZK-ANCHOR-FIXES-2026-07-17.md. [@status CANONICAL] + // DEPRECATED — BUGGY V1 (finding F8: challenge bond unrecoverable). 0 deposits, left on-chain, harmless. Superseded by AereCompliancePoolV2 below. Do NOT deposit/withdraw here. + AereCompliancePool_v1_DEPRECATED: '0x79735c31F289F7A4d6Be3E02aaB70B544796D41d', // COMPLIANT privacy pool (sanctions-gated + Travel Rule), WAERE denom, live 2026-07-07. BUG(F8): challengeAssociationRoot pulled a 100 WAERE CHALLENGE_BOND but an UPHELD challenger was NEVER refunded (no refund fn; the root just stayed "challenged" forever with the bond locked) and a dismissal BURNED it — so an honest challenger who was RIGHT always lost 100 WAERE. Superseded by AereCompliancePoolV2. [@status DEPRECATED @reason upheld-challenger-bond-unrecoverable @replacement AereCompliancePoolV2] + AereCompliancePoolV2: '0xB144c923572E5Ac1B6B961C4ccfec36917173465', // CANONICAL. COMPLIANT privacy pool (Privacy Pools + Travel Rule), WAERE denom, 1 WAERE denomination, FOUNDATION=Foundation account (single-key EOA, NOT a multisig; immutable, baked into runtime bytecode at deploy), VERIFIER=AereCompliancePoolSP1Verifier 0xE2D3…F95E (REUSED), 24h challenge window, 0 deposits (fresh). Merkle tree / deposit / withdraw / Travel-Rule logic byte-identical to V1 (same ZERO_VALUE + keccak tree -> same SP1 circuit). FIX(F8): a DISMISSED (Foundation dismisses within the window) challenge is burned to dEaD exactly as V1 (anti-grief preserved); an UPHELD challenge (Foundation does NOT dismiss within ASSOCIATION_ROOT_CHALLENGE_WINDOW) can be finalised by anyone via reclaimUpheldChallenge — bond REFUNDED, root permanently rejected (safe default). Deploy tx 0xca77b3a1…dce5fb85, block 8910143. Proven by test/audit-fix-v2-raas-compliance-2026-07.test.js + on-chain (deployer-owned twin, byte-identical immutable-masked): UPHELD reclaim refunded 100 (challenger whole again) + root rejected + publish reverts (reclaimTx 0x609d20af…); DISMISSED burned 100 to dEaD, challenger NOT refunded (dismissTx 0x45d452e3…); a dismissed-then-quiet valid root published (0x41117e01…). RESIDUAL: liveness assumption — the Foundation must dismiss BASELESS challenges within the window, else the challenge stands (fail-safe toward challengers, strictly better than V1). [@status CANONICAL] + AereComputeMarket: '0xf0c8178a5d9feb0f70C5f184e79edeEDaddcF350', // DePIN compute coordination (native-AERE stake/escrow), live 2026-07-07. [@status CANONICAL] + AerePQCVerifier: '0x1cE2949e8cE3f1A77b178aF767a4455c08ec6F82', // WOTS+ post-quantum (hash-based) signature verifier, live 2026-07-07. [@status CANONICAL] + AereLatticeVerifier: '0x60c06E6A3CC201B46A16650be096C6E45424dfD9', // Falcon/Dilithium-family lattice verification core (ring arith + norm), n=64 demo, live 2026-07-07. [@status CANONICAL] + AereFalcon512Verifier: '0x4E8e9682329e646784fB3bd01430aA4bA54D8fFC', // spec-complete NIST Falcon-512 verifier, official KAT-validated on-chain, live 2026-07-09. [@status CANONICAL] + AereFalcon1024Verifier: '0xF0aFA59BaB2058e4B6e6B424b7f76750F1F66e36', // spec-complete NIST Falcon-1024 verifier, official round-3 KAT (rsp 036a0bf5…) valid→true/tampered→false via eth_call. verifyAndRecord (~21.7M gas) exceeds the L1 EIP-7825 2^24 per-tx cap; verify() is a pure view. Live 2026-07-10. [@status CANONICAL] + AereXmssVerifier: '0x77b14E264D0bb08d304d4e0E527F0fCdFc88B112', // roadmap #60 — on-chain RFC 8391 XMSS-SHA2_10_256 many-time hash-based signature verifier (WOTS+ leaf + h=10 SHA-256 Merkle auth path to the long-term root); honest many-time extension of AerePQCVerifier WOTS+. Validated vs the OFFICIAL xmss-reference @171ccbd test/vectors KAT (pk-hash 7de72d19…, sig-hash 8b6cb278…), cross-checked by from-scratch Python+JS oracles. Live via eth_call: official KAT→true, tampered WOTS+/auth→false. verifyAndRecord tx 0x7f97071e… gasUsed 1,561,963 < EIP-7825 2^24 cap. verify() is a pure view; no owner/admin. HONEST SCOPE: verifies a signature, does NOT enforce the signer's one-time-per-leaf state. Live 2026-07-10. [@status CANONICAL] + AereMLDSA44Verifier: '0xf1F7A6Acd82D5DAf9AF3166a2F736EE52C5F85AE', // roadmap #57 — on-chain NIST ML-DSA-44 (Dilithium2, FIPS 204) module-lattice signature verifier; full Verify_internal: pkDecode, sigDecode (BitUnpack + HintBitUnpack), ExpandA (SHAKE128 rejection), mu=H(H(pk)||M), SampleInBall, w=NTT⁻¹(Â∘NTT(z) − NTT(c)∘NTT(t1·2^d)) over Z_q[x]/(x²⁵⁶+1), q=8380417 (fresh NTT, roots ≠ Falcon's q=12289), UseHint, c~'=H(mu||w1Encode(w1)), ‖z‖∞<γ1−β. Validated bit-for-bit vs the OFFICIAL NIST ACVP ML-DSA-sigVer-FIPS204 vectors TG8 (internal, externalMu=false): all 15 cases (3 valid + 12 crafted-invalid: modified message/z/commitment/hint) reproduce NIST's expected testPassed; prompt.json sha256 2a9b7fcb…, expectedResults.json sha256 33e0ea7d…. Cross-checked by an independent from-scratch Python FIPS 204 verifier (also 15/15). Live via eth_call: official valid→true, tampered c~/z/message→false. verify() is a pure view; a full verify ≈52.9M gas exceeds the L1 EIP-7825 2^24 per-tx cap, so verifyAndRecord is view-only (like Falcon-1024). No owner/admin. Deploy tx 0x2cccc29f…, block 8889215. Live 2026-07-10. [@status CANONICAL] + AereSphincsVerifier: '0xAfFc9F8d950969b46b54e77758BbFf7e000c87e6', // on-chain NIST FIPS 205 SLH-DSA-SHA2-128s (SPHINCS+-SHA2-128s-simple) STATELESS hash-based signature verifier. Full slh_verify_internal (Alg. 20): H_msg=MGF1-SHA256(R||PK.seed||SHA256(R||PK.seed||PK.root||M)) -> (md, idx_tree mod 2^54, idx_leaf mod 2^9); FORS pkFromSig (base_2^12 big-endian indices, the FIPS 205 change vs round-3 SPHINCS+); d=7 hypertree of WOTS+ (len=35) + h'=9 Merkle layers; tweakable hash Th=Trunc16(SHA256(PK.seed||0^48||ADRSc||M)) via the 0x02 precompile. Validated bit-for-bit vs the OFFICIAL NIST ACVP SLH-DSA-sigVer-FIPS205 TG31 (SHA2-128s, internal): all 14 (2 valid + 12 crafted-invalid) reproduce NIST testPassed; prompt.json sha256 4e7beb12…, expectedResults.json 259f5e2a…. Cross-checked by a from-scratch Python FIPS 205 verifier (14/14) and the sphincs/sphincsplus reference C @7ec789a THASH=simple with FORS index extraction corrected to base_2^b (14/14; unpatched 12/14, failing exactly the 2 valid, isolating the one FIPS 205 change). Live via eth_call: official valid→true, tampered R/SIG_FORS/SIG_HT/message→false. HEADLINE: a full verify ≈1.81M gas is UNDER the EIP-7825 2^24 (16,777,216) per-tx cap, so verifyAndRecord is RECORDED ON-CHAIN (tx 0x20ae1526…, block 8916065, gasUsed 1,812,066, lastResult=true), unlike the view-only Falcon-1024 (~21.7M) and ML-DSA-44 (~52.9M). SLH-DSA is stateless/many-time, so NO one-time-per-leaf caveat (unlike XMSS). verify() is a pure view; no owner/admin. Deploy tx 0x32d5e6ad…, block 8916065. Completes AERE's PQC verification suite. Live 2026-07-10. [@status CANONICAL] + AerePQCAttestation: '0x465d9E3b476BF98Aa1393079e240Db5D2a9bEA6A', // permissionless quantum-durable attestation registry that USES the LIVE native PQC verification precompiles (0x0AE1 Falcon-512 / 0x0AE2 Falcon-1024 / 0x0AE3 ML-DSA-44 / 0x0AE4 SLH-DSA-128s, activated on mainnet 2800 at block 9,189,161). registerKey binds a NIST PQC public key; attest verifies ON-CHAIN via the corresponding precompile that a signature covers keccak256(DOMAIN, chainid, address(this), keyId, per-key nonce, messageHash) and records it, with strict nonce increment (replay-proof) and no fund custody. verifySignature(scheme,pubKey,messageHash,signature) is a free eth_call PQC verify for anyone. HONEST SCOPE: application-layer PQC signature verification via the precompiles (this is NOT PQC consensus; AERE blocks are still QBFT/ECDSA-signed). DEMONSTRATED LIVE end-to-end with a REAL Falcon-1024 (scheme 2) keypair (BouncyCastle 1.83, the same audited lib the precompile wraps): registerKey keyId 0 (registerTx 0xcd135037…0660), then attest tx 0xb659b949…9ec1 (block 9,200,542, gasUsed 692,206, status 1) where the contract verified the signature via the live 0x0AE2 precompile and recorded the attestation (isValidAttestation(0,0,msg)=true, attestationCount=1); verifySignature genuine=true / tampered=false, attest(tampered) reverts. TX success alone proves the live precompile returned valid=1, else attest reverts PQCVerificationFailed. Bytecode-verified (on-chain runtime == compiled artifact). Deploy tx 0x1ffaeb0d…ca21, deployer 0xbeB3…6465. No owner, no admin, no token. Live 2026-07-12. [@status CANONICAL] + // ── PQC wave-1 frontier (deployed 2026-07-12, deployer 0xbeB3…6465, no fund custody, founder-visibility-flagged) ── + AereCryptoRegistry: '0xaE6fC596bb3eCcbf5c5D02D67B0Ef065b3Afbaa5', // cryptographic-agility registry over the 5 live native precompiles (Falcon-512/1024, ML-DSA-44, SLH-DSA-128s, SHAKE256). Governed algorithmId→{verifier, wire-format, status, gas, successor}: a scheme can be deprecated/revoked/superseded WITHOUT redeploying consumers (route via resolveActive). seedLiveSchemes() registered 5 rows (algorithmCount=5 on-chain). verify(id,pubKey,msg,sig) is a FAIL-CLOSED view (false for unknown/hash-only/UNKNOWN/REVOKED/malformed; DEPRECATED still verifies but isUsable=false). Halmos symbolic-proven fail-closed (R1: a REVOKED/UNKNOWN id can NEVER verify). Ownable (deployer now; transfer to Timelock later, founder-signed). No funds/payable/selfdestruct. Deploy tx 0x2feee4d2…13cd, seed tx 0x681d12df…4ce1. Live 2026-07-12. BYTECODE DOES NOT REPRODUCE FROM PUBLISHED SOURCE (30-agent audit 2026-08-01, finding C7): the live contract disassembles to 5,724 instructions against 4,366 in our source and diverges from instruction 3; 112 recompilation profiles were tried and none reproduces it. This is the contract that decides which cryptography is active, and it is owned by an operational key (owner() == 0xbeB3…6465, measured 2026-08-02), so "verify yourself" does not hold for it today. It stays CANONICAL because it is the live routing point and nothing replaces it; the open work is the source, not the address. [@status CANONICAL @repro MISMATCH] + AerePQCKeyRegistry: '0x1eCa3c5ADcBD0b22636D8672b00faC6D89363691', // permissionless PQC public-key registry with on-chain PROOF-OF-POSSESSION: registerKey(scheme,pubKey,signature) stores a key only if signature is a valid PQC sig by pubKey over a contract-bound PoP challenge, verified in full by the live precompile (routes/encodes identically to AerePQCAttestation; precompileFor(1)=0x0ae1 confirmed). Owner-only rotateKey/revokeKey; verify()/verifyWithKey() fail-closed (REVOKED never verify). No owner/admin, no funds. Deploy tx 0x7c15ce1e…1f57. Live 2026-07-12. [@status CANONICAL] + AereAgentDID: '0xce641d7d7C10553D82b06B7C21d423550e7522C5', // Falcon-rooted decentralized identity for AI agents: root authority = a Falcon key in AerePQCKeyRegistry (0x1eCa…3691); issues short-lived revocable secp256k1 SESSION keys (scope + cumulative spend cap + expiry). issueSession is Falcon-PoP-gated (verified on-chain via the precompile through the registry) and relayable; authorize() is the cheap ecrecover hot path; a session is valid only while its Falcon root stays ACTIVE. Read-only cross-links: AereAgentBond 0x32E0…B86A, AereAIReputation 0x781e…feBF. HONEST: session ACTIONS are classical secp256k1 (hot keys) BY DESIGN; only the ROOT is quantum-durable. No funds (spend cap = accounting, not custody). Deploy tx 0x0fe86fa0…30bb. Live 2026-07-12. [@status CANONICAL] + AereHybridAuthorizer: '0x168F2A6a3071e7654CF1784a6f5d7BC8e1a582E0', // crypto-agility CONSUMER over AereCryptoRegistry (0xaE6f…baa5): authorizes (algorithmId, pubKey, msgHash, sig) against the currently-ACTIVE scheme via registry.resolveActive(id) (follows the successor chain), so a Foundation-governed scheme swap (addAlgorithm new → setSuccessor(old,new) → deprecate/revoke old) migrates EVERY consumer with NO redeploy. Only ACTIVE schemes accepted (stricter than registry.verify); a REVOKED id is never used; checkAuthorized/checkAuthorizedFor are fail-closed. Owner-governed app default (id 1 = Falcon-512) + permissionless per-account preference with safe fallback. Proven by 35 hardhat tests (REVOKED-never-authorized, successor-swap-transparent, resolveActive-terminates over cyclic graphs, owner-only). Ownable (deployer now; → Timelock later, founder-signed). No funds. Deploy tx 0x428e38b75ea7d6f469421bb1ae03100c5b7117e9130b294d2600c81f167fafb5. Live 2026-07-12. [@status CANONICAL] + // ── Interop + MPC no-fund frontier primitives (deployed 2026-07-12, deployer 0xbeB3…6465, ownerless, NO fund custody) ── + // 5-lens adversarial pre-deploy review found zero exploitable defects; each deployed + self-tested on chain 2800. EXTERNAL AUDIT PENDING. These do NOT make mainnet consensus post-quantum. + AereThresholdRegistry: '0x875BA0dbA1806Ad9aE57627d705ecA12139D1EF4', // on-chain registry of t-of-n MPC/TSS threshold-ECDSA signing committees (register / reshare / rotate / slash, each threshold-signature-authorized; optional guardian break-glass). Self-contained, no owner, no funds (metadata + ecrecover verification only; a consuming vault holds value, not this). HONEST SCOPE: ecrecover proves authenticity under the DKG group key, NOT live t-of-n participation; group key is classical secp256k1, NOT post-quantum. deployed + self-tested + adversarially-reviewed (2026-07-12), external audit pending, no fund custody. Deploy tx 0x3d826b0ba5574a48592e7e714288cbac0c10d21e2c6b45c582841ec1eeec9843 (gas 1,552,554); committeeCount()==0. [@status CANONICAL] + AereThresholdPQCRegistry: '0x9a6096F6FB3a7E54cF70DE12Cb3903Ae79D1C213', // t-of-n POST-QUANTUM threshold authorization (verifies >= t DISTINCT PQC sigs via the LIVE precompiles 0x0AE1 Falcon-512 / 0x0AE2 Falcon-1024 / 0x0AE3 ML-DSA-44 / 0x0AE4 SLH-DSA-128s): registerCommittee(scheme,t,pubKeys[]) + authorize(committeeId,messageHash,PqcSig[]) that verifies ON-CHAIN that >= t distinct committee members each PQC-sign the domain-separated challenge. Complements AereThresholdRegistry (threshold-ECDSA) with a POST-QUANTUM threshold-MULTISIG, and is strictly stronger on-chain: threshold-ECDSA's t-of-n is byte-identical to a single ecrecover (t-of-n lives off-chain), whereas here the chain verifies t SEPARATE PQC sigs against t DISTINCT registered keys so t-of-n participation is PROVEN on-chain (cost: t precompile verifies bound the (scheme,t) ceiling under EIP-7825 2^24). Strict distinctness (DuplicateMember / MemberOutOfRange revert), per-committee strictly-increasing authNonce (replay-proof), no owner/admin, no funds (verification only). HONEST BOUNDARY: a threshold MULTISIG of INDEPENDENT PQC signatures (t separate precompile verifies), NOT a single-aggregate threshold-PQC signature (lattice/hash threshold sigs are an open, unstandardized research problem) and NOT post-quantum consensus (AERE consensus stays classical ECDSA QBFT). deployed + 17/17 hardhat tests + honest-boundary review (2026-07-12), external audit pending, no fund custody. Deploy tx 0xffd8475a7ac9517619b0455fe5f5f662923ea4a904676087c34b0efe7b0fec87 (gas 1,282,547); live eth_call verified committeeCount()==0, authorizationCount()==0, SCHEME_FALCON512()==1, precompileFor(1)==0x0ae1. REPLACED AND STILL PRINTED AS CANONICAL UNTIL 2026-08-02: the fixed registry is AereThresholdPQCRegistryV2Fixed 0x8Fbfe1C7…643c, which is live, matches its artifact byte for byte and rejects duplicate committee keys; this address does not. The whitepaper already printed the fixed one, so this line was the last place still naming the replaced address. Left on chain and left in this book: it is live code and a reader has to be able to learn that it is the wrong one. [@status DEPRECATED @reason accepts-duplicate-committee-keys-superseded-registry @replacement AereThresholdPQCRegistryV2Fixed] + AereOutboundOutbox: '0xd43FeacbbdDc5ff7cE4A72C726f3FBD204ef7936', // AERE-side (chain 2800) source of the canonical OUTBOUND cross-chain message; emits the AereCrossChainMessage log the zk-interop SP1 guest proves QBFT-final inclusion of. No owner, no funds. deployed + self-tested + adversarially-reviewed (2026-07-12), external audit pending, no fund custody. Deploy tx 0xbe583ef44bc621bf40e540d54bf803423e9fa0a51ec7bac3c4f3e0b61b542bf1 (gas 187,792); AERE_CHAIN_ID()==2800, nonce()==0. [@status CANONICAL] + AereOutboundVerifier_DEPRECATED_FORGEABLE_DESIGN: '0x8E893686b6B2509C5f7Fe477CE530Bc868B0074e', // DEPRECATED — FORGEABLE BY DESIGN, SUPERSEDED by AereOutboundVerifierV2 0x08b68bd5…a96F (below). Left on-chain and PERMANENTLY INERT: programVKey==0x0 (re-verified live 2026-07-17), which is FAIL-CLOSED — every proof reverts — and programVKey is IMMUTABLE, so this contract can never be fixed in place. It was never exploitable and never held funds. **DO NOT "fix" this by pinning any vkey.** DESIGN FLAW FOUND 2026-07-16 (code-read, not exploited): the zk-interop guest reads its ENTIRE trust anchor as PRIVATE prover-supplied input — `InteropInput { chain_id, finality: FinalityInput { known_validators, .. }, .. }` — and its committed PublicValues (chainId, blockNumber, blockHash, root, claimKind, commitment, finalized, falconVerified) contain NO validator-set commitment, while this contract binds only chainId==2800 + finalized==true. `verify_finality` merely checks the header's extraData set == the PROVER'S OWN `known_validators` and that a quorum of seals recovers to it, so an attacker can forge a header listing THEIR OWN keys, self-seal a quorum, and produce a VALID proof committing finalized=true for an arbitrary blockHash/commitment — forging bridge messages. Pinning a vkey would ACTIVATE that, so inert is strictly safer than "configured". THE FORGERY IS NOT THEORETICAL — it was CONSTRUCTED AND PROVEN on 2026-07-17: a real Groth16 proof over a fabricated header (7 attacker-generated keys named as the validator set, a self-sealed 5-of-7 quorum, and an attacker-built receiptsRoot carrying a forged AereCrossChainMessage ascribed to the real Outbox) is ACCEPTED by the REAL, LIVE SP1VerifierGateway 0x9ca479…0628 (confirmed by eth_call against the V1-design vkey — the proof is cryptographically valid, nothing is faked), and the V1 gate logic then delivers it (reproduced in test/outbound-verifier-v2-anchor-fix.test.js, which shows V1 delivering a message from 0x…deadbeef that the real Outbox never emitted). FIXED by AereOutboundVerifierV2 0x08b68bd5…a96F: the guest now commits validatorSetRoot + a constant chainId, and V2 binds that root to the immutable anchor 0x5fa93ba7…dd79 — the identical forgery reverts with ValidatorSetMismatch. This mirrors AereZkQbftLightClient 0xCaDA54FA…6488, which was always safe precisely because it commits validatorSetRoot publicly and checks it against an immutable anchor. Historical note: the entry previously read "PENDING CONFIG … inert until a founder-supervised redeploy pins the real vkey", which understated the problem — the blocker was not a missing vkey, it was an unbound anchor. Trust-minimised NOT trustless (security == AERE validator set; seals are classical ECDSA; Groth16 wrap is BN254 — NOT quantum-safe). No owner, no funds. deployed + self-tested + adversarially-reviewed (2026-07-12), external audit pending, no fund custody. Deploy tx 0x82f17d02efb79727cd1b8185a0c91dcfd639d6ece0c90e85ac7622b1c229a9ad (gas 492,915). Full postmortem: zk-light-client/OUTBOUND-VERIFIER-FIX-2026-07-16.md. [@status DEPRECATED @reason trust-anchor-is-private-prover-input-forgeable @replacement AereOutboundVerifierV2] + // DEPRECATED — Altair-era generalized indices (finality 105 / next-committee 55). Ethereum mainnet is on the Electra/Fulu BeaconState layout, so its finality/next-committee branches (len 7 / 6) never match this contract's 6/5. Superseded by the gindex-corrected AereEthLightClient below. Left on-chain, harmless (bootstrap state only). Deploy tx 0xf19ca7d23aa8316186bfec675df545b488a3ee88533d33f6c0c88ab18f5fd94b. + AereEthLightClient_v1_DEPRECATED_ALTAIR_GINDICES: '0x9A9147236a47aE05eeEF692Bac985706f49E177b', // [@status DEPRECATED @reason altair-generalized-indices-never-match-electra @replacement AereEthLightClient] + AereEthLightClient: '0x8a453D06F67c32E9908024743BDA74A01CEEbE93', // native Ethereum beacon light client on AERE, CORRECTED to the ELECTRA generalized indices (finalized_checkpoint.root gindex 169 -> depth 7/idx 41; next_sync_committee gindex 87 -> depth 6/idx 23; current committee gindex 86). Gindices confirmed against consensus-specs (specs/electra/light-client/sync-protocol.md: FINALIZED_ROOT_GINDEX_ELECTRA=169, NEXT_SYNC_COMMITTEE_GINDEX_ELECTRA=87, CURRENT_SYNC_COMMITTEE_GINDEX_ELECTRA=86) AND empirically OFF-CHAIN against a REAL live mainnet finality_update / update: finality branch (len 7) verifies at gindex 169, next-committee branch (len 6) at gindex 87, and the committee BLS signature verifies (511/512 participants, POP DST). Bootstrapped with REAL data VERIFIED on deploy: genesisValidatorsRoot 0x4b363db9…bfe95, sync-committee root 0x40474717…0a25, finalized header slot 14755232 (root 0x73f355ec…7d6f); header root == chain finalized root, committee root verifies at gindex 86. HONEST SCOPE: BLS12-381 is classical/quantum-vulnerable (Ethereum's crypto, NOT AERE PQC). KNOWN LIMITATION (not a gindex bug): a full 512-member sync-committee processUpdate EXCEEDS AERE's EIP-7825 2^24 (16,777,216) per-tx gas cap — the Solidity committee-root recomputation alone costs ~13.22M gas (on-chain tampered-committee tx reverted at LC:committee mismatch, gasUsed 13,220,467) and the complete update OOGs at the cap (gasUsed==16,777,216, status 0; node rejects any gasLimit>2^24 with -32005 "Transaction gas limit cap exceeded"). So live Ethereum updates VERIFY OFF-CHAIN against this contract's (now-correct) logic but CANNOT be advanced on-chain in one tx — the real fix is a gas-optimized / multi-tx processUpdate or the SP1 zk-light-client path (see report). Do NOT claim on-chain live-update verification. No owner, no funds. Redeploy tx 0x2140a932f33db42f0952a175057bc1b3a0b9fb36788b0ba08c6826f0dc9d48f5 (gas 2,167,944), bootstrap self-tested on-chain (finalizedSlot()==14755232). 2026-07-12. [@status CANONICAL] + AereZkEthLightClient_DEPRECATED_UNBOUND_VERIFY: '0x2a2b6D936002A62adb4bb1d131007ec564429E9d', // DEPRECATED — UNBOUND verify(), SUPERSEDED by AereZkEthLightClientV2 0x6f01ac96…17a8. Its processProof path is SAFE (binds gvr + prevCommitteeRoot before advancing) and its one historical advance was backed by a REAL Groth16 proof, so nothing false was ever recorded — but its PUBLIC verify() view ran the proof and abi.decoded with NO anchor binding, so any consumer using it as a finality ORACLE can be handed a proof over a PROVER-CHOSEN sync committee and an arbitrary Ethereum head. DEMONSTRATED LIVE 2026-07-17 with the REAL proof from its own processProof tx 0xba422694…8628: verify() returns NO REVERT for prevCommitteeRoot 0x40474717…0a25 while trustedCommitteeRoot() is 0x68874d30…6c96 (it never compares). Immutable — cannot be fixed in place. Left on-chain: no owner, no funds, harmless unless verify() is trusted as an oracle. DO NOT use verify() as a finality oracle; repoint to V2. See docs/ZK-ANCHOR-FIXES-2026-07-17.md. [@status DEPRECATED @reason verify-not-bound-to-committed-anchor @replacement AereZkEthLightClientV2] + AereZkEthLightClientV2: '0x6f01ac96a28D0d670f94A41F323f198be14a17a8', // CANONICAL inbound zk Ethereum light client. REPLACES 0x2a2b6D93…29E9d (below), whose public verify() view ran the Groth16 proof and abi.decoded WITHOUT binding the committed gvr/prevCommitteeRoot to its trusted state — the stateful processProof path always bound them, the view did not, so a consumer using verify() as a finality oracle could be handed a proof over a PROVER-CHOSEN sync committee and an arbitrary Ethereum head. V2 routes processProof AND verify through one _bindToAnchor() (gvr == immutable genesisValidatorsRoot, prevCommitteeRoot == trustedCommitteeRoot, nextCommitteeRoot != 0), mirroring AereZkQbftLightClient 0xCaDA54FA…6488 (always bound) and the AereOutboundVerifierV2 0x08b68bd5…a96F anchor fix. Also adds the code-less-verifier constructor guard V1 lacked. GUEST UNCHANGED: same eth-lightclient ELF, same PROGRAM_VKEY 0x00f03e1a45f22b1a283fde42dab83e0f70b36d054d18f032b4556fe30f74d191 — no reproving. LINEAGE PRESERVED, NO HEAD REGRESSION: the deploy script READ the live V1 state and bootstrapped V2 from it — gvr 0x4b363db9…bfe95, trustedCommitteeRoot 0x68874d30…6c96 (period 1802, V1's already-ROTATED committee, not its bootstrap), finalizedSlot 14,753,792, finalizedHeaderRoot 0x0d62648b…57d7 (on-chain self-check PASS on all six fields). Deploy tx 0x6a63163a5ee6102ffef5f28b926af54a83922a7de4149c89397fb8d0c56df64f (block 10,082,267, gas 444,789, deployer 0xbeB33D20…6465). ATTACK REJECTED LIVE WITH A REAL PROOF (2026-07-17): the REAL 356-byte Groth16 proof recovered from V1's own processProof tx 0xba422694…8628 commits prevCommitteeRoot 0x40474717…0a25 (period 1801), while both clients now trust period 1802 — replayed through the REAL SP1VerifierGateway 0x9ca479…0628, V1.verify() returns NO REVERT and hands back the tuple (committee-in-proof == trusted? FALSE — V1 never compares), while V2.verify() REVERTS CommitteeMismatch(0x40474717…0a25, 0x68874d30…6c96). HONEST: that live demo uses a real STALE committee, not a fabricated one (fabricating needs a new proof); the code path is identical because V1 performs NO committee comparison at all, and the fabricated prover-chosen-committee case is proven in test/zk-eth-lightclient-anchor-fix-2026-07-17.test.js (21/21, gateway mocked to ACCEPT = the attacker HAS a valid proof: V1.verify() returns the attacker's Ethereum head, V2 reverts). HONEST SCOPE: verify() has NO monotonicity constraint by design (a stateless view has no head to advance; matches the QBFT sibling) — returning means "signed by the committee this client currently trusts", NOT "newer than the tracked head"; consumers needing recency must read finalizedSlot(). The committee lineage is an EXPIRING CREDENTIAL: it only moves when someone submits a proof. TRUST-MINIMIZED (>= 2/3 of Ethereum's 512 sync committee), NOT trustless, NOT quantum-safe (BLS12-381 + Groth16/BN254 are classical); APPLICATION/INTEROP layer — does NOT touch AERE consensus (still classical ECDSA QBFT). No owner, no funds. Full report: docs/ZK-ANCHOR-FIXES-2026-07-17.md. [@status CANONICAL] + // ── Threshold PQC custody + outbound zk light client (deployed 2026-07-14) ── + // ADDRESS-BOOK CATCH-UP (2026-07-14): both entries below were confirmed live on mainnet via direct + // eth_getCode / eth_call against https://rpc.aere.network AFTER this file's per-entry docs were last + // written (THRESHOLD-ACCOUNT-2026-07-14.md still reads "Not deployed" as of this same day); this file + // had no entry for either despite both being real, live, and functioning. Added to close that gap. + AereThresholdAccountFactory: '0xf8fCC337d7749Ff2935D755C5F3934e2B70779E8', // CREATE2 factory for AereThresholdAccount, a non-custodial ERC-4337 (v0.7) smart account whose owner is a t-of-n committee of NIST post-quantum keys (Falcon-512/1024, ML-DSA-44, SLH-DSA-128s); a userOp is authorized only once >= threshold DISTINCT committee members each supply a valid PQC signature, verified in full on-chain by the live precompiles 0x0AE1-0x0AE4. No single key can move funds; no admin/owner/recovery backdoor. VERIFIED LIVE (2026-07-14): eth_getCode on chain 2800 returns real non-empty runtime bytecode (confirmed directly against https://rpc.aere.network, not assumed from this file). Source: contracts/mpc/AereThresholdAccountFactory.sol + AereThresholdAccount.sol, 11/11 hardhat tests passing (test/AereThresholdAccount.test.js) plus an in-house audit pass (Slither, solc SMTChecker, Halmos, 300-iteration fuzzing, Semgrep, manual review) per ShippedSection.tsx's 2026-07-14 entry. HONEST GAP: this repository's own deploy tooling only has a local-network deployment record (contracts/deployments/threshold-account-factory.31337.json); no mainnet deploy-tx hash or deployer address was found in any file, so none is asserted here; only what was independently confirmed via live RPC is stated. Application/account layer only; AERE consensus stays classical ECDSA QBFT. [@status CANONICAL] + // ── CANONICAL outbound zk BRIDGE VERIFIER — ANCHOR-BOUND FIX (deployed 2026-07-17) ── + AereOutboundVerifierV2: '0x08b68bd553116Dffb99E648cb764AA93930da96F', // CANONICAL outbound (AERE -> destination) zk bridge verifier. REPLACES the forgeable AereOutboundVerifier 0x8E89…074e. Admits an AERE outbound message on an SP1/Groth16 proof that the AereOutboundOutbox 0xd43F…7936 log was included in a QBFT-final block, then delivers it exactly once to the target handler. THE FIX (vs V1): the zk-interop guest was rewritten to COMMIT `validatorSetRoot` (keccak256 over the set the finality obligation was actually discharged against) and to commit `chainId` from a COMPILE-TIME CONSTANT instead of echoing the prover's input; this contract then BINDS that committed root to TRUSTED_VALIDATOR_SET_ROOT 0x5fa93ba7730cdb599fd814c0497565f320f10d808b6ed485c3e02fb1a1e2dd79 — an IMMUTABLE anchor = keccak256 over the LIVE N=7 validator set in ascending order (re-derived from qbft_getValidatorsByBlockNumber inside the deploy script, which would have aborted on mismatch before spending gas). Without that bind, `finalized==true` means only "final under a set the PROVER chose" — which is why V1 was forgeable. Also adds: MIN_SOURCE_BLOCK 9,312,565 (first block sealed by the anchored set = the anchor's validity window), an exact 288-byte publicValues length check, a non-zero-vkey constructor guard (V1 could be deployed with programVKey==0x0 — fail-closed but a trap), a code-less-verifier guard, and exactly-once replay by messageId. PROGRAM_VKEY 0x00a71f7d74d3a503326a93c88b0f6a6d3bfe4609e79959cc5cad56a0d5f208d0 = the REAL vkey of the compiled zk-interop-guest ELF (sha256 0b14f9bf…c691, 363,432 bytes, SP1 6.3.1, cargo-prove 8252c29), derived deterministically via client.setup(ELF) on a dedicated non-infra prover (deleted after use) — NOT a placeholder. Deploy tx 0x03a67d48e772284c117cb23f4732209fec5ba087fa5e97e8ec98fdd462a252f0 (block 10,073,049, gas 617,696, deployer 0xbeB33D20…6465). PROVEN BOTH DIRECTIONS ON MAINNET (2026-07-17): (+) POSITIVE — a REAL Groth16 proof (356 bytes, 288-byte publicValues, selector 0x4388a21c) that a genuine AereOutboundOutbox log emitted in chain-2800 block 10,073,141 (sealed by a real 5-of-7 committed-seal quorum of the live set) is QBFT-final and included, DELIVERED via deliver() tx 0xc27f09365e9bbeb37225bc42d1fc194228326f57352d1c8842159fb7f5a62b2b (block 10,074,980, gas 471,507, far under the EIP-7825 2^24 cap): deliveryCount 0 -> 1, delivered[0x759ce49f…a927]==true, and AereOutboundDeliveryRecorder recorded the payload. (-) ATTACK REJECTED — a REAL Groth16 proof over a FORGED header (7 attacker-generated keys named as the validator set, self-sealed to a 5-of-7 quorum, attacker-built receiptsRoot carrying a forged message ascribed to the real Outbox; the guest verifies it HONESTLY because the circuit cannot know which set is real) REVERTS with ValidatorSetMismatch(0x4f2c0cf7…23ee, 0x5fa93ba7…dd79) — committed attacker root != anchored root. PAIRED CONTROL: that same forged proof is ACCEPTED as cryptographically VALID by the REAL LIVE SP1VerifierGateway 0x9ca479…0628 (eth_call, V1-design vkey 0x00123374…66f5), and the V1 gate logic delivers it (test/outbound-verifier-v2-anchor-fix.test.js, 10/10) — i.e. the old design really would have minted a forged bridge message; no forgeable verifier was ever deployed live to show it. HONEST SCOPE: APPLICATION/INTEROP layer only — does NOT change or touch AERE consensus (still classical ECDSA QBFT) and is NOT post-quantum (secp256k1 seals + Groth16/BN254 wrap; falconVerified must be false and is rejected if true). TRUST-MINIMIZED, NOT TRUSTLESS: security reduces to >= 5-of-7 of AERE's QBFT validators being honest (ALL Foundation-operated, so an operator assumption, not an economic one) PLUS the pinned vkey PLUS the SP1 gateway PLUS the anchor being the right set. THE ANCHOR DOES NOT TRACK ROTATION: a validator-set change requires a fresh deployment; consumers MUST check TRUSTED_VALIDATOR_SET_ROOT still equals keccak256 over the live set before trusting this contract (treat it as an expiring credential). Immutable, no owner, no funds. [@status CANONICAL] + AereOutboundDeliveryRecorder: '0x98fa803a58e6B4A726C1d783eA91f06826226813', // The demonstration delivery target for AereOutboundVerifierV2 — records each delivered message so the outbound loop is auditable end-to-end on chain. Deploy tx 0x4e68736b15ae81cc1cd7ae98a635fb2e4f0a6d0be1ede38dfa57cc098cbe1f9f (block 10,073,047, gas 368,519). DELIBERATELY UNAUTHENTICATED: anyone can call handleAereMessage directly and record an arbitrary entry, so its contents are NOT evidence of a proven message — the trust-minimised guarantee lives in the verifier, not here. A REAL application handler MUST gate on msg.sender == the verifier. No owner, no funds. [@status CANONICAL] + // ── CANONICAL outbound zk QBFT light client — 7-SET ANCHORED (deployed 2026-07-16) ── + AereZkQbftLightClient: '0xCaDA54FAb6E7AE311d240Cf0C2Df45e974156488', // CANONICAL. Outbound direction of AERE's zk light-client stack: ANY external chain/verifier can advance a trust-minimized view of AERE's OWN QBFT finality via processProof(publicValues, proof) — a permissionless ~313k-gas SP1 Groth16 verify through the live SP1VerifierGateway 0x9ca479…0628 (route 0x4388a21c -> SP1VerifierGroth16 v6.1.0 0xb5456d48…71aD), binding blockHash/blockNumber/committedSealHash/validatorSetRoot/finalized/falconVerified to a fixed anchor and requiring blockNumber to STRICTLY advance. REPLACES 0xc9A2…B1c2, which is permanently frozen at a STALE N=3 anchor (see DEPRECATED entry below). Deploy tx 0xb3b0f8f5dfd121370874e6c7baea96b107be8305e1805f60ba26e7acb60eeae4 (block 9,991,201, gas 502,790, deployer 0xbeB33D20…6465). PROGRAM_VKEY 0x00c802837538e13424d93e43ac4b9d8005d23f62359317096c40d43d5ab7adc1 = the REAL vkey of the compiled qbft-lightclient-guest ELF (sha256 e8aa1369…9dba, SP1 6.3.1, cargo-prove 8252c29), derived deterministically from the ELF on a dedicated non-infra prover — NOT a placeholder. trustedValidatorSetRoot 0x5fa93ba7730cdb599fd814c0497565f320f10d808b6ed485c3e02fb1a1e2dd79 = keccak256 over the LIVE N=7 validator set in ascending order, independently reproduced three ways (node from qbft_getValidatorsByBlockNumber at 'latest' AND at the bootstrap block, and by the Rust guest/host) and re-verified against the live chain inside the deploy script before it spent gas. Weakly-subjective bootstrap = block 9,312,565 (0xdbb9ee56…f474) = the FIRST block sealed by this 7-set (N=6 at 9,312,564), i.e. the honest start of the anchor's validity window. PROVEN END-TO-END ON-CHAIN (2026-07-16): a REAL SP1 Groth16 proof (356 bytes, selector 0x4388a21c) that chain-2800 block 9,989,005 carries a valid 5-of-7 (2f+1, quorum=ceil(2*7/3)) ECDSA committed-seal quorum under the live set was generated on a dedicated non-infra Hetzner box (deleted after use) and submitted via processProof tx 0xc606be93490b9944b16c6f1743fd9ed3de046765831d84ec904fdd95a5102903 (block 9,991,732, gasUsed 313,462 — far under the EIP-7825 2^24 cap): finalizedNumber ADVANCED 9,312,565 -> 9,989,005, finalizedBlockHash = 0x0c787718…77f0 (== the real chain hash of 9,989,005, cross-checked via eth_getBlockByNumber), updateCount 0 -> 1. Tamper-reject verified live: tampered proof, tampered publicValues, a stale-N=3-anchor publicValues, and a replay of the same proof ALL revert. HONEST SCOPE: this is an APPLICATION/INTEROP-layer contract — it does NOT change or touch AERE consensus (still classical ECDSA QBFT) and is NOT post-quantum (secp256k1 seals + Groth16/BN254 wrap; falconVerified is recorded but never required and is false). TRUST-MINIMIZED, NOT TRUSTLESS: security reduces to >= 5-of-7 of AERE's QBFT validators being honest (ALL Foundation-operated today, so this is an operator assumption, not an economic one) PLUS the pinned vkey PLUS the SP1 gateway PLUS the immutable validator-set anchor. The anchor does NOT track rotation: a future validator-set change requires a fresh deployment (this redeploy is exactly that event happening). Advancing is permissionless but not automatic — the head moves only when someone submits a proof. No owner, no funds. [@status CANONICAL] + AereZkQbftLightClient_DEPRECATED_STALE_ANCHOR: '0xc9A2DCaeD0Ceb2B400Dd705a75cbabEBf5aBB1c2', // DEPRECATED — STALE ANCHOR, DO NOT USE AS A LIVE FINALITY ORACLE. Same contract code, but its IMMUTABLE trustedValidatorSetRoot is 0x694a716bc7af1e5e7939cc03c5f7e6e9d32f388d4805d54ee9787903d898dc2f = the HISTORICAL N=3 set (0x4bf6…0044 / 0xb5e7…c2a8 / 0xf73b…c00d), reproduced exactly on 2026-07-16 as keccak256 of those three addresses in that order. The live set became N=7 at block 9,312,565, so this client can NEVER verify a header sealed by the current set: the guest commits validatorSetRoot over the real set and processProof reverts with ValidatorSetMismatch. Verified live 2026-07-16 via eth_call on https://rpc.aere.network: finalizedNumber() = 9,241,622, finalizedBlockHash() = 0x00e9cda8…6f63 (== the REAL chain hash of block 9,241,622, cross-checked), updateCount() = 1, PROGRAM_VKEY() = 0x002c6293…71f2, SP1_VERIFIER() = 0x9ca479…0628. That single advance WAS backed by a real Groth16 proof (the gateway's 0x4388a21c route points at the real SP1VerifierGroth16 v6.1.0 and processProof reverts on any verify failure, so no advance is possible without one), and block 9,241,622 was itself sealed under the N=3 set — self-consistent. But it is FROZEN at that historical head (~750k blocks behind), tracks a validator set that no longer exists, and is superseded by 0xCaDA54FA…6488. Left on-chain (immutable, no owner, no funds, harmless). Note: its PROGRAM_VKEY 0x002c6293…71f2 was NOT reproducible from a clean 2026-07-16 rebuild of the same guest source (a fresh build yields 0x00c80283…adc1) — SP1 ELFs are not byte-reproducible across toolchain/dependency-resolution differences, so the old vkey's provenance cannot be independently re-derived today; the new deployment's vkey CAN be, and was proven end-to-end. [@status DEPRECATED @reason immutable-anchor-frozen-at-historical-n3-set @replacement AereZkQbftLightClient] + AereCompliancePoolSP1Verifier: '0xE2D3fa91b680E835c971761ba75Fde0204AEF95E', // vkey 0x00aa183a…. [@status CANONICAL] + AereAIProof: '0xFf92c669AbF4C1DAE31eBFCC017764036d9D97e6', // [@status CANONICAL] + AereAttestationGateway: '0x9bdacA8dfF39Fc688e8D3c4bbA13bCFC0580c325', // [@status CANONICAL] + AereBestExReceipt: '0x3c80BD6fa0d9a2274c7fBD5943B5EC03313D92d7', // MiCA Article 78. [@status CANONICAL] + // DEPRECATED / FLAWED LIVE HUB — two audited defects (F-SWEEP HIGH griefing + F-LOCK liveness). Superseded by AereSettlementHubV2 below. Holds ZERO value (bootstrap); NOT migrated/re-pointed by the V2 deploy (that swap is founder-supervised: aerenew/docs/SETTLEMENT_HUB_V2_MIGRATION_RUNBOOK.md). Do NOT route new deposits/intents here. + AereSettlementHub_v1_DEPRECATED_FLAWED: '0x2a02fD80c16293D2B5D8a295F31D1a6E6a582c02', // BUG(F-SWEEP, HIGH griefing): sweepResidual() was permissionless with no residual accounting, so any EOA could push a live claimed intent's parked funds + posted solver bonds into the sink, making settle() revert TransferFailed and permanently bricking the settlement (depositor funds burned, solver unpaid). BUG(F-LOCK, liveness): an unclaimed deposit had no refund/cancel/timeout path and was locked forever. Superseded by AereSettlementHubV2. [@status DEPRECATED @reason settlement-flaw-superseded-by-corrected-fork @replacement AereSettlementHubV2] + // ── Settlement hub V2 — corrected fork (FRESH INERT, deployed 2026-07-12, deployer 0xbeB3…6465) ── + AereSettlementHubV2: '0xAe1c8F4d8d14BDE6121aCD525Af5A93f52946F41', // CANONICAL corrected settlement hub. FRESH + INERT: deployer-owned (owner 0xbeB3…6465), holds nothing, SINK=live AereSink 0x6958…1676 (immutable), NOT wired live, live V1 untouched, NOT migrated. FIX(F-SWEEP): per-asset committedLiabilities (parked intent remainders + posted bonds) maintained in lockstep across deposit/bond/settle/cancel/slash gates sweepResidual to residualOf = balance - committed, so a permissionless sweep can only ever take genuine surplus (a fee or slashed bond that could not reach the sink) and can NEVER touch a live intent's funds or a solver bond (reverts ExceedsResidual). FIX(F-LOCK): records createdAt and adds cancelIntent(), a depositor-only refund of the parked remainder after REFUND_TIMEOUT (7 days), only while the intent is unclaimed + unsettled. settle() semantics identical to V1. 7995 bytes runtime (eth_getCode non-empty); byte-identical to the 0.8.23/viaIR artifact except at the SINK immutable slots (every differing byte is a 0x00 placeholder). Deploy tx 0xcb713afe2b89405d1a8d30d25c8542121a189ed0fbb94ce34204834dcded5bad. Proven by test/settlementhub-v2-fix.test.js (5 passing: F-SWEEP closed + settle still pays, F-LOCK refund + rejection paths, genuine-residual bounded by residualOf, full legit deposit/bond/claim/settle/slash with conservation at each step); V1 regression suite test/settlement-hub.test.js still green. Founder-supervised swap: aerenew/docs/SETTLEMENT_HUB_V2_MIGRATION_RUNBOOK.md (NOT executed). [@status INERT @reason corrected-fork-deployed-inert-not-repointed] + AereCoinbaseSplitterV2: '0x8C1A48eFA57b66fEE743A00E3899c29ad3Fd27b4', // [@status CANONICAL] + // DEPRECATED — BUGGY V1 pair (finding F13: per-agent nonce-namespace collision, LIVENESS, no theft). Left on-chain (harmless); do NOT use. Superseded by the cross-wired AereAgentV2 + AERE402FacilitatorV2 below. + AereAgent_v1_DEPRECATED: '0xE96396B4b596B3A74e4195Be12aADd5257863536', // companion to the buggy V1 facilitator; its immutable AERE402_FACILITATOR pins the V1 facilitator, so it can NOT pair with FacilitatorV2 (debit is facilitator-gated). Superseded by AereAgentV2. [@status DEPRECATED @reason debit-path-not-facilitator-gated @replacement AereAgentV2] + AERE402Facilitator_v1_DEPRECATED: '0xbA6e6700D629a5E3C885778a42885a944CA84E56', // BUG(F13): replay key consumed[agentId][nonce] was GLOBAL per agent, so two providers following the documented per-provider monotonic-nonce convention collided and a fully valid, agent-signed settlement reverted NonceAlreadyConsumed (denial of settlement). Superseded by AERE402FacilitatorV2. [@status DEPRECATED @reason replay-key-global-per-agent-blocks-valid-settlement @replacement AERE402FacilitatorV2] + AereAgentV2: '0x3FAcb997eb4252341052e7c84a86fCa0513c4490', // CANONICAL. Machine-account registry, logic-identical to V1 AereAgent (5748 bytes), cross-wired so AERE402_FACILITATOR = AERE402FacilitatorV2. A companion redeploy is required because debit is gated to the immutable facilitator. No new token, no owner. Deploy tx 0x82a75c88…, block 8912669. [@status CANONICAL] + AERE402FacilitatorV2: '0xFC2f7FAa94919caF1126b3c995F0F6AcCef291de', // CANONICAL. HTTP-402 agentic settlement. FIX(F13): replay key is now consumed[agentId][payee][nonce] — each (agent,payee) pair owns an independent nonce namespace; a TRUE replay (same agentId+payee+nonce) still reverts, so replay strength is unchanged. AGENT_REGISTRY=AereAgentV2, SINK=AereSink 0x6958…1676 (matches V1), 25-bps fee, EIP-712 domain name unchanged ("AERE402Facilitator", domain-separated by verifyingContract so signer SDKs swap only the address). Deploy tx 0x14f8a3c1…, block 8912670. DEMONSTRATED live on chain 2800: V1 pair reproduced the collision (payeeA settle nonce=1 OK -> payeeB nonce=1 REVERT); V2 pair — payeeA AND payeeB both settled nonce=1 (each received 0.00399 WAERE) and a true replay reverted. Point providers/SDK here. [@status CANONICAL] + // DEPRECATED / FLAWED LIVE 7702 TARGET — two session-key scope escapes. Superseded by AereDelegate7702V2 below. Holds ZERO value (bootstrap). No live EOA is re-pointed by the V2 deploy (delegating EOAs opt in to V2 by re-signing their own 7702 tuple — founder-supervised: aerenew/docs/DELEGATE7702_V2_MIGRATION_RUNBOOK.md). Do NOT point new 7702 delegations here. + AereDelegate7702_v1_DEPRECATED_FLAWED: '0x5673D92080efbd0987402E9335c14200d0a5EaeF', // BUG(FACET 1, drain): a session key was bound ONLY by a 4-byte selector allow-list — no target allow-list and no native-value cap — so a key granted selector S could aim `target` at ANY contract exposing S and set `value` to the account's entire native balance, draining it to an arbitrary address. BUG(FACET 2, escalation): onlyOwner is msg.sender==address(this) and executeWithSessionKey calls out with msg.sender==address(this), so a key granted a selector colliding with setPasskey/addSessionKey/revokeSessionKey could target the account itself and pass onlyOwner, taking it over. Superseded by AereDelegate7702V2. [@status DEPRECATED @reason delegation-flaw-superseded-by-corrected-fork @replacement AereDelegate7702V2] + // ── EIP-7702 delegate V2 — scope-hardened (FRESH INERT, deployed 2026-07-12, deployer 0xbeB3…6465) ── + AereDelegate7702V2: '0xC6d18e0Ce1B6467d952e31315505E0190a4A3310', // CANONICAL scope-hardened 7702 delegation target. FRESH + INERT: this is a fresh CODE address; no live delegating EOA is migrated (an EOA opts in only by re-signing its own 7702 tuple). Owner (executeBatch) and passkey (executeWithPasskey) paths are behaviorally IDENTICAL to V1. FIX(FACET 1): addSessionKey now takes a per-key TARGET allow-list AND a per-key native SPEND CAP (cap defaults to 0 = key moves no native value unless the owner grants a cap); executeWithSessionKey enforces both (TargetNotAllowed / SpendCapExceeded, cumulative across calls). FIX(FACET 2): a session key can never target address(this) (rejected at grant and at call), so it can never reach an owner-gated function via msg.sender==address(this). Note the addSessionKey INTERFACE + storage changed vs V1 (extra spendCap + allowedTargets), so V2 is a fresh contract, not a hot-swap of the same code. 4535 bytes runtime (eth_getCode non-empty); byte-identical to the 0.8.23/viaIR artifact (no immutables, 0 differing bytes). Deploy tx 0xea1bd2789a1862493e5c7ac0d0b044a721784dfa05af67752e9d2e45b7fd2e6a. Proven by test/delegate7702v2-scope-fix.test.js (8 passing: FACET 1 drain + cumulative-cap closed, FACET 2 self-call escalation closed, legit scoped call + owner batch + revocation/expiry + passkey no-replay preserved). Founder-supervised swap: aerenew/docs/DELEGATE7702_V2_MIGRATION_RUNBOOK.md (NOT executed). [@status INERT @reason corrected-fork-deployed-inert-not-repointed] + AereDelegationRegistry: '0x6c25c07D134713b6C2F8E19D807423f022903D63', // [@status CANONICAL] + AereInsuranceFund: '0x5Ab95C549c2A2b07913Df7edD4a16fd108B7CAAC', // 7-day cooldown. [@status CANONICAL] + AereNavOracle: '0xC8D12E44f10b03477330b35115b432750831fEBD', // Merkle-rooted RESERVE attestations (proof-of-backing). Holds NO per-asset price. For AereLendingOracle NavOracle-type collateral PRICES use AereNavOracleAdapter below (finding F12). [@status CANONICAL] + AereNavOracleAdapter: '0xBb8bB6846d2440FdF0076fc5750baE11C2731D21', // FIX(F12): owner-attested per-asset RWA NAV price feed implementing latestForAsset(bytes32) that AereLendingOracle.FeedType.NavOracle expects. The deployed AereNavOracle stores Merkle reserve-snapshot roots (a total reserve AMOUNT per leaf, not a per-unit price; a bytes32 key cannot recover a value from a root) so configureFeed(NavOracle -> AereNavOracle) reverted (dead path). A NavOracle-type feed now points HERE — no AereLendingOracle redeploy. owner=Foundation; NAV_ORACLE ref=0xC8D1…fEBD (provenance only, never read for price). LendingOracle still enforces staleness + deviation on top, so the hot key cannot jump the price. Deploy tx 0x73e0ca15…, block 8912639. DEMONSTRATED live via a byte-identical deployer-owned AereLendingOracle twin (== canonical, 3218 bytes): raw-NavOracle configureFeed REVERTED; adapter-backed configureFeed SUCCEEDED and getPrice returned the attested 1.02e18. QUEUED Foundation actions: setNav(,<18-dec NAV>) + configureFeed(,1,adapter,,…) on the canonical LendingOracle 0xc0f1…4C49. [@status CANONICAL] + // ── Agentic bond / reputation / memory + AI-Act log oracle (deployed 2026-07-10, deployer 0xbeB3…6465) ── + // Additive registries, no new token. Slashing oracle + reputation attestor are immutably the Foundation account (a single-key EOA today, not a multisig). + AereAgentBond: '0x32E0015F622a8719d1C380A87CE1a09bcd0cB86A', // slashable agent bond; slashed WAERE flushes to AereSink; oracle=Foundation. [@status CANONICAL] + AereAIReputation: '0x781ef746c08760aa854cDa4621d54db6734bfeBF', // composable reputation over AereAgentBond; attestor=Foundation. [@status CANONICAL] + AereAgentMemoryVault: '0x309b56BDf0E3F6C10783eB76c0C02127F933D641', // portable user-owned AI agent memory; no admin. [@status CANONICAL] + AereInferNet: '0xba76891DB84B9755613dE3A1c7F3902BB6bbf856', // EU AI Act Art.12 inference-log Merkle commitments; permissionless, no PII. [@status CANONICAL] + // ── Parallel-EVM hints + delegator slashing coverage (deployed 2026-07-10, deployer 0xbeB3…6465) ── + AereBlockSTMRegistry: '0x98E2C3e615841919d173D8FF642514c5902E8A28', // roadmap #33 — opt-in r/w slot-hint registry for the Block-STM scheduler; advisory only, no admin over others. [@status CANONICAL] + // DEPRECATED — BUGGY V1 (finding #10 GRIEFING). Left on-chain (0 real usage, harmless); do NOT use. Superseded by AereSlashingInsuranceV2 below. + AereSlashingInsurance_v1_DEPRECATED: '0xAd0109A880444519DDbdbFDF3561C624787591bC', // BUG(HIGH): cancelCoverage had NO timelock guard, so a griefer could front-run a MATURED, legitimate executeCoverage with cancelCoverage and delete the claim; repeated on each re-proposal this permanently blocked the payout. Superseded by AereSlashingInsuranceV2. [@status DEPRECATED @reason cancelCoverage-griefing-after-claim-matures @replacement AereSlashingInsuranceV2] + AereSlashingInsuranceV2: '0x86430e5D743787cA0b074a7ec69AF84840E7485C', // CANONICAL. roadmap #21 delegator slashing-loss coverage vault (native AERE, NOT a token); Foundation-only timelocked coverage, per-event cap 50k AERE, 1d cooldown, NO admin withdrawal. FIX(finding #10): cancelCoverage reverts ClaimMatured once block.timestamp >= readyAt, so a matured claim can only be EXECUTED (pre-maturity cancel stays permissionless so the community can still veto a compromised-key proposal). owner=Foundation, prod params match V1. Deploy tx 0x677d559c…e955b212, block 8899939. Live-DEMONSTRATED on a byte-logic-identical deployer-owned twin: matured cancelCoverage -> ClaimMatured() [0x77b48094]; executeCoverage paid the frozen payout; an un-matured claim was still cancellable. [@status CANONICAL] + // ── Rollup validity (ZK) settlement anchor (deployed 2026-07-10, deployer 0xbeB3…6465) ── + AereRollupValidity: '0x38772063572DF94E90351e44ccbBEefD5F497fbd', // on-chain anchor for SP1 Groth16 validity proofs of AERE's rollup executor. Epoch 0 recorded from a REAL proof (submit 0xd4f8d858…12a4b0): latestRoot=0x256fa277…25e3ac, epochCount=1. No owner/admin; immutable gateway 0x9ca479C8…70628 + vkey 0x00c39737…84ad. HONEST SCOPE: proves the CURRENT bounded-VM executor (Transfer/Sweep/Increment/AmmSwap), NOT a full EVM. [@status CANONICAL] + // ── Hybrid ECDSA + Falcon-512 auth + validium-grade DA committee (deployed 2026-07-10, deployer 0xbeB3…6465) ── + AereHybridAuth: '0xc20390C9656ECe1AE37603c84E395bC898b3FAA1', // roadmap #59 — authorizes iff BOTH a secp256k1 ECDSA sig AND a NIST Falcon-512 sig verify over the SAME 32-byte hash. Falcon leg via the live AereFalcon512Verifier 0x4E8e…D8fFC. DEMONSTRATED live: registered a hybrid identity, authorize tx 0x6c8a9283…ae148 accepted (both legs valid, gasUsed 10,299,873 < EIP-7825 2^24 cap), isAuthorized=true. checkHybrid() view rejects tampered-Falcon (true,false,false) and wrong-ECDSA (false,true,false). No owner/admin; append-only registration. [@status CANONICAL] + // DEPRECATED — BUGGY V1 (finding #9 FAIL-OPEN). Left on-chain (0 real usage, harmless); do NOT use. Superseded by AereDACommitteeV2 below. + AereDACommittee_v1_DEPRECATED: '0xC2a0e6f38084A08CcA768C01af3bFB52C5e99A43', // BUG(HIGH): removeMember clamped threshold to memberCount, so removing all members drove threshold to 0; then attest(…, sigs=[]) recorded availability with ZERO committee signatures (valid 0 < threshold 0 is false), forging availability with no sigs and breaking the "no admin backdoor" invariant. Superseded by AereDACommitteeV2. [@status DEPRECATED @reason fail-open-threshold-zero-forged-availability @replacement AereDACommitteeV2] + AereDACommitteeV2: '0xFADfDfF4c5db5f8e16315E3fbfA508f2cb89B1eE', // CANONICAL. validium-grade M-of-N data availability attestation committee (2-of-3 demo). FIX(finding #9): invariant memberCount>=threshold>=1 preserved everywhere; removeMember reverts WouldBreakThreshold before it could drop memberCount below threshold (the last member can never be removed, so threshold can never reach 0); attest([]) reverts EmptySignatureSet. ONLY attest() with >=M distinct member sigs (M>=1) can set available; NO admin backdoor. DEMONSTRATED live: 2-of-3 attest tx 0x01f3d279…b75684 -> available; 1-sig -> ThresholdNotMet(1,2) [0xb7842ce0]; attest([]) -> EmptySignatureSet() [0xc0e8691c]; removeMember-to-zero -> WouldBreakThreshold(1,2) [0x8d8048fb] (attack-probe 0xE8Ce029F…9A3c10). HONEST SCOPE: trusted committee attests availability, NOT trustless DA sampling, as centralized as the committee. Deploy tx 0x0355ca2a…011589e, block 8899888. Demo admin=deployer; Foundation transferAdmin queued. [@status CANONICAL] + // ── Lending ENGINE live + proven end-to-end 2026-07-07 (existing sAERE/WAERE, no new token) ── + AereLendingOracle: '0xc0f18A567067F1B84BDf75eDEbFaDdCBb70A4C49', // owner=Foundation. [@status CANONICAL] + AereLendingMarket_sAERE_WAERE: '0x2C2d39dB711C0A33De04Dc74b1E22f4760FD4bb0', // engine proof market; owner=Foundation. [@status CANONICAL] + // ── PENDING (real RWA markets blocked on bridged tokens / Hyperlane USDC.e bootstrap) ──── // AereCoreBookV0 — per-market deploy, needs BASE + QUOTE=USDC.e - // AereLendingMarket × 6 — needs USDC.e + bridged RWAs - // AereCompliancePool — needs USDC.e as TOKEN + // AereLendingMarket × 6 (BUIDL/USDY/OUSG/LBTC/SolvBTC/pumpBTC) — need bridged RWA + USDC.e + // AereCompliancePool — needs a fixed-denomination token // AereSpokePool — needs USDC.e // AereHypERC20Synthetic/Collateral — Hyperlane Warp Routes (Ethereum-side gas required) // RWATransferAdapter — needs Foundation NAV aggregators // AereCompliancePoolSP1Verifier — needs VKEY from cargo-prove build // ── dApp contracts (deployed 2026-05-22, owner = Foundation) ── - AereSwapFactory: '0xf0a8df7BDc25721892475B21271e52D77B0e84DC', // V2 AMM factory - AereSwapRouter: '0x7526B2E5526EfA84018378b60F2844Dad77523D8', // V2-style periphery (add/remove liquidity + swap) - AereBridge: '0x7eDa66cd93baAE19530839Bbb28ee36aC8aFAd68', // 1-of-1 Foundation signer (relayer pending) - AereMiningSubscription: '0xDad25d2163187DF8AAEcf9EA31b6355315Bb69f1', // 4 tiers, 30-day periods - AereNFT: '0x3f9A9D9CAB005327869396C69bE226ef98039f1c', // ERC-721 + EIP-2981 royalties - AereNFTMarketplace: '0x852e07F2619F7F4aD10d9f2aC681310301d99528', // on-chain marketplace, 2.5% fee + AereSwapFactory: '0xf0a8df7BDc25721892475B21271e52D77B0e84DC', // V2 AMM factory. [@status CANONICAL] + AereSwapRouter: '0x7526B2E5526EfA84018378b60F2844Dad77523D8', // V2-style periphery (add/remove liquidity + swap). [@status CANONICAL] + AereBridge: '0x7eDa66cd93baAE19530839Bbb28ee36aC8aFAd68', // 1-of-1 Foundation signer (relayer pending). [@status CANONICAL] + AereMiningSubscription: '0xDad25d2163187DF8AAEcf9EA31b6355315Bb69f1', // 4 tiers, 30-day periods. [@status CANONICAL] + AereNFT: '0x3f9A9D9CAB005327869396C69bE226ef98039f1c', // ERC-721 + EIP-2981 royalties. [@status CANONICAL] + AereNFTMarketplace: '0x852e07F2619F7F4aD10d9f2aC681310301d99528', // on-chain marketplace, 2.5% fee. [@status CANONICAL] // ── Governance + locked staking ─────────────────────────── - AereGovernanceStaked: '0x8D77C888e439C4fADb2e23F1567a0A1965F80bCb', // stake-weighted (reads AereStaking) - AereLockedStaking: '0x21108c28A849b05aE6b7a3a5bc435C9Bc897E7Ad', // fixed-term locks: 30d/10%, 90d/15%, 180d/22%, 365d/30% APY + // SUPERSEDED_STILL_PRIVILEGED / LEGACY_NON_EXECUTING (audit C11, 2026-08-01). NEVER an ownership destination: + // its only execution path is a self-call address(this).call(...), so it can never emit a call to an outside + // address and can never act as the owner of anything. Ownership sent here is unrecoverable under one-step Ownable. + // Enforced by contracts/scripts/ownership/ownership-allowlist.js. + AereGovernanceStaked: '0x8D77C888e439C4fADb2e23F1567a0A1965F80bCb', // stake-weighted (reads AereStaking). [@status CANONICAL] + AereLockedStaking: '0x21108c28A849b05aE6b7a3a5bc435C9Bc897E7Ad', // fixed-term locks: 30d/10%, 90d/15%, 180d/22%, 365d/30% APY. UNFUNDED: rewardReserve() == 0, so no yield is payable today and withdraw() at maturity reverts; earlyExit() still returns principal. [@status CANONICAL] // ── Tier-1 DeFi (deployed 2026-05-31) ───────────────────── - AereFeeBurnVault: '0x696afDF4f814e6Fd6aa45CE14C498ed9375fB2c6', // protocol-fee burn endpoint (stateless, no admin) - AereYieldFarm: '0xF86Fb0Eb3262C4e93Dbb349d63023218a5Db713F', // MasterChef-style LP staking → native AERE rewards - AereMiningDistributor: '0x0607ad23534ee251f359D960f7a6823C6b876b26', // Merkle-claim AireFlow payout (per-epoch, sweepable) + AereFeeBurnVault: '0x696afDF4f814e6Fd6aa45CE14C498ed9375fB2c6', // protocol-fee burn endpoint (stateless, no admin). [@status CANONICAL] + AereYieldFarm: '0xF86Fb0Eb3262C4e93Dbb349d63023218a5Db713F', // MasterChef-style LP staking → native AERE rewards. [@status CANONICAL] + AereMiningDistributor: '0x0607ad23534ee251f359D960f7a6823C6b876b26', // Merkle-claim AireFlow payout (per-epoch, sweepable). [@status CANONICAL] // ── Tier-1.3 paymaster stack (deployed 2026-05-31) ────────── - AereEntryPoint: '0x19773ba45287A64B05d0BCBD59D1371BF51Bd5D2', // Lightweight ERC-4337 EntryPoint compatible with our paymasters - AereOnboardingPaymaster: '0x4058E406475Dbed7056Aee0c808f293F05fEa879', // Foundation-funded · 3 lifetime UserOps/sender · 100/day sitewide cap - AereTokenPaymaster: '0xEb6e2Eb24e597C85392DdCD68a1F9b654FffdcB2', // Pay gas in any whitelisted ERC-20 (Foundation enables tokens) - AereStakeQuotaPaymaster: '0xD16C86D792444c2667A26dB62f01b90FC0DaB87b', // Stake AERE → daily free-tx quota (Tron-style UX) - AereAppPaymasterFactory: '0xEC22603E8712cBc5c31E53370D10f1a80CcB4DF0', // Permissionless factory — any dApp clones its own AereAppPaymaster + AereEntryPoint: '0x19773ba45287A64B05d0BCBD59D1371BF51Bd5D2', // Lightweight ERC-4337 EntryPoint compatible with our paymasters. [@status CANONICAL] + AereOnboardingPaymaster: '0x4058E406475Dbed7056Aee0c808f293F05fEa879', // Foundation-funded · 3 lifetime UserOps/sender · 100/day sitewide cap. [@status CANONICAL] + AereAppPaymasterFactory: '0xEC22603E8712cBc5c31E53370D10f1a80CcB4DF0', // Permissionless factory — any dApp clones its own AereAppPaymaster. [@status CANONICAL] + // DEPRECATED — BUGGY V1 paymasters. Left on-chain (fail-closed, harmless); do NOT wire the relayer/site to these. Use the V2 addresses below. + AereTokenPaymaster_v1_DEPRECATED: '0xEb6e2Eb24e597C85392DdCD68a1F9b654FffdcB2', // BUG(MED): withdrawToken used transferFrom(address(this)) → collected tokens stuck. Superseded by AereTokenPaymasterV2. [@status DEPRECATED @reason superseded-by-corrected-paymaster-fork @replacement AereTokenPaymasterV2] + AereStakeQuotaPaymaster_v1_DEPRECATED: '0xD16C86D792444c2667A26dB62f01b90FC0DaB87b', // BUG(HIGH): balanceOf(address) missing on real AereStaking + getLock field order mismatched → reverts on any real locker. Superseded by AereStakeQuotaPaymasterV2. [@status DEPRECATED @reason superseded-by-corrected-paymaster-fork @replacement AereStakeQuotaPaymasterV2] + + // ── Tier-1.3 paymaster stack V2 — bug-fix redeploys (deployed 2026-07-10, deployer 0xbeB3…6465, owner=Foundation) ── + // These are the CANONICAL paymasters. Point the relayer + website + SDK here. + AereTokenPaymasterV2: '0x217f56a5b0C7f35abe4D2fff924A6c13B85d7243', // Pay gas in any whitelisted ERC-20. FIX(MED): withdrawToken now uses transfer() so Foundation can sweep collected gas revenue. Deploy tx 0x155684d9…. Replaces 0xEb6e…dcB2. [@status CANONICAL] + AereStakeQuotaPaymasterV2: '0xE50464ca7E8E7F542D1816B3172a2330cFE384E8', // Stake AERE → daily free-tx quota (Tron-style UX). FIX(HIGH): reads the REAL AereStaking via validatorCount/validatorList/delegations + validators.selfStake (no balanceOf) and the REAL AereLockedStaking.getLock amount-first field order; bounded loops (MAX_*_SCANNED=100). LIVE-PROVEN: with a real 1-AERE lock, V1.stakedOf reverts while V2.stakedOf returns 1e18 (stake tx 0xbf0fbf4d…, earlyExit 0x5ce8307f…). Deploy tx 0xfc22a66b…. Replaces 0xD16C…B87b. [@status CANONICAL] // ── Tier-1.4 cross-chain messaging (deployed 2026-05-31) ────────── - AereMessenger: '0xe54c2329f0786CFE3420c566B646148D25477325', // Hyperlane Mailbox-compatible cross-chain message bus - AereIGP: '0x61B48615F490A23945988c92835eF35fdD86E837', // Interchain Gas Paymaster — receives AERE for outbound message gas + AereMessenger: '0xe54c2329f0786CFE3420c566B646148D25477325', // Hyperlane Mailbox-compatible cross-chain message bus. [@status CANONICAL] + AereIGP: '0x61B48615F490A23945988c92835eF35fdD86E837', // Interchain Gas Paymaster — receives AERE for outbound message gas. [@status CANONICAL] // ── Tier-1.5 intent-based cross-chain (deployed 2026-05-31) ────────── - AereSpokePool: '0xCAB1DBA5f6F06198000C20a974d675f1B3181AbD', // Across-v3-compatible SpokePool (deposit + fill + settlement) - AereERC7683: '0x67Fb9830e3a2BC06cEb641cfF3beD87b273ccb29', // ERC-7683 IOriginSettler — gasless cross-chain intents + // DEPRECATED / FLAWED LIVE STACK. HIGH theft-of-principal (fill-verification) bug found by + // seeded invariant fuzzing (contracts/test/spokepool-intents-invariant-property.test.js). + // The origin settlement handler authenticated a fill by (depositId, inputToken, inputAmount) + // ONLY; the OUTPUT actually delivered (outputToken / outputAmount / recipient) was never + // carried in the settlement message nor checked, and fillRelay accepted outputAmount = 0. So + // anyone could read a victim's public deposit event, fillRelay it delivering NOTHING, relay the + // genuine validator-signable settlement, mark the deposit settled, and drain the victim's entire + // locked principal while permanently blocking their refund. Superseded by the corrected FRESH + // INERT stack below. These live contracts are NOT migrated/re-pointed by that deploy; the swap + // is founder-supervised (see aerenew/docs/BRIDGE_FILL_VERIFICATION_MIGRATION_RUNBOOK.md). Do NOT + // wire new integrations here; do NOT route new deposits through them. + AereSpokePool_v1_DEPRECATED_FLAWED: '0xCAB1DBA5f6F06198000C20a974d675f1B3181AbD', // Across-v3-compatible SpokePool. BUG(HIGH): handle() released locked principal without verifying the delivered output leg; fillRelay allowed outputAmount=0. Theft-of-principal. Superseded by AereSpokePoolV2Corrected. [@status DEPRECATED @reason principal-theft @replacement AereSpokePoolV2Corrected] + AereERC7683_v1_DEPRECATED_FLAWED: '0x67Fb9830e3a2BC06cEb641cfF3beD87b273ccb29', // ERC-7683 IOriginSettler routing into the flawed SpokePool above. Superseded by AereERC7683V2Corrected. (Interface unchanged; the fix is in the SpokePool settlement path it delegates to.). [@status DEPRECATED @reason principal-theft @replacement AereERC7683V2Corrected] + + // ── Tier-1.5 CORRECTED intent stack (FRESH INERT, deployed 2026-07-12, deployer 0xbeB3…6465) ── + // Fixes the fill-verification theft-of-principal bug above. FRESH + INERT: deployer-owned, holds + // nothing, NO validators enrolled on its messenger, NO remote spoke enrolled, NOT wired to the + // live messenger route (0xe54c…7325), NOT migrated. The live flawed stack is untouched. Swap is + // founder-supervised: aerenew/docs/BRIDGE_FILL_VERIFICATION_MIGRATION_RUNBOOK.md (NOT executed). + // + // THE FIX (contracts/bridge/AereSpokePool.sol): the deposit now stores the full requested output + // leg (outputToken / outputAmount / recipient); fillRelay rejects outputAmount==0 and commits the + // ACTUAL delivered output into the settlement message; and origin handle() releases principal only + // when the delivered output satisfies the order (outputToken == requested, recipient == requested, + // outputAmount >= requested minimum). A fill that delivers nothing, the wrong token, to the wrong + // recipient, or short can no longer settle. The legit flow is intact: a genuine relayer who + // delivers the requested output to the intended recipient is repaid exactly the locked input once; + // refund still works only after fillDeadline on an unfilled deposit. AereERC7683 is interface- + // identical (already forwards the full order through deposit()); AereMessenger is payload-agnostic + // (opaque body) so a fresh inert one is deployed purely as the corrected spoke's constructor dep. + // Proven by contracts/test/spokepool-intents-invariant-property.test.js (3 passing: 360-step + // randomized conservation/repayment-exact-once invariants + the explicit HIGH regression proof: + // zero-output / wrong-recipient / short-fill settlements all revert, principal never released + // without a valid fill, honest solver repaid exactly once, victim refund intact). Bytecode + // VERIFIED: each address is byte-identical to its 0.8.23/viaIR artifact except at immutable slots + // (every differing byte is a 0x00 placeholder), via eth_getCode against rpc.aere.network. + AereSpokePoolV2Corrected: '0xbEF9BF0D22dd00DBEdA262C3Cd3178f08C623d8d', // CANONICAL corrected SpokePool. 6317 bytes runtime (eth_getCode non-empty). Deploy tx 0x28bb0e8caaeb91b83ab65f1db65e41c47a60f152e93a71202221084c4bfac2fd. owner=deployer 0xbeB3…6465, no remote spoke enrolled (inert). messenger=AereMessengerBridgeFixInert below (NOT the live 0xe54c…7325). [@status CANONICAL] + AereERC7683V2Corrected: '0x8eC4e7F01790C04D450b45d399E71DFd381560e3', // CANONICAL corrected ERC-7683 IOriginSettler routing into AereSpokePoolV2Corrected. 7931 bytes runtime. Deploy tx 0x9de5183e0f389e4906231c1a3bd2958bb2db1e5df659568e74ab9a45dcf3649f. [@status CANONICAL] + AereMessengerBridgeFixInert: '0x6215eB10b47d6c3AC32124eA40730d23DA3Fd017', // FRESH INERT messenger, constructor dep of the corrected spoke ONLY. 4589 bytes runtime. 0 validators enrolled -> it can dispatch but can process NO inbound settlement (below threshold), so the corrected stack is not a live route. Deploy tx 0x0405981171832520200a3e4a21adf338366411f14880423debc82f3bdd42c176. owner=deployer 0xbeB3…6465. This is NOT the canonical live AereMessenger (0xe54c…7325). [@status INERT @reason deployed-deliberately-inert] // ── Tier-1.6 oracle stack (deployed 2026-05-31) ────────── - AerePyth: '0xb7F3354C1E0C5ef89D8b1072a3CEa7FFEf2FfE3F', // Pyth-IPyth-compatible pull oracle (publisher-signed updates) - AereOracleAdapter: '0xb28A23dc177794DEC2Cacd2738fCc6c5C1Fc4Fe6', // Unified price-quote interface (routes Pyth → legacy AereOracle fallback) + AerePyth: '0xb7F3354C1E0C5ef89D8b1072a3CEa7FFEf2FfE3F', // Pyth-IPyth-compatible pull oracle (publisher-signed updates). [@status CANONICAL] + AereOracleAdapter: '0xb28A23dc177794DEC2Cacd2738fCc6c5C1Fc4Fe6', // Unified price-quote interface (routes Pyth → legacy AereOracle fallback). Currently reads AereOracle_v1_DEPRECATED for BTC/USD + ETH/USD (no Pyth feeds registered). Foundation can repoint via setLegacy(AereOracleV2) once >=3 reporters run. [@status CANONICAL] + AereOracleV2: '0xca69AA961D836516010Ae669a223Ce249490ACb1', // CANONICAL fixed multi-reporter median oracle (bug-fix redeploy 2026-07-10, deployer 0xbeB3…6465). FIX(finding #11): getPrice reverts InsufficientQuorum unless >= minContributors authorized reporters are BOTH fresh (quorum-staleness guard). minContributors owner-configurable, floored at 1, default 3. Drop-in getPrice/submit/DECIMALS signature. owner=Foundation, minContributors=3. DEMONSTRATED live: 1 fresh -> revert InsufficientQuorum(1,3); 2 fresh -> (2,3); 3 fresh -> median (contributors 3); a lone 500000e8 outlier does NOT move the median (stays 101e8); raw getPrice(BTC/USD, 0 fresh) reverts InsufficientQuorum(0,3) [selector 0x6a1ee67a]. Deploy tx 0x62ab6eac…65628, block 8903500. REPOINT (Foundation, QUEUED): AereOracleAdapter.setLegacy(0xca69…ACb1) once >=minContributors independent reporters run and stay fresh; AereTokenPaymasterV2's oracle ref is IMMUTABLE -> repointing needs a new paymaster deploy. Demo reporters are throwaway keys; Foundation should removeReporter them and addReporter its production reporters. [@status CANONICAL] // ── Tier-1.7 verifiable randomness (deployed 2026-05-31) ────────── - AereRandomnessBeacon: '0x25b6317efD8C7d425210F56Ee1E204852CD8213C', // Permissionless drand beacon — anyone submits, consumers pay own gas - AereDrandConsumer: '0xeBA8De4f61c923a2E43eA8d7233Cf8e1Db5911B5', // Reference consumer (example/library) + AereRandomnessBeacon: '0x25b6317efD8C7d425210F56Ee1E204852CD8213C', // Permissionless drand beacon — anyone submits, consumers pay own gas. [@status CANONICAL] + AereDrandConsumer: '0xeBA8De4f61c923a2E43eA8d7233Cf8e1Db5911B5', // Reference consumer (example/library). [@status CANONICAL] // ── Tier-1.8 burn flow (deployed 2026-05-31) ────────── - AereCoinbaseSplitter: '0xb4b0eCe9011613A5b84248a9B42a0f309E6F01Ec', // 37.5% to FeeBurnVault, 62.5% to validator. Whitepaper §3.3 made real. + AereCoinbaseSplitter: '0xb4b0eCe9011613A5b84248a9B42a0f309E6F01Ec', // 37.5% to FeeBurnVault, 62.5% to validator. Whitepaper §3.3 made real. [@status CANONICAL] // ── Tier-1.9 batch-auction DEX (deployed 2026-05-31) ────────── - AereVaultRelayer: '0x9FCA122e87E36D7cba20DbEA7b9b7354A4Cece91', // Token allowance proxy for batch settlement - AereSolverRegistry: '0xDBD29332a9993d2816EF0bD240288E03a8103f3B', // Permissioned solver allowlist (Phase 1) - AereSettlement: '0x9C2957b1622567B4802E4AFd4c42FB2ec70dE875', // CoW-style batch-atomic settlement (MEV-resistant) + AereVaultRelayer: '0x9FCA122e87E36D7cba20DbEA7b9b7354A4Cece91', // Token allowance proxy for batch settlement. [@status CANONICAL] + AereSolverRegistry: '0xDBD29332a9993d2816EF0bD240288E03a8103f3B', // Permissioned solver allowlist (Phase 1). [@status CANONICAL] + AereSettlement: '0x9C2957b1622567B4802E4AFd4c42FB2ec70dE875', // CoW-style batch-atomic settlement (MEV-resistant). [@status CANONICAL] - // ── Tier-1.10 fee monetization (deployed 2026-05-31) ────────── - AereFeeMonetization: '0x6b62DC6cC974F779354c953F41b64a7aB994dd98', // Developer fee-share NFTs + 5% Foundation treasury slice + // ── Tier-1.10 fee monetization (deployed 2026-05-31; V2 bug-fix redeploy 2026-07-10) ────────── + // DEPRECATED — BUGGY V1 (finding #1 HIGH: fee-stream squat + permanent DoS). Left on-chain (37 Foundation bootstrap registrations, 0 pending rewards, harmless); do NOT use for external dev registration. Superseded by AereFeeMonetizationV2 below. + AereFeeMonetization_v1_DEPRECATED: '0x6b62DC6cC974F779354c953F41b64a7aB994dd98', // BUG(HIGH): register(contractAddr,payout) had NO check that msg.sender controls contractAddr, so anyone could squat a victim contract's dev-share fee stream (mint the NFT to themselves) and permanently DoS the real dev ("already registered", no unregister path). Superseded by AereFeeMonetizationV2. [@status DEPRECATED @reason fee-stream-squat-and-permanent-dos @replacement AereFeeMonetizationV2] + AereFeeMonetizationV2: '0xb560bdFB8b8B918012e6481e3bcF473c79c2a850', // CANONICAL. Developer fee-share NFTs + 5% Foundation treasury slice (deployer 0xbeB3…6465, owner=Foundation). FIX(finding #1): register requires msg.sender == contractAddr (self) OR == Ownable(contractAddr).owner() (try/catch; codeless target -> reject) — permissionless but authenticated; adds unregister (NFT owner or FeeMon owner, pays out pending first, frees the contract) + reassignPayout. Fee/claim/distribute logic byte-identical to V1. DEMONSTRATED live: register(legacyOracle, deployer) reverts "FeeMon: not controller" (legacyOracle Ownable-owned by Foundation, not deployer); OwnableProbe owner-path register tx 0x76f710c1… (tokenId 1); SelfRegisteringProbe self-path tx 0x365c6064… (tokenId 2); unregister tx 0x999f3baf… (NFT burned) then re-register tx 0x00d12de4… (tokenId 3). Deploy tx 0x9b37a8b6…9c76b, block 8903465. Probes: OwnableProbe 0x82ae4F1D…A81A, SelfRegisteringProbe 0xABEe8e95…952b. [@status CANONICAL] // NOTE: AERE is the network's only native token. No stablecoin issuance. // ── Tier-1.14 zk-verifier stack (deployed 2026-05-31) ────────── @@ -149,26 +326,173 @@ export const AERE_MAINNET = { // with zero downstream migration. // // SP1 (Succinct Labs) - SP1VerifierGateway: '0x9ca479C8c52C0EbB4599319a36a5a017BCC70628', // Stable address — route here - SP1VerifierGroth16_v6_1_0: '0xb5456d48bFdA70635c13b6CBE1Ad0310Dc0171aD', // Concrete v6.1.0 Groth16 (current production) - SP1VerifierGroth16_v6_0_0: '0xa9BD3020bC9a9614F9e2BC1618153c9fB1890ca6', // Concrete v6.0.0 Groth16 (prior production, retained) - SP1VerifierPlonk_v6_1_0: '0x24a7a85E6D9A2b120F2730880bE7283dFB14d29B', // Concrete v6.1.0 Plonk (no per-circuit trusted setup) + SP1VerifierGateway: '0x9ca479C8c52C0EbB4599319a36a5a017BCC70628', // Stable address — route here. [@status CANONICAL] + SP1VerifierGroth16_v6_1_0: '0xb5456d48bFdA70635c13b6CBE1Ad0310Dc0171aD', // Concrete v6.1.0 Groth16 (current production). [@status CANONICAL] + SP1VerifierGroth16_v6_0_0: '0xa9BD3020bC9a9614F9e2BC1618153c9fB1890ca6', // Concrete v6.0.0 Groth16 (prior production, retained). [@status CANONICAL] + SP1VerifierPlonk_v6_1_0: '0x24a7a85E6D9A2b120F2730880bE7283dFB14d29B', // Concrete v6.1.0 Plonk (no per-circuit trusted setup). [@status CANONICAL] // RISC Zero - RiscZeroVerifierRouter: '0x3f7015BC3290e63F7EC68ecF769b00aB296a249C', // Stable address — route here - RiscZeroGroth16Verifier: '0x95cB30f3bdb3187f39203A9907bf707Aef07a1FD', // Concrete Groth16 verifier (selector 0xc27d1bc0) - // AERE registry — multi-prover proof attestation log with permissionless program registration - AereProofRegistry: '0x0A9b09677DbE995ACfC0A28F0033e68F068517Ee', // Routes proofs through SP1 gateway + R0 router + RiscZeroVerifierRouter: '0x3f7015BC3290e63F7EC68ecF769b00aB296a249C', // Canonical router (Foundation-owned). Needs Foundation addVerifier(0xef6cb709, RiscZeroGroth16Verifier) to route real risc0 5.0.0-rc.1 seals. [@status CANONICAL] + // DEPRECATED: deployed with a NON-CANONICAL control root (0xb1f640...488167) so it computes selector 0xc27d1bc0 and cannot verify any genuine risc0 5.0.0-rc.1 receipt. Do not use. + RiscZeroGroth16Verifier_DEPRECATED: '0x95cB30f3bdb3187f39203A9907bf707Aef07a1FD', // [@status DEPRECATED @reason superseded-by-current-groth16-verifier @replacement RiscZeroGroth16Verifier] + // Corrected concrete Groth16 verifier: genuine risc0 5.0.0-rc.1 control root 0x4ec911...bde5b04, SELECTOR 0xef6cb709. Deployed 2026-07-10 (tx 0xb75d0671...f08fc2c). + RiscZeroGroth16Verifier: '0xb6fD00D88Bf8B08d6371d2D98E0e239B89Ab5B9D', // [@status CANONICAL] + // AERE registry: multi-prover proof attestation log with permissionless program registration. + // Canonical registry (Foundation-owned) has an IMMUTABLE risc0Router pointing at the Foundation router above, so it can only record R0 proofs once the Foundation runs the repoint. + AereProofRegistry: '0x0A9b09677DbE995ACfC0A28F0033e68F068517Ee', // Routes proofs through SP1 gateway + R0 router. [@status CANONICAL] + // Self-owned corrected R0 stack (deployer 0xbeB33D...6465). Records the REAL staged risc0 proof today, independent of the Foundation repoint. + RiscZeroVerifierRouter_Corrected: '0x62b96F7211F832f47d8Fc0D8317D5867B0Af43E5', // Owns verifiers[0xef6cb709] = corrected verifier. [@status CANONICAL] + AereProofRegistry_Corrected: '0x174F616E2048A71408E2491791ef77cd6913bbEf', // sp1Gateway = production gateway, risc0Router = corrected router. Recorded R0 proof id 0 (submit tx 0xf9269dde...396e629). [@status CANONICAL] - // ── Tier-1.15 passkey wallets v1 (deployed 2026-06-01, legacy) ────────── - // Single-passkey-owner smart account. Retained for the original demo account. - // For new wallets use AerePasskeyAccountFactoryV2 below. - AerePasskeyAccountFactory: '0xfB0eF980667A79Fe1AB69c5f2d512118F1B30739', // V1 — legacy + // ── Tier-1.15 passkey wallets v1 (deployed 2026-06-01) — RETRACTED 2026-08-02 ── + // Single-passkey-owner smart account. No EOA owner, no ERC-4337 path. + // RETRACTED IN THE ADDRESS BOOK ONLY. Measured 2026-08-02 by walking the live + // runtime as instructions and collecting PUSH4 selectors (positive proof from + // bytecode, never an empty eth_call revert): 0xfB0e…0739 is 5,547 runtime bytes, + // 17 distinct selectors, and it still exposes createAccount(uint256,uint256,uint256) + // 0x4c1ed7f5 and predictAddress(uint256,uint256,uint256) 0x92671220. Those three + // functions are its entire surface: it has NO owner, NO pause and NO kill switch, + // so it CANNOT be turned off on chain and anyone can still call it forever. The + // retraction is a documentation gate, nothing more. Do not read it as "dead". + /** + * @deprecated Retracted 2026-08-02. Legacy Tier-1.15 single-passkey factory, + * still live and still callable. Two measured reasons not to use it, neither of + * them a theft path: + * 1. createAccount(0, 0, salt) deploys an AerePasskeyAccount whose stored P-256 + * key is (0, 0). AerePasskeyAccount.initialize is factory-only and one-shot, + * so such an account is bricked forever: execute / executeBatch both revert + * NotInitialized(). The address is CREATE2-derived from (pubkey, salt), so a + * third party can permanently burn a user's counterfactual address. + * 2. Until today this entry sent new wallets to AerePasskeyAccountFactoryV2, + * which is the ecrecover-zero FLAWED factory. + * This is NOT the finding-63 address(0)-owner bug. That one belongs to + * AerePasskeyAccountFactoryV2_DEPRECATED_FLAWED below; V1 has no EOA owner set at + * all. Use AerePasskeyAccountFactoryV2Fixed for every new wallet. + */ + AerePasskeyAccountFactory_v1_DEPRECATED: '0xfB0eF980667A79Fe1AB69c5f2d512118F1B30739', // V1 — legacy, LIVE and un-pausable, retracted in docs only. [@status DEPRECATED @reason legacy-v1-superseded-and-mints-bricked-zero-key-accounts @replacement AerePasskeyAccountFactoryV2Fixed] // ── Tier-1.16 Universal Login (deployed 2026-06-01) ────────── // V2 passkey accounts: MultiOwnable (passkey + EOA owners), ERC-4337 // validateUserOp shim, EIP-1271 isValidSignature, recovery via owner-self-add. - AereEntryPointV2: '0x8D6f40598d552fF0Cb358b6012cF4227B86aF770', // Real ERC-4337-shaped EntryPoint - AerePasskeyAccountFactoryV2: '0x5FFa9a6487DA4641a1A1e7900ff2bD4525D34fdA', // V2 factory — predictAddress(initialOwners[], salt) + AereEntryPointV2: '0x8D6f40598d552fF0Cb358b6012cF4227B86aF770', // Real ERC-4337-shaped EntryPoint. [@status CANONICAL] + // DEPRECATED / FLAWED LIVE FACTORY — the accounts it deploys carried an ecrecover-zero auth bypass. Superseded by AerePasskeyAccountFactoryV2Fixed below. Its accounts hold ZERO value (bootstrap); NOT migrated (existing accounts are not re-pointed — swap is founder-supervised: aerenew/docs/PASSKEY_ECRECOVER_ZERO_MIGRATION_RUNBOOK.md). Do NOT create new wallets here. + // Measured 2026-08-02 from live runtime by PUSH4 selector walk (positive proof, not an + // empty revert): 9,722 runtime bytes, 35 distinct selectors, createAccount(bytes[],uint256) + // 0x3ffba36f PRESENT and predictAddress(bytes[],uint256) 0x5e6c8642 PRESENT. It is therefore + // still able to mint flawed accounts today, and it has no pause, so the key below is renamed + // to carry the retraction in the NAME: any consumer that still reads the old key now fails to + // compile instead of silently deploying a forgeable wallet. + /** + * @deprecated FLAWED AND STILL LIVE. Registry finding 63. Deploys + * AerePasskeyAccountV2 accounts whose EIP-1271 / validateUserOp EOA-owner path + * compares ecrecover's result to the stored owner without rejecting address(0), + * and whose MultiOwnable accepts an address(0) owner word, so a malformed + * signature that recovers to address(0) can authorize and drain the account. + * NOT retractable on chain: it has no owner and no pause, so this rename is a + * documentation gate only. Use AerePasskeyAccountFactoryV2Fixed. + */ + AerePasskeyAccountFactoryV2_DEPRECATED_FLAWED: '0x5FFa9a6487DA4641a1A1e7900ff2bD4525D34fdA', // FLAWED. Deploys AerePasskeyAccountV2 accounts whose EIP-1271 / validateUserOp EOA-owner path compared ecrecover's result to the stored owner WITHOUT rejecting address(0): a malformed / zero-recovering signature returns address(0), and paired with an address(0) owner word (which MultiOwnable then accepted) a forged signature could authorize and drain the account. Superseded by AerePasskeyAccountFactoryV2Fixed. [@status DEPRECATED @reason ecrecover-zero-address-owner-forgery @replacement AerePasskeyAccountFactoryV2Fixed] + // ── Passkey ecrecover-zero fix — belt-and-suspenders, fixed IN PLACE (FRESH INERT redeploy, deployed 2026-07-12, deployer 0xbeB3…6465) ── + AerePasskeyAccountFactoryV2Fixed: '0x8FA2B45D63EBaa4551A55d7f33a82d597e423428', // CANONICAL corrected passkey factory. FRESH + INERT (deployer-owned, deploys nothing until called; the flawed live factory is NOT migrated/re-pointed). Same source, no storage/interface change (so it keeps the "V2" contract name). FIX(1, AerePasskeyAccountV2._verifyWrappedSignature): the EOA-owner path now requires recovered != address(0) before comparing to the owner, so a malformed / zero-recovering signature can never authorize (still returns ERC-4337 code 1, does not revert validateUserOp). FIX(2, MultiOwnable._addOwner): reverts ZeroAddressOwner() when the EOA owner word is zero, so address(0) can never enter the owner set via addOwnerAddress / _initializeOwners / the factory (duplicates were already blocked). 9675 bytes runtime (eth_getCode non-empty); byte-identical to the 0.8.23/viaIR artifact except at the defaultEntryPoint immutable slots (every differing byte is a 0x00 placeholder); defaultEntryPoint = AereEntryPointV2 0x8D6f…aF770. Reproduced the drain on the current live code (probe reverted=false moved=true), then proved closed (reverted=true moved=false) + address(0) rejected, with Campaigns A/B legit flows still green. Proven by test/passkey-universal-login-invariant-property.test.js (6 passing incl. the two FIX-PROOF cases). Founder-supervised swap: aerenew/docs/PASSKEY_ECRECOVER_ZERO_MIGRATION_RUNBOOK.md (NOT executed). [@status INERT @reason corrected-factory-deployed-inert-not-repointed] + AerePasskeyAccountV2_sampleFixed: '0x7C599babc66c350A6cE76673868253e2288D75C1', // sample account minted by AerePasskeyAccountFactoryV2Fixed (8430 bytes runtime, eth_getCode non-empty); the corrected account logic that the FIX-PROOF exercised. Inert demo, holds nothing. [@status CANONICAL] + + // ── Post-quantum smart account — roadmap #270 (deployed 2026-07-10, deployer 0xbeB3…6465) ── + // An ERC-4337 v0.7 smart account whose SOLE owner is a NIST Falcon-512 public key (897 bytes). + // Both validateUserOp and EIP-1271 isValidSignature are decided by the LIVE on-chain + // AereFalcon512Verifier 0x4E8e…D8fFC (real lattice crypto: SHAKE256 HashToPoint, 14-bit pubkey + // decode, comp_decode, negacyclic NTT mod q=12289, l2-norm bound). No classical ECDSA fallback, + // no new token. Turns AERE's PQC verifier suite into a usable, quantum-resistant wallet primitive. + AerePQCAccountFactory: '0xd5315Ea7caa60d320c4f34b1bEd70dd9cc02CE58', // CREATE2 factory: predictAddress(falconPubKey, salt) → deterministic AerePQCAccount, binds AereEntryPointV2 + Falcon-512 verifier (both immutable). Deploy tx 0x861c91e9…, block 8919341. DEMONSTRATED live with a REAL reference-generated Falcon-512 keypair: EIP-1271 isValidSignature ACCEPT=0x1626ba7e, tampered→0x00000000 (re-verifiable by RPC against the account + the live verifier); a full userOp through AereEntryPointV2.handleOps FIT the EIP-7825 2^24 cap (est 10,641,716 / gasUsed 10,278,313 < 16,777,216, tx 0xd2e38baf…, opSuccess=true, moved 0.0001 AERE). HONEST SCOPE: Falcon-512 not 1024; ~10.5M gas/PQC-auth (heavy but under cap; native SHAKE precompile would cut it). [@status CANONICAL] + AerePQCAccount_sample: '0xa42a5e7F72E46BadC11367650Ec34D676194326f', // sample account owned by a REAL Falcon-512 key (pubkey keccak256 0xc531b9da…3d6ce637; create tx 0xa4e22b72…, block 8919700). The EIP-1271 + handleOps proofs above target this account; see contracts/deployments/pqc-account.json for the full signature material. [@status CANONICAL] + + // ── ERC-6551 token-bound accounts — roadmap #12 (deployed 2026-07-10, deployer 0xbeB3…6465) ── + // Account/registry PRIMITIVES, NOT tokens. An AereNFT can own a wallet that holds + // assets, signs via EIP-1271, and executes calls (also 4337 via AereEntryPointV2). + ERC6551Registry: '0x7fFdA0AcDeB919938dB91dbEa779D841c833EF68', // canonical reference registry (verbatim erc6551/reference); deterministic CREATE2 factory for ERC-1167 account proxies; no owner/admin. [@status CANONICAL] + AereTokenBoundAccount: '0xBc5e24180f3F75DC6b1965E4aaD3D4F184b6F9E2', // TBA implementation; owner = ownerOf(boundTokenId). Live demo binding: AereNFT #1 → account 0x82D24cC4E09CaBfD9B00233438B8B6321CBC13Dd (owner()=0xbeB3…6465, create tx 0x89809154…82bb02). [@status CANONICAL] + + // ── Homepage-surfaced contracts (deployed 2026-07-07/10, deployer 0xbeB3…6465) ────────── + // These are referenced (truncated) on the live homepage FeaturesSection/ShippedSection and + // feature pages. Added here so every address the site shows is verifiable in the registry. + // All confirmed REAL via eth_getCode on https://rpc.aere.network (chain 2800) 2026-07-11. + AereModularAccountFactory: '0xE3f45Ed4a81f982fF25ad172A72456a1833a440E', // roadmap ERC-7579 modular account factory; binds AereEntryPointV2. [@status CANONICAL] + // DEPRECATED — BUGGY V1 (CONFIRMED per-batch value-cap bypass: executeBatch enforced maxValuePerOp per sub-call with no running sum → a session key could move maxValuePerOp*N in one batch). Left on-chain; do NOT install on new accounts. Superseded by AereSessionKeyValidatorV2. + AereSessionKeyValidator_v1_DEPRECATED: '0x6e03A3D7A4c90d6f8dD6F0BA1F6e8aB1F8990D26', // [@status DEPRECATED @reason superseded-by-v2-validator @replacement AereSessionKeyValidatorV2] + AereSessionKeyValidatorV2: '0xC06EAe63Ed12307F56A1506917C48C027D8852ff', // CANONICAL. ERC-7579 validator module: scoped, time-bounded session keys. FIX: caps sum(batch value) at maxValuePerOp, hard-blocks admin self-calls, optional rolling cumulative cap. No owner/immutables. Deploy tx 0xb7e255ce…, block 8954361. [@status CANONICAL] + AereSocialRecoveryModule: '0x077514DB2a85F239145537e8334CC99d42c9D812', // guardian-based owner rotation behind a 48h timelock. [@status CANONICAL] + AereMailboxV3: '0x7BF113Ab1BCd2b6da01804764065776e3057605a', // Hyperlane v3 Mailbox on the AERE side (working quoteDispatch), owner=Foundation. [@status CANONICAL] + AereIGPV3: '0x5e4B8e9b196B1c7b3Be86148769aB0047c79744c', // Hyperlane v3 InterchainGasPaymaster, owner=Foundation. [@status CANONICAL] + AereWarpRouteV3: '0x1f44573684aB6bC617e7200A19b940b05e4EE098', // USDC.e Warp Route router riding AereMailboxV3; AERE side proven, Ethereum leg pending L1 bring-up. [@status CANONICAL] + AereKZGVerifier: '0x6596307BD8f54d9A91FE364EBC3e594F200AC862', // KZG polynomial-commitment opening verifier via the live EIP-4844 point-evaluation precompile at 0x0A. [@status CANONICAL] + AereHalo2CubicVerifier: '0x414Cfe640B2770856d3D7262a7a3729f5c07dC55', // on-chain Halo2 (PLONKish, KZG-backed) verifier. [@status CANONICAL] + AereCancunCanary: '0x8DbFC002bB23124cBeCd7B4916c179D2AFd65498', // demonstrates the full Cancun opcode set live: TSTORE/TLOAD, MCOPY, PUSH0, BLOBHASH/BLOBBASEFEE. [@status CANONICAL] + AereStateRootAnchor_DEPRECATED_WIRED_TO_POISONABLE_V1: '0x78b40a983E89c91Aefd8A62Be709bDF25ABB57cb', // DEPRECATED — code is SOUND and unchanged in V2, but this instance is immutably wired to the poisonable AereStorageProofVerifier V1 0xF9a1A183…9362E, so records it anchors can be overwritten by anyone through that verifier's unbound submitProof(). SUPERSEDED by the identical-code AereStateRootAnchorV2 0x0b959402…e488 wired to AereStorageProofVerifierV2. Left on-chain: immutable, no owner, no funds. See docs/ZK-ANCHOR-FIXES-2026-07-17.md. [@status DEPRECATED @reason wired-to-the-poisonable-v1-verifier @replacement AereStateRootAnchorV2] + AereStateRootAnchorV2: '0x0b959402283c0D2B9db4FfD7823f99782462e488', // CANONICAL storage-proof canonicity anchor. SAME CODE as 0x78b40a98…57cb (its logic was sound — it just drove the flawed AereStorageProofVerifier V1); this instance is wired to AereStorageProofVerifierV2 0x487021f9…a1Dd and is that verifier's IMMUTABLE CANONICAL_ANCHOR, i.e. the ONLY contract whose submissions earn Provenance.Anchored. Recovers the canonical block hash from the BLOCKHASH opcode (256-block window, ~128s at 0.5s blocks — anchor promptly; once anchored the record is permanent), checks keccak256(rlpHeader) against it and decodes the state root at the fixed header offset, then drives submitProofWithExpectedRoot so a proof's committed root must equal a root established canonical ON CHAIN. Deploy tx 0xb7e8f1809d2c0132a6864f0f252c3b6e9c079b925e5a7474482f9a8f9a6c05cc (block 10,084,210, gas 628,156, deployer 0xbeB33D20…6465). Binding VERIFIED BOTH DIRECTIONS live (anchor.VERIFIER == 0x487021f9…a1Dd && V2.CANONICAL_ANCHOR == this). Immutable, no owner, no admin. Full report: docs/ZK-ANCHOR-FIXES-2026-07-17.md. [@status CANONICAL] + AereHistoryStateRootAnchorV2: '0x4C1F9daD515c7990b65F9833960CA4315216330C', // CORRECTED EIP-2935 (8191-block) storage-proof canonicity anchor (FINDING 4 fix): proveAgainstAnchor decodes blockNumber/account/slot locally from the 192-byte public values and calls submitProofWithExpectedRoot EXACTLY ONCE (V1 ran the SP1 Groth16 verify twice on identical inputs). Immutable, no owner/admin. Wired to the live AereStorageProofVerifier 0xF9a1A183…9362E. Note: CORRECTED 2026-08-01: EIP-2935 history storage IS deployed on chain 2800 (83 bytes at 0x0000F90827F1C53a10cb7A02335B175320002935, live since the AerePQC fork at block 9,189,161; 8191-block window measured end to end at head 11,810,041). The anchoring path CAN serve live headers. The open item is different and is a real one: this anchor's VERIFIER() returns 0xF9a1A183…9362E, the AereStorageProofVerifier marked DEPRECATED_POISONABLE above, so until it is repointed at AereStorageProofVerifierV2 0x487021f9…a1Dd the extended-lookback path terminates in a record this registry itself calls poisonable; the FINDING 4 correction + immutable verifier wiring are what this inert redeploy locks in. Verified deployed on chain 2800. [@status CANONICAL] + AereZKMLVerifier: '0xf1BF15d5018a35D21FBB4Ec868f062DF7C06783c', // verifies a real Groth16 proof of a 784→256→10 MLP MNIST classifier run inside the SP1 zkVM (private input). owner=Foundation. [@status CANONICAL] + AereComputeMarketV2: '0x33E3B06A7344f0B201fdD11B18bC244c84dbca32', // CANONICAL DePIN compute marketplace (native-AERE stake/escrow, dispute+slashing). 3 jobs settled end-to-end on-chain. Supersedes AereComputeMarket (V1) 0xf0c8…F350. [@status CANONICAL] + AereConfidentialCompute: '0x2120350c124e4Cae2C9FfBB6E4942DB1d380c287', // Shamir secret sharing + BGW multiplication gate; 5-node committee, chain verifies a threshold of EIP-712 sigs. Semi-honest, not malicious-secure. [@status CANONICAL] + AereProofAggregator_DEPRECATED_UNENFORCED_INNER_VKEYS: '0x6a260238890E740dB12b371E0C5d17a2470F84C5', // DEPRECATED — inner vkeys COUNTED, NEVER ENFORCED; SUPERSEDED by AereProofAggregatorV2 0x944dE720…2b4C. The aggregation vkey is pinned and the guest genuinely recursive, and its 2 historical records are genuine (recognized == count) — the bug was LATENT, never exploited. But recordAggregation only counted registered inner programs into `recognized` and recorded regardless, so a proof of an UNCONSTRAINED attacker guest (`fn main(){ commit_slice(&attacker_bytes) }`) committing any public tuple is recorded as a legitimate-looking aggregation (proven in test/proof-aggregator-inner-vkey-enforcement-2026-07-17.test.js: V1 RECORDS it with recognized=0). It also happily registers a ZERO inner digest, which would no-op any gate. owner = Foundation 0x0243A4…f3C3. Left on-chain: no funds. Repoint to V2. See docs/ZK-ANCHOR-FIXES-2026-07-17.md. [@status DEPRECATED @reason inner-vkeys-not-enforced @replacement AereProofAggregatorV2] + AereProofAggregatorV2: '0x944dE720D6C9696Bdf10b6E2F00dd21ABB1A2b4C', // CANONICAL recursive SP1->Groth16 aggregation anchor. REPLACES 0x6a260238…F84C5 (below), which COUNTED folded inner-program vkeys into a `recognized` field but NEVER ENFORCED them — an unregistered inner program was not an error, just a lower number. ATTACK (code-read 2026-07-17, not exploited): an attacker writes an SP1 guest with NO constraints (`fn main(){ sp1_zkvm::io::commit_slice(&attacker_chosen_bytes); }`), has it commit e.g. the exact AereZKScreen public tuple, proves it (trivial — it asserts nothing), folds it with the REAL aggregation guest (which honestly verifies it: it IS a valid SP1 proof of that vacuous program) and submits; V1 records an aggregation that exists, carries the pinned aggVKey and is indistinguishable from a genuine one except for recognized < count, a field nothing enforced. V2 REQUIRES every folded inner vkey to be an ALLOWED program and REVERTS UnregisteredInnerProgram(digest, index) — in BOTH recordAggregation and the verifyAggregation view, and BEFORE the gateway is consulted, so no proof however valid can pass. THE RECURSION GUEST IS UNCHANGED AND WAS NEVER THE PROBLEM: the composite it commits (sha256(u32_be(n) || (koalabearVKeyDigest_i || sha256(publicValues_i))…)) ALREADY bound every inner vkey digest and V1 already recomputed it correctly — the contract always KNEW which programs were folded, it just did nothing about it; same aggregation vkey 0x003a70854f258b13c6612b0272421f2d7d97f90eee63e124864c80be61a2672c reused, NO reproving. Composite formula re-validated against reality: the REAL live on-chain digest 0x8e246396…4e36 was recomputed byte-for-byte. FUNCTIONAL ON ARRIVAL: the allowed set is SEEDED IN THE CONSTRUCTOR from the LIVE V1 registry (zkscreen 0x3510880a…e5b7, over18 0x2d54a563…43c5, zkml-mnist 0x30a21e71…bceb — each read from chain and verified known==true before being trusted), so no Foundation signature is needed for it to be safe. owner = Foundation 0x0243A4…f3C3 (same as V1) may extend the set; sealRegistry() is a ONE-WAY latch that freezes the set forever and renounces ownership — deliberately NOT called (freezing is the founder's call). Extra hardening V1 lacked: a zero inner digest can never be registered (it is the default value of an unregistered slot — V1 happily registers it, which would no-op the gate), code-less-verifier guard; `recognized` retained for read-shape compat but now an enforced invariant (== count always). Deploy tx 0x24c0f43d7db58084f3200f5c6eee11be0a855f27f1cd347399ce1dfca03ad94f (block 10,083,377, gas 1,460,748, deployer 0xbeB33D20…6465). PROVEN BOTH DIRECTIONS ON MAINNET (2026-07-17): (+) REAL ACCEPT — the REAL 356-byte aggregation Groth16 proof over 10 REAL inner proofs, recovered from V1's own recordAggregation tx 0xd1fd4d60…d978 and replayed onto V2 via recordAggregation tx 0x08bc005f3ffaca38e060c6d93bb0970e4608fa9db91efb5a544c7ca8c3811b87 (block 10,083,451, gas 409,305, under the EIP-7825 2^24 cap): exists=true, count=10, recognized=10, composite 0x11ee0c08…a1fb. (-) ATTACK REJECTED — identical calldata with an unregistered attacker digest REVERTS UnregisteredInnerProgram(0xdede…dede, 0), and smuggled in alongside the 10 real programs REVERTS at index 10, while V1 on the same calldata only reaches the GATEWAY (InvalidProof, because the script supplied a dummy proof) — i.e. V1 has NO concept of an unvetted program and the only thing between an attacker and a recorded V1 aggregation is a real proof of their own vacuous guest, trivially obtainable. Full attacker-succeeds-on-V1 case proven in test/proof-aggregator-inner-vkey-enforcement-2026-07-17.test.js (29/29, gateway mocked to ACCEPT: V1 RECORDS it with recognized=0, V2 reverts). HONEST SCOPE: REGISTRATION IS A TRUST ACTION — allowing a program asserts its constraints are sound, and until sealRegistry() is called the Foundation owner is trusted (registry currently UNSEALED). V2 does NOT check the SEMANTICS of inner public values, only that the producing program is allowed. V1's two historical records are genuine (recognized == count) — the bug was latent, never exploited. APPLICATION layer; classical Groth16/BN254, NOT quantum-safe; does not touch AERE consensus. Full report: docs/ZK-ANCHOR-FIXES-2026-07-17.md. [@status CANONICAL] + AereShutterMempoolV2: '0x135100D523edA8D0AdC70e08af905dE5042A9310', // application-level, opt-in threshold-encrypted mempool (Shutter playbook). NOT wired into consensus (Besu QBFT L1 has no protocol-level encrypted mempool). SUPERSEDED by AereShutterMempoolV3 0x0C0b0560…81df, per our own deployment record shutter-mempool-v3.json, which fixes the position lock; V3 was absent from this book while V2 was named here alone. Measured 2026-08-02: still live, 8,339 bytes. Its coordinator is the hot deploy key, and the epoch key is not bound to the committee, so replaying an old epoch opens a new one; the 30-agent audit measured positively (Lagrange combination over the live precompiles) that the live epoch pk and DK are authentic, i.e. the attack was never used. [@status DEPRECATED @reason epoch-key-not-bound-to-committee-and-position-lock @replacement AereShutterMempoolV3] + + // ── OZ Governor stack (deployed + verified on chain 2800, 2026-07-11, deployer 0xbeB3…6465) ── + // Binding-capable governance. MUST be externally audited before the Timelock owns any real contract; the Timelock owns nothing yet. + AereGovernor: '0xd16C2551Bf4f3d0DDF961282078917b2e8679999', // DEPRECATED: flawed lazy-sync vote source, replaced by the AereGovLock stack (SUPERSEDED_STILL_PRIVILEGED: re-measured 2026-08-01 it is still PROPOSER/EXECUTOR/CANCELLER on its 48h timelock, so NOT abandoned; it owns no contract but it retains governance power. Never an ownership destination.). OZ Governor + TimelockControl, 10% quorum, 2-day timelock, reads gAERE votes. Binding-capable but MUST be externally audited before it owns any real contract. [@status DEPRECATED @reason flawed-lazy-sync-vote-source-STILL-PRIVILEGED-on-its-48h-timelock @replacement AereGovernorV2] + AereTimelockController: '0xf95738Cf366Dd2ea76fBa1b2736163BDc11D2e55', // DEPRECATED: flawed lazy-sync vote source, replaced by the AereGovLock stack (SUPERSEDED_STILL_PRIVILEGED: re-measured 2026-08-01 it is still PROPOSER/EXECUTOR/CANCELLER on its 48h timelock, so NOT abandoned; it owns no contract but it retains governance power. Never an ownership destination.). 2-day minDelay; Governor is PROPOSER/EXECUTOR/CANCELLER; deployer admin renounced. Owns nothing yet. [@status DEPRECATED @reason timelock-of-the-flawed-governor-STILL-PRIVILEGED @replacement AereGovernorV2Timelock] + AereStakedGovVotes: '0xD7575795A055cb093957B86f0607871A2D37805C', // DEPRECATED: flawed lazy-sync vote source, replaced by the AereGovLock stack (SUPERSEDED_STILL_PRIVILEGED: re-measured 2026-08-01 it is still PROPOSER/EXECUTOR/CANCELLER on its 48h timelock, so NOT abandoned; it owns no contract but it retains governance power. Never an ownership destination.). gAERE, checkpointed ERC20Votes adapter over AereStakingV2 + AereLockedStaking; permissionless sync(). [@status DEPRECATED @reason flawed-lazy-sync-vote-source @replacement AereGovLockV2] + + // ── Governance V2: AereGovLock custody-lock stack (CORRECTED, deployed + verified on chain 2800, 2026-07-11, deployer 0xbeB3…6465) ── + // CORRECTED governance. Custody-lock veToken-style votes: voting power cannot detach from capital. + // Replaces the deprecated lazy-sync AereStakedGovVotes stack above. The Timelock owns nothing yet; MUST be externally audited before any ownership transfer. + AereGovLock: '0xec7994D1Cf8C00b5674AEBd786b0680E56A8eeF8', // govAERE. Custody-lock veToken-style NON-transferable checkpointed votes; voting power cannot detach from capital. Correct vote-source design, but paired below with the FINDING-1-flawed AereGovLockGovernor, so this whole stack is superseded by the AereGovernorV2 stack. Owns nothing. Verified deployed on chain 2800. [@status DEPRECATED @reason paired-with-the-finding-1-flawed-govlock-governor @replacement AereGovLockV2] + AereGovLockGovernor_DEPRECATED: '0xb7657b15bFa6369c84a431fc4e47f7f8234B39Cf', // DEPRECATED (FINDING 1, quorum-inflation veto): plain GovernorVotesQuorumFraction with no floor/cap and a snapshot-time denominator, so a whale can lock govAERE right before the snapshot, stay silent, and fix an unreachable quorum, vetoing every proposal. Superseded by AereGovernorV2 (0x03251BD9…3047). SUPERSEDED_STILL_PRIVILEGED: re-measured 2026-08-01 it is still PROPOSER/EXECUTOR/CANCELLER on the 48h timelock 0x87E1874f, so NOT abandoned. Capture cost is 100,000 AERE, fully recoverable after the 7-day lock, i.e. net zero and about 10 days. Never an ownership destination. [@status DEPRECATED @reason finding-1-vote-source-flaw @replacement AereGovernorV2] + AereGovLockTimelock: '0x87E1874f3d78925671a889EaBf64d2001f27dD81', // 2-day TimelockController for the deprecated AereGovLockGovernor. Owns nothing; superseded alongside its governor. Verified deployed on chain 2800. [@status DEPRECATED @reason timelock-of-the-deprecated-govlock-governor @replacement AereGovernorV2Timelock] + + // ── Governance V3: AereGovernorV2 robust-quorum stack (CORRECTED, deployed + verified on chain 2800, 2026-07-11, deployer 0xbeB3…6465) ── + // Closes FINDING 1 (quorum-inflation veto). AereGovernorV2.quorum() reads the supply DENOMINATOR at + // snapshot - max(quorumLookback, votingDelay()), a pre-proposal timepoint a reactive whale lock cannot + // inflate, then clamps into [quorumFloor, quorumCap]. Robustness no longer depends on a tightly-chosen cap. + // Fresh, INERT stack (own govAERE + timelock); binding proven end-to-end by an isolated self-test at deploy. + // Founder-tunable quorum params STAGED at deploy: floor 1,000,000 govAERE, cap 50,000,000 govAERE, + // lookback votingDelay+7200 blocks (re-settable by the founder before any activation). Timelock owns + // nothing; MUST be externally audited before any ownership transfer. Supersedes the AereGovLock*_DEPRECATED stack. + AereGovLockV2: '0x547F58B087BEbB1746d6159070E755b868C27731', // govAERE vote source for the AereGovernorV2 stack. Custody-lock veToken-style NON-transferable checkpointed votes; voting power cannot detach from capital. Verified deployed on chain 2800. NAMING (measured 2026-07-20, bytecode linkage sweep): the "V2" here denotes the GOVERNANCE STACK GENERATION, not a distinct contract. The runtime bytecode at this address reproduces contract AereGovLock (contracts/governance/AereGovLock.sol), MATCH_EXCEPT_IMMUTABLES; there is no contract named AereGovLockV2 anywhere in this tree. Read this key as "the AereGovLock instance wired into the V2 stack". [@status CANONICAL] + AereGovernorV2: '0x03251BD9A115385B76220b17914f56eAC0773047', // CORRECTED OZ Governor (FINDING 1 fix): pre-proposal quorum denominator + [floor,cap] band defeat the quorum-inflation veto. Wired to AereGovLockV2 (votes) + AereGovernorV2Timelock (execution). Owns nothing; audit before any ownership transfer. Self-test propose→vote→queue→execute PASSED at deploy. Verified deployed on chain 2800. [@status CANONICAL] + AereGovernorV2Timelock: '0x9d618c5AB5f40c7187fc8D644d1aC9Bae0805f85', // 2-day TimelockController for the AereGovernorV2 stack; Governor is PROPOSER/EXECUTOR/CANCELLER, deployer admin renounced. Owns nothing yet. Verified deployed on chain 2800. [@status CANONICAL] + + // ── Season 1: Altitude growth campaign (deployed + verified on chain 2800, 2026-07-11, owner = Foundation account 0x0243A4f47D44b40b65D33f20329dE20D00c6f3C3, a single-key EOA, not a multisig) ── + // Deployed UNFUNDED. AereRewardDistributor holds 0 native AERE and needs an external audit before it is funded. + AerePointsLedger: '0x615e29e6123E3745fC7FeD1Edb995A3A3f07DDD3', // AP, NON-transferable/soulbound, credit-only, no burn/redeem path. [@status CANONICAL] + AereQuestRegistry: '0x9357081B7935f41469265bb6E297Eefecf2a7Bce', // 5 stage-1 quests seeded. [@status CANONICAL] + AereQuestAttestor: '0xDd0f794C5F0822d13eD523C1275E87573A440c48', // EIP-712 one-shot quest tickets; dedicated campaign signer, not the deployer. [@status CANONICAL] + AereQuestCheckIn: '0x3D6cF8ae5BaB008aE7Ba457f29F414B0d2DB3fF9', // soulbound First Flight, ownerless. [@status CANONICAL] + AereReferralRegistry: '0x2Dcf0A3Aed49acFCfa549293C6E7F58CC985dC56', // pays only on invitee activation. [@status CANONICAL] + AereRewardDistributor_DEPRECATED: '0x848Ca87E03498507f9108F05fC114D79Bd93dDc4', // DEPRECATED (FINDING 2, confiscation): owner could exclude-after-claim OR pause-then-clawback and sweep an in-progress claimant's vested-but-unclaimed AERE. Deployed UNFUNDED (holds 0), never funded. Superseded by AereRewardDistributorV2 (0x54B0D3d7…2DC0). [@status DEPRECATED @reason superseded-by-v2-distributor @replacement AereRewardDistributorV2] + AereRewardDistributorV2: '0x54B0D3d797762c34f32467c63192CBC605dC2DC0', // CORRECTED Merkle claim of native AERE (FINDING 2 fully closed): no exclude-after-claim; clawbackUnclaimed is whenNotPaused and can recover ONLY balance - (totalAllocated - totalClaimed), so every leaf's entitlement stays reserved and claimable forever. Owner cannot redirect OR freeze a claim in progress. Deployed UNFUNDED (holds 0); needs external audit before the founder funds it; publishRoot now takes totalAllocated. Verified deployed on chain 2800. This is the funding/root/ownership target that supersedes 0x848Ca87E…3dDc4. [@status CANONICAL] + + // ── Full-EVM validity anchor (deployed + verified on chain 2800, 2026-07-11, deployer 0xbeB3…6465) ── + AereEVMValidity: '0x1f2CB0ebDBb21500e99868DbF1dB3abCcDd7DF26', // real full-EVM validity anchor (revm-in-SP1-zkVM via rsp/sp1-reth); records + verifies real chain-2800 block execution proofs through the SP1 gateway; distinct from the bounded-VM AereRollupValidity; proof-of-approach on small blocks, not a production rollup batch yet. [@status CANONICAL] + AereEVMValidityBatch: '0x49D30a5999eA5b7f6eFf12196AB006316683Ff3C', // full-EVM validity anchor for multi-block BATCHES (revm-in-SP1-zkVM); records + verifies a batch of real chain-2800 blocks in one Groth16 through the SP1 gateway; bound to the batch program vkey; sibling of the single-block AereEVMValidity. [@status CANONICAL] + + // ── Full-EVM validity V2 — QBFT-CANONICAL-BOUND (deployed + verified on chain 2800, 2026-07-12, deployer 0xbeB3…6465) ── + // Successors to the V1 anchors above. V2 fixes the canonical-binding gap: the re-proved V2 guest additionally + // commits the block's own canonical blockHash + parentHash (and, for the batch, firstParentHash + lastBlockHash), + // and the contract requires the committed hash to equal the on-chain canonical hash of that block via + // canonicalHash() (256-deep blockhash() window, or the EIP-2935 history ring 0x0000F908…2935 — LIVE on 2800 since + // the AerePQC fork at block 9,189,161 — for older blocks). So a genuine SP1 proof of a FABRICATED execution can no + // longer be anchored as a real chain-2800 block. PROGRAM_VKEY + SP1_VERIFIER are IMMUTABLE (no owner/admin); + // recording is permissionless, gated only by the Groth16 proof through the live SP1VerifierGateway 0x9ca479C8…0628. + // QBFT FIX: chain-2800 is Besu QBFT, whose canonical block hash is computed over the header with the committed + // seals STRIPPED from extraData (Besu encodeWithoutCommitSeals). reth's generic hash_slow over the FULL extraData + // therefore does NOT equal blockhash()/EIP-2935, so the FIRST V2 pair (deployed earlier the same day, vkeys + // 0x0043b11a… / 0x009065ab…, addresses 0xbBe84387… / 0xeB8A6879…) could never bind a real QBFT block and are + // SUPERSEDED/left-on-chain. The re-proved V2 guests below strip the QBFT seals inside the zkVM before hashing, so + // the committed blockHash equals the real canonical hash (validated: guest hash == eth_getBlock().hash == + // canonicalHash()). Read-back verified on-chain (PROGRAM_VKEY == the deployed vkey). + AereEVMValidityV2_PREFIX_SUPERSEDED: '0xbBe84387738Ec472BB6DF93285664514dA89dd32', // SUPERSEDED (pre-QBFT-fix): committed blockHash was reth hash_slow over the FULL extraData, which never equals Besu's QBFT canonical hash, so recordBlock would always revert BlockHashMismatch. vkey 0x0043b11a…, deploy tx 0x62b0761e…fceef47, block 9255572. Left on-chain, harmless (provenCount 0). Superseded by AereEVMValidityV2. [@status DEPRECATED @reason public-values-prefix-superseded @replacement AereEVMValidityV2] + AereEVMValidityBatchV2_PREFIX_SUPERSEDED: '0xeB8A687999B5aff9Aed97Ee70bb55427d3aEb73f', // SUPERSEDED (pre-QBFT-fix): same reth-full-extraData hash mismatch on the batch tip. vkey 0x009065ab…, deploy tx 0x89752917…44dccd8, block 9255581. Left on-chain, harmless (provenCount 0). Superseded by AereEVMValidityBatchV2. [@status DEPRECATED @reason public-values-prefix-superseded @replacement AereEVMValidityBatchV2] + AereEVMValidityV2: '0x4884ad6617e320735b65D31915d1aBC884768D9B', // CANONICAL single-block QBFT-canonical-bound anchor. 288-byte public values (chainId, blockNumber, parentHash, blockHash, prevStateRoot, postStateRoot, txRoot, gasUsed, numTxns); guest strips QBFT committed seals so committed blockHash == blockhash()/EIP-2935. PROGRAM_VKEY 0x00c5c11c964d88260f90fa6a6d59c77d73e5375425eedd3d42efef76e7dfe84b (re-proved seal-stripping V2 single-block guest ELF). Deploy tx 0x20f0c4fb1f5fafddeec145b5c0ce064ff6b80e4ddda256c622fcddf268419682, block 9257558, 2852 code bytes. provenCount 0 (single-block proof not yet submitted; the sibling batch anchor AereEVMValidityBatchV2 is likewise deployed but NOT yet exercised, its provenCount() also reads 0 on-chain, verified via eth_call). Supersedes AereEVMValidity 0x1f2CB0eb… (V1, self-consistent only, left on-chain). [@status CANONICAL] + AereEVMValidityBatchV2: '0xe154B8993FB54dB4418e03ef4a04894f29E690aE', // CANONICAL contiguous-batch QBFT-canonical-bound + continuity-enforced anchor. 320-byte public values (chainId, firstBlock, lastBlock, numBlocks, firstParentHash, lastBlockHash, prevStateRoot, postStateRoot, totalGas, numTxns); tip lastBlockHash bound to canonicalHash(lastBlock) (QBFT seals stripped in-guest); after the first record, ranges must chain gap-free (firstBlock==prior.lastBlock+1 && prevStateRoot==prior.postStateRoot). PROGRAM_VKEY 0x00194b1d212e482ca4ec25058f9478d953a673f356db3fd95cd4340ee543de86 (re-proved seal-stripping V2 batch guest ELF). Deploy tx 0x9df060997d3493c6ce314236570b042e320572c936532bfeb42df2587441d178, block 9257566, 3425 code bytes. provenCount 0 (deployed + canonical-bound, but NO batch proof has been submitted yet, verified via eth_call on chain 2800). Supersedes AereEVMValidityBatch 0x49D30a59… (V1, self-consistent only, left on-chain). [@status CANONICAL] // ── Tier-1.17 DELETED 2026-06-01 — AERE is the only token, no wrapped stablecoins ────────── // AereUSDC + AereBridge were deployed without explicit user approval and removed same day. @@ -176,6 +500,43 @@ export const AERE_MAINNET = { // The AereUSDC + AereBridge contracts remain on-chain but are inert (bridge watcher dead). // Foundation will pause+renounce AereUSDC.MINTER_ROLE when Foundation key is available. + // ── Wave A: identity + compliance stack (deployed 2026-07-19, deployer 0xbeB3…6465) ── + // Founder greenlit the low-risk clean set ("hai incepe"). All 7 are CLEAN in the security review + // (aerenew/docs/AERE-SECURITY-REVIEW-NEW-CONTRACTS.md), formally verified (z3), NO fund custody, NO + // drainable admin, wired only to live addresses. Pre-flight: live-dep check + a full fork DRY-RUN + // (7/7 deploy+verify) + an infra check, all green before broadcast; each verified post-deploy via + // view calls and independently re-verified from local; RPC stayed sub-second. Consensus was NOT + // touched (still classical secp256k1 QBFT). "Deployed" is not "in production use" — see the + // AereTrustRegistry note. Record: aerenew/contracts/deployments/wave-a-identity-compliance-2026-07-19.json. + AereRandomnessBeaconV2: '0xaDC45101D408E88d3268e2262CD53F3A4eC92cfD', // Real EIP-2537 BLS drand-quicknet verify, fail-closed, no admin. Classical drand BLS: verifying it does NOT make the randomness post-quantum. Deploy tx 0x348b0321…a445. [@status CANONICAL] + AereRecoveryRegistry: '0x7A0A49C7485b7516d8fAC48CC04a2820E151A1d5', // Falcon-512-attested (live precompile 0x0AE1), append-only, no admin. Deploy tx 0x1446db5a…43cc. [@status CANONICAL] + AereIdentityRegistry8004: '0x5C65105E14BBD1aBb0c6bc76f3BcB340bbc308Ba', // ERC-8004 identity adapter over the live Falcon-rooted AereAgentDID 0xce64…22C5. KEY_REGISTRY read from the DID = 0x1eCa…3691. No admin. Deploy tx 0xc6c2a419…d9da. [@status CANONICAL] + AereValidationRegistry8004:'0xa8805c575227B2a81f71A1Cd4E2f7727aE2ada8C', // ERC-8004 PQC-verified validation (Falcon 0x0AE1 / ML-DSA-44 0x0AE3), no admin. Deploy tx 0x069e9db2…4308. [@status CANONICAL] + AereBitstringStatusList: '0x3C13a0c568F5d953d2Ef1d6B067B5D701649d6CB', // W3C BitstringStatusList. nonRevocationVerifier=address(0) so the zk non-revocation path stays fail-closed OFF until an SP1 circuit exists. ADMIN=deployer (immutable) can only publish a vkey, never move value. Deploy tx 0x5ff60c14…2cb1. [@status CANONICAL] + AereTrustRegistry: '0x9CF8b66e01eC6F4b40e11eef2AD59eF982F7BbD1', // eIDAS-aligned trusted-issuer list. Ownable, owner=deployer at deploy. PENDING FOUNDER ACTION: transfer owner to the Foundation 0x0243…f3C3 (or Timelock), then accredit real issuers. Deploying asserts NO institution is accredited (issuerCount==0). Deploy tx 0xc21fa531…71a8. [@status CANONICAL] + AereVerifiableCredential: '0x2c97d9808c44a98038B6a8D7fFcD686df625530f', // Binds accreditation + Falcon signature + validity + revocation, fail-closed, no admin. DID method did:aere. Wired to AereTrustRegistry + AereBitstringStatusList above. Deploy tx 0xd7b6a4e0…9ca4. [@status CANONICAL] + + // ── Live on chain 2800 and absent from this book until 2026-08-02 ───────── + // Why they are here now: a live contract that this file does not name is a + // contract nobody can check and nobody knows to be wary of. Each line below + // was measured directly against https://rpc.aere.network at `latest` + // (head observed 11,929,374; the head is an observation, not a replay handle, + // because chain 2800 keeps roughly 512 blocks of state). Capability claims + // come from a PUSH4 instruction walk of the live runtime code, never from an + // empty eth_call revert. + AereThresholdPQCRegistryV2Fixed: '0x8Fbfe1C72E8c83ca2a0c475ce3648D47bCC8643c', // CANONICAL t-of-n post-quantum threshold registry. REPLACES 0x9a6096F6…C213 above, which this file kept calling canonical after it had been superseded. Live: 5,909 bytes of runtime code (the replaced one has 5,689), 33 distinct dispatcher selectors, holds no native balance. It rejects duplicate committee keys, which is the defect the replaced one carries. It is printed as the canonical address by the whitepaper and by docs/THRESHOLD-PQC-2026-07-12.md, so until today the book and the published documents disagreed. [@status CANONICAL] + AereHalo2ProofAnchor: '0xA67080084d1Ff2E6E1c59eE5a4Da059F0Ce8255f', // Anchor for the Halo2 (PLONKish, KZG over bn254) proof path; the consumer of AereHalo2CubicVerifier 0x414Cfe64…dC55, which WAS in this book while its anchor was not. Live: 1,426 bytes, 8 dispatcher selectors, no owner() in the code, no native balance. Deployment record aerenew/contracts/deployments/halo2-cubic.json (anchor deploy tx 0x622a9faf…3406, deployer 0xbeB3…6465). HONEST SCOPE: the SRS behind that path is a locally generated dev SRS, NOT a public ceremony. [@status CANONICAL] + AereShutterMempoolV3: '0x0C0b0560fcaa534fc30D29ae1D248CC1675281df', // Application-level threshold-encrypted mempool, the reveal-timeout fix over V2's position lock. Live: 8,893 bytes, 63 dispatcher selectors (V2 has 8,339 and 56), no native balance. Our own deployment record aerenew/contracts/deployments/shutter-mempool-v3.json states in its own words that it supersedes V2, and V2 was the only one this book named. NOT a consensus change: Besu QBFT has no protocol-level encrypted mempool. [@status CANONICAL] + AereCollateralVaultUnregistered: '0x31642bD7901A0405950026072c121bC3Cf25F4fC', // NEVER AUDITED, IN NO DEPLOYMENT RECORD, and until today in no registry. Found by the 30-agent audit 2026-08-01 outside all 530 inventoried addresses; re-measured here 2026-08-02. Live: 4,954 bytes, 33 dispatcher selectors, owner() == Foundation 0x0243A4…f3C3, native balance 0. Identified from the live dispatcher as a collateral vault: deposit(), withdraw(uint256), repay(address,uint256), mint(address,uint256), owner(), transferOwnership(address). TWO THINGS MEASURED HERE, NOT INHERITED: (1) it holds the mint right over dUSD 0xF0a90fEA…8801 — dUSD.minter() (selector 0x07546172, confirmed present by an instruction walk of dUSD's runtime code) returns exactly this address; (2) its storage slot 2 holds 0xf0A13823A4bFa86358Fe30aaf1f44A36AcbCf399, which is AereOracle_v1_DEPRECATED in this same file, so an unaudited vault prices collateral from an oracle we ourselves marked deprecated for returning a median at one contributor. No source in this repository reproduces it. [@status UNAUDITED @reason never-audited-holds-dusd-mint-right-and-reads-a-deprecated-oracle @repro NO_SOURCE] + dUSD: '0xF0a90fEA2FDA12CC2545ddAa817F5C253F348801', // Live ERC-20, name() "AERE USD", symbol() "dUSD", 18 decimals, totalSupply() 0, owner() == Foundation 0x0243A4…f3C3, 3,459 bytes, no native balance. mint(address,uint256) and burn(address,uint256) are both present in the dispatcher, and minter() returns AereCollateralVaultUnregistered above, so the mint authority sits with a contract that was never audited. Recorded in aerenew/contracts/deployments/unmanifested-live-2026-08-01.json; 15 compiler profiles against contracts/bridge2/AereUSDC.sol reproduce none of it, so the deployed source is not in this repository. NOT a burn vault: it has no receive() and a plain native transfer to it reverts. [@status UNAUDITED @reason no-reproducing-source-and-mint-authority-is-an-unaudited-vault @repro NO_SOURCE] + AereBridgedUSDC_live: '0x99fe69077B3DDaA81B94D0F95f6724F6819CC320', // Live ERC-20, name() "Aere-Bridged USDC", symbol() "aUSDC", totalSupply() 50,000,000 raw units, 5,963 bytes, no native balance. AccessControl, not Ownable: hasRole, getRoleAdmin, grantRole, DEFAULT_ADMIN_ROLE and MINTER_ROLE (0x9f2df0fe…56a6) are all present in the live dispatcher, alongside mint(address,uint256). This is the token the exposed-attestor finding of 2026-08-01 runs through, and it was in no registry. WHO HOLDS MINTER_ROLE AND DEFAULT_ADMIN_ROLE TODAY IS NEMASURAT in this pass. [@status UNAUDITED @reason unaudited-token-with-a-live-mint-role-never-registered @repro NEMASURAT] + AereBridge_live: '0x6F5c279A3436d8b21AF6f8f7E48174A12D4a94a1', // Live bridge, 4,881 bytes, 23 dispatcher selectors, no native balance. AccessControl (hasRole / getRoleAdmin / grantRole / DEFAULT_ADMIN_ROLE) and mint(address,uint256) are present in the live code. Named in aerenew/contracts/deployments/bridge.json and in no registry. "Kill AereUSDC + AereBridge" was recorded as done on an earlier pass and the code is still live, which is exactly why it is written down here instead of left out. Its current role holders are NEMASURAT in this pass. [@status UNAUDITED @reason recorded-as-killed-but-still-live-role-holders-not-measured @repro NEMASURAT] + AereSpokePoolUnmanifested: '0x3a3eaec50caf4abccb266002d6e54aaf0c1ca941', // Live, 6,317 bytes, owner() == the hot deploy key 0xbeB3…6465 (NOT the Foundation), paused() == false, native balance 0, depositCounter 0 at the 2026-07-31 reading. Found through the hot-key exposure sweep, recorded in aerenew/contracts/deployments/unmanifested-bridge-2026-07-31.json, absent from this book. Bytecode does not reproduce from any local source; identified as AereSpokePool by a 4-byte selector-set comparison (18 of 18 live selectors present in that ABI, next best of 484 ABIs far behind). [@status UNAUDITED @reason unpaused-and-hot-key-owned-with-no-reproducing-source @repro NO_SOURCE] + AereZKScreen_v1_DEPRECATED_BOOL_DECODE: '0xE9da9c5F40c2CDfda368885832C59609286e04ee', // Live, 3,113 bytes, owner() == Foundation 0x0243A4…f3C3, no native balance (measured 2026-08-02). First ZKScreen deployment. It declared the SP1 verifier interface as returns (bool); the real gateway returns nothing and reverts on an invalid proof, so decoding a bool from empty return data is unsound. Our own published spec (research/specs/spec-identity-compliance.md) has named this address as dead since it was written, while this book named neither it nor v2, so a reader of the spec had no registry entry to check it against. [@status DEPRECATED @reason sp1-interface-declared-returns-bool-decoded-from-empty-return @replacement AereZKScreen] + AereZKScreen_v2_DEPRECATED_SELF_CLEAR_ROOT: '0x140572e018C0342336dbaAa1713281c15678aFa7', // Live, 3,102 bytes, owner() == Foundation 0x0243A4…f3C3, no native balance (measured 2026-08-02). Second ZKScreen deployment, the self-clear hole: the proof commits an extraDataHash read as the allowlist Merkle root the screen was checked against, and the prover supplies that root, so a prover clears itself. Closed in v3 by binding a Foundation-set authorizedRoot. Same reason for being written down as v1 above. [@status DEPRECATED @reason prover-supplies-the-root-it-is-checked-against @replacement AereZKScreen] + AereConsensusPQCAttestor: '0xf3681Aa6444F79562683C26f9d5c369A479c87dD', // Live, 4,050 bytes, owner() == 0xE04587e0…06D9 (the bootstrap key, not the Foundation), no native balance. Deployment record aerenew/contracts/deployments/consensus-pqc-attestor.json; cited 12 times on the public surface (blocky-chain-forge/public/claim-evidence.json among them) and named in no registry until today. HONEST SCOPE, unchanged: mainnet consensus is classical secp256k1 ECDSA. An attestor contract records post-quantum attestations at the APPLICATION layer and does not make consensus post-quantum. [@status CANONICAL] + AereMailboxUnmanifested: '0xf0cBd31E9578ac26BDEC01E0F45651d4E89Af94B', // Live, 4,589 bytes, owner() == the hot deploy key 0xbeB3…6465, paused() == false, native balance 0. Found by following the spoke pool's own messenger() getter, not by any file: it appeared in no file in the tree. Same record as the spoke pool above. [@status UNAUDITED @reason unpaused-and-hot-key-owned-found-only-by-following-another-contracts-wiring @repro NO_SOURCE] + // ── Deferred to future phases (not yet deployed) ────────── // AereSwapRouter, AereYieldFarm, // AereVesting, AereInsurancePool, AereLaunchpad, AereAirdrop, AereMultiSig,