Audit
Ten rules, the test that proves each, and what is still not proven.
86 tests, 0 failed, 0 skipped — 62 local and 24 against a BSC mainnet fork with both RPC variables set. Twenty-six guards were deleted from the source on purpose and the tests that claim to catch them were required to fail.
Nothing is deployed. No address exists on any chain.
There is no factory address, no vault address and no mine address, on mainnet or on any testnet. No transaction has been broadcast. What exists is source, a test suite, the measurements on these pages — and a deploy script that has not been run.
Two rows carry rule 001, because the rule has two parts and one of them is the open item. The tick count on each row is the number of tests named in that row’s Proof column — it is a count of evidence, not a score. Rule 006 is proved by the suite table rather than by named tests, and rule 007 has nothing to name because nothing calls the interface.
Base, UI schema, Guardian, no DoS
Inherits the Flap v2.2 vault and factory bases unmodified. The published schema describes eight real methods with correct ABI types and write flags; the only privileged function in the system is setProject, which is Guardian-only, and nothing can revoke the Guardian. Settlement never loops over participants.
Commission recommendation
The rule recommends msg.value * 6 / taxRateBps — 3% at a 2% tax. This vault credits 30% to a launcher-configured project address snapshotted per period: ten times that. Not a hardcoded developer address, and flagged rather than decided.
Factory and commission mechanics
Factory spec v2.2. newVault reverts unless the caller is Flap’s VaultPortal, and payload length and address padding are checked before decoding. Native BNB only. The commission figures are measured on the real chain: 9,000 bps kept with no receiver, 8,700 with one, and that 300 bps is a cut of the wage bill.
Fairness, no privileged sandwich
Tax arriving in period N funds N+1, and credit follows the period owning the seed block rather than the submission. Project, referrer and rounding remainder all resolve from a funding-time snapshot, and no admin can rewrite the split. Disclosed rather than hidden: multi-address Sybil, and a block producer’s influence over one seed block.
Literal, UI-friendly, bilingual errors
Every require in our own code carries a literal English-and-Chinese string, and we declare no custom errors. The vendored Flap prelude keeps its own — we did not fork the base.
receive() gas
Period arithmetic on its own copied values, one bucket write, a project snapshot, two counters and one event. No loop, no external call, no transfer, no delegatecall. 108,115 gas measured inside a real TaxProcessor dispatch on a BSC mainnet fork, against Flap’s 1,000,000 ceiling — see Fig. 11.
Integration tests
86 tests, 0 failed, 0 skipped, of which 24 fork BSC mainnet, register the factory on the real VaultPortal, launch a real taxed token, buy on the bonding curve and dispatch real tax. Plus three stateful invariants. Nothing on the fork path is mocked.
AI Oracle
Nothing in either contract calls Flap’s AI provider interface.
Trigger Service
No trigger request and no callback. Settlement is a permissionless public call that pays its caller 2%, which is why it does not need one.
Emergency controls
Both contracts are BeaconProxies. Rule 009 says such a vault is fully exempt and must omit the emergency functions entirely — neither carries any of the five. The beacon moves ownership to the Guardian inside its constructor.
VaultBaseV3 / ERC-20 quote accounting
A native-BNB VaultBaseV2 with no vaultQuoteToken(). The tax token being a V3 token does not imply a V3 vault base.
What the edge mark means
The compiler settings are part of the result.
Solidity 0.8.26, EVM version cancun, optimizer 200, IR pipeline on — all pinned. Leaving the EVM version unpinned lets a newer toolchain retarget the bytecode to a fork BNB Chain does not run.
The vault is the tight one: 1,424 bytes of headroom under the 24,576-byte contract size limit.
From forge build --sizes with the pinned settings — Solidity 0.8.26, evm_version = "cancun", optimizer 200, via_ir = true. Leaving the EVM version unpinned lets a newer toolchain retarget the bytecode to a fork BNB Chain does not run, which would change every bar here.