The protocol released its first batch of core contracts on March 14, 2025, with the audit report due in two weeks. The announcement was met with a predictable wave of optimism. Community members celebrated "transparency" and "new standards." I counted 47 tweets within 24 hours praising Aero’s commitment to security. The narrative is comforting. The reality is more complex.
Aero is a permissionless lending protocol built on Arbitrum, offering variable-rate loans with a novel liquidation mechanism. It has attracted $340 million in total value locked since its launch in January 2024. The team claims to have undergone a "multi-phase security review" by three separate firms. The first batch of core contracts—covering the lending pool, oracle integration, and liquidation engine—is now publicly available on GitHub. The audit is described as "nearing completion."
On the surface, this is a positive signal. Few protocols release raw contract code before the final audit report is published. Doing so invites public scrutiny and potential exploitation before fixes are applied. It is a high-risk move that suggests confidence. But confidence is not a security guarantee. The system fails because it assumes that visibility equals safety.
The core contracts reveal two structural concerns.
First, the oracle integration relies on a single Chainlink price feed for each asset pair. The code shows a hard-coded address for the ETH/USD feed with no fallback oracle. This is a single point of failure. During the March 2023 flash crash on Arbitrum, Chainlink’s ETH/USD feed lagged by 12 seconds, causing cascading liquidations on protocols without redundant oracles. Aero’s code does not include a secondary oracle or a time-weighted average price mechanism. The team’s documentation claims "multi-source redundancy," but the code speaks otherwise. The logic is simple: if the primary feed is manipulated or delayed, the liquidation engine will execute at stale prices. The protocol’s solvency margin is 110%. A 12-second delay could reduce that margin to below 100% in a high-volatility event. This is a systemic risk, not a theoretical edge case.
Second, the liquidation engine uses a linear slippage model. The code calculates the amount of collateral to seize based on a fixed percentage of the debt. The formula is: