Security
Security Policy
Aevum Protocol takes security seriously. If you discover a vulnerability, please disclose it responsibly.
Responsible disclosure
If you discover a security vulnerability in Aevum Protocol's smart contracts, infrastructure, or frontend, please email us at security@aevumprotocol.io before disclosing publicly.
What to include in your report
- Description of the vulnerability and potential impact
- Steps to reproduce or proof of concept
- Affected contracts, endpoints, or components
- Your suggested fix (optional but appreciated)
What we commit to
- Acknowledge your report within 48 hours
- Keep you informed of our progress
- Credit you in our disclosure (if desired)
- Not pursue legal action for good-faith security research
Scope
- Smart contracts deployed on Ethereum mainnet (verified source on Etherscan)
- Frontend at aevum-frontend.vercel.app
- Main website at aevumprotocol.io
- API endpoints and serverless functions
Out of scope
- Issues already documented in KNOWN_LIMITATIONS.md
- Denial of service attacks
- Social engineering
- Third-party services (Supabase, Vercel, Stripe)
Audit status
A professional security audit by Hexens (Kasper Zwijsen, Head of Audits — previously audited EigenLayer, Lido, LayerZero) is contracted and will restart upon first investment close. Known limitations are documented and shared with auditors and partners on request at jonathan@aevumprotocol.io.