Aero bug bounty on Sherlock: up to 500,000 USD
Dromos Labs pays up to 500,000 USD on Sherlock for critical bugs in Aero, its multichain liquidity protocol. Live since 21 October 2026.
The Aero bug bounty on Sherlock pays researchers for vulnerabilities in Aero, the multichain liquidity protocol from Dromos Labs. Aero builds on the earlier Aerodrome and Velodrome protocols. The program page shows it live since 21 October 2026 and has no end date.
Rewards are paid in USDC on Ethereum mainnet. Critical findings pay 50,000 USD to 500,000 USD. High findings pay up to 50,000 USD, medium findings 1,000 USD to 10,000 USD and low findings up to 1,000 USD. Critical and high rewards are 10% of the funds directly affected, within those limits.
The scope covers the Aero contracts, the concentrated liquidity contracts and periphery contracts such as the Relay and the Metarouter. Base is the root chain and coordinates rewards across chains through Hyperlane messaging. Issues in Hyperlane itself and other third party protocols are out of scope, as are known issues from earlier audits.
Every report needs a coded proof of concept with instructions to run it. It must reflect production code and show that the exploit's conditions can happen in production. Testing must be done on local forks, never on mainnet or public testnet deployments.
Reports go only through the Sherlock platform. Keep the details private until the team has verified the issue, deployed a fix and given explicit permission to disclose.
Quick answers
How is a critical reward worked out?
It is 10% of the funds directly affected, up to 500,000 USD, with a minimum of 50,000 USD. A critical bug must put more than $500,000 of funds at risk.
Which chains are in scope?
Base as the root chain, plus Ethereum, OP Mainnet, Arc, Ink, Robinhood and Arbitrum.
Can I test on mainnet?
No. All testing must be done on local forks of a public testnet or mainnet.