# pFLY Scoped Security Review Date: 2026-05-31 Scope: repository contracts, launch website, testnet proof package, and deployed PulseChain Testnet V4 state. ## Result This is a scoped internal review and QA pass. It is not a formal third-party audit. No launch-blocking issue was found in the reviewed scope after fixes and regression tests. ## Automated Checks - `npm run compile` passed. - `npx hardhat test` passed with the current contract, activation-airdrop, and airdrop regression suite. - Added abuse-regression tests for owner-only controls, fee caps, engine-share totals, swap bounds, AMM fee flow, staking lock bounds, early-end penalty bounds, reward reserve safety, farm reward-rate caps, inactive pool exits, and LP withdrawal behavior. - JavaScript in `web/index.html`, `web/contract-viewer.html`, and launch copies parsed successfully. - Testnet proof package JSON parsed successfully. - Dangerous-pattern grep found no use of `tx.origin`, `delegatecall`, `selfdestruct`, inline `assembly`, `suicide`, `blockhash`, or raw `.call`. - Production dependency audit passed with `npm audit --omit=dev --audit-level=high`. ## Browser And Load QA - In-app Browser load check passed on `http://127.0.0.1:4200/pfly/index.html`. - Entry page title, launch section, and first meaningful content rendered with no console warnings or errors. - Link audit checked 51 anchors: 23 hash links, 12 local static links, and 16 approved external launch/wallet/explorer links. - Fixed one static-site issue found during QA: `/pfly/WHITEPAPER.md` was missing from the web bundle. - Final link audit passed with no broken local links or missing hash targets. - Click-through QA exercised dashboard, flywheel, products, whitepaper, LP farm, staking, launch, contract viewer, wallet-detect, add-liquidity, farm, staking, launch-check, and read-block controls. - Live chart QA confirmed real PulseChain Testnet V4 `FlywheelEngine` logs: 1 event, `2.7608 pFLY` bought and burned, `1.6807` pFLY/pDAI LP burned, and `14.2098` pFLY/pMINT LP burned. - Local-only load stress completed 2,000 requests at 64-way concurrency across the app, contract viewers, proof JSON, review docs, and whitepaper: 2,000 HTTP 200 responses, zero failures, p95 latency 75 ms, max latency 91 ms. ## Covered Behaviors - Flywheel executes after fee buildup even when LP ratios drift. - LP burn rails route LP tokens to the dead wallet. - pFLY buy and burn route sends bought pFLY to the dead wallet. - Staking V3 supports 5,555-day max locks. - Staking V3 emergency end starts at 30% and can scale to 45%. - Emergency end routes two-thirds of penalty to pDAI reflections and one-third to pFLY buy and burn. - Staking rewards are capped to the funded reserve. - Recycle farm burns 0.25% LP on deposit. - Recycle farm escrows most harvest rewards. - Recycle farm rewards do not accrue beyond funded reserve. - Recycle farm pDAI Stability Drips require real LP staked before funding and are claimed through the farm harvest path. - LP providers can withdraw deposited LP without an exit burn. - Farm pools are pFLY/pDAI, pFLY/pMINT, pFLY/pHEX, and pFLY/WPLS. - PMINTHolderAirdrop binds claims to the PulseChain pMINT address, snapshot pMINT balance, Merkle allocation, per-wallet cap, and minimum eligibility threshold. - PMINTHolderAirdrop prevents double claims, supports optional stake-and-claim for 180/555/5,555 days, and splits expired unclaimed pFLY 50% burn / 50% staking reserve. - PDAIHolderAirdrop binds claims to the pinned PulseChain pDAI address `0x6B175474E89094C44Da98b954EedeAC495271d0F`, snapshot pDAI balance, Merkle allocation, per-wallet cap, and minimum eligibility threshold. - PDAIHolderAirdrop prevents double claims, supports optional stake-and-claim for 180/555/5,555 days, and splits expired unclaimed pFLY 50% burn / 50% staking reserve. - PFLYFlywheelActivationAirdrop combines pMINT and pDAI holder sources into one Merkle root with source IDs, 25% base unlock, wallet-only 100% path, activation bonuses, and a 200% payout cap. - Activation airdrop LP checks require exact pFLY/pDAI or pFLY/pMINT partner tokens, with optional PulseX factory validation. - Activation airdrop tests cover bad proofs, wallet-only bonus blocking, exact LP rail enforcement, tiny LP rejection, pause behavior, expired sweep, and full 200% stake + LP + farm activation. - Snapshot helper tests verify known linked pMINT and pDAI wallets are clustered as one holder for square-root weighting and max cap before allocation is split across wallets. - Front-end claim center validates user-provided Merkle claim inputs with `canClaim`, then routes either `claim` or `stakeAndClaim`. - Token owner controls are inaccessible to non-owners in the tested paths. - Farm reward rate cannot exceed the hard cap. - Inactive farm pools block new deposits while allowing existing LP withdrawals. ## Owner Controls Reviewed - Token fee updates are capped. - Engine share updates must sum to 100%. - Swap threshold and max swap settings are owner controlled. - AMM pair registration is owner controlled. - Swap slippage and deadline settings are owner controlled and capped. - Farm pool creation, allocation, active state, reward rate, and timing are owner controlled. - Staking swap slippage and deadline settings are owner controlled and capped. These controls are powerful and should be clearly disclosed before mainnet. ## Remaining External Audit Targets Before mainnet public promotion, get outside review for: - Owner controls and operational launch procedures - PulseX router assumptions - LP creation and LP burn paths - Automated swap paths and quoted slippage behavior - Staking V3 emergency-end swap routing - pDAI reflection accounting - Recycle farm reward reserve accounting - Mainnet deployment parameters - Mainnet allocation funding transactions: 50% staking reserve, 35% recycle farm reserve, activation airdrop funding, 2% pDAI pioneers fund, and 5% marketing/growth wallet - PFLYFlywheelActivationAirdrop snapshot root, source snapshots, excluded-address lists, Sybil cluster files, reserve wallets, and distribution process ## Current Mainnet Status Mainnet public hype should stay off until the mainnet proof package is published: - Token address - LP add transaction - LP burn proof - Staking V3 funding transaction - Recycle farm funding transaction - pDAI Stability Drip funding transaction, if farmer pDAI rewards are advertised - 50% staking reserve funding transaction - 35% recycle farm reserve funding transaction - PFLYFlywheelActivationAirdrop deployment and funding transaction - Combined activation snapshot JSON, source snapshots, excluded-wallet lists, and Sybil cluster files - 2% pDAI pioneers fund wallet and distribution plan - 5% marketing/growth wallet and distribution plan - External audit status No mainnet transactions were sent by this workspace automation during this scoped QA pass. Unknown multi-wallet Sybil ownership cannot be solved on-chain. The activation airdrop prevents double-claims per address and source; known linked-wallet handling belongs in the public snapshot cluster files and must be reviewed before publishing Merkle roots. ## Disclaimer This review is for technical transparency only. It does not guarantee safety or profitability. Users should independently verify contracts and transactions before interacting.