What the code forbids
A team's promises are worth nothing. FlyPool's contracts are built so the question never arises: what must be impossible is absent from the code, and that can be read off the bytecode rather than off a page like this one.
FlyPool.sol
The token is deliberately inert
The entire supply is minted at deployment. No mint function exists afterwards, not locked, absent. The supply can therefore only shrink.
| Capability | Present? | Consequence |
|---|---|---|
| Minting after deployment | No | The supply cannot be diluted |
| Pausing transfers | No | Nobody can immobilise your tokens |
| Address blacklist | No | No holder can be excluded |
| Transfer tax | No | A transfer delivers the amount sent |
| Code upgrade | No | What is deployed will not change |
| Owner | No | There is no privilege to compromise |
| Burning one's own tokens | Yes | Lets the oracle burn what it holds, with no power over anyone else's tokens |
FlyOracle.sol
The contract does not trust the server
The oracle receives the simulated epochs and executes the corresponding action on the tokens it holds. It assumes the publishing key can be compromised at any moment, and therefore grants it nothing beyond the right to submit an already-bounded epoch.
In particular, it never accepts an amount computed off-chain: it recomputes it from its own balance and the announced fraction, which is itself capped.
| Guarantee | Value | What it prevents |
|---|---|---|
| Prior commitment to the seed | SHA-256 on-chain | Choosing the seed after seeing the result. The contract recomputes the commitment itself |
| Absolute cap per epoch | 1 % | Any oversized epoch. Even the owner, even after the delay, cannot configure a higher cap |
| Burn circuit breaker | rolling window | A run of legitimate epochs draining the supply by accumulation |
| Strictly increasing identifiers | strict | Replaying an epoch that has already executed |
| Minimum interval between epochs | 15 min in the first hour, then 30 min | An accelerated sequence of epochs |
| Buyback | real purchase on the pool | A buyback that only moves tokens: ETH from the treasury buys FLYPOOL on the Uniswap V2 FLYPOOL/WETH pool, at the pool's own price |
| Buyback size | treasury spent over 2 days · ≤ 1 % of pool reserve | Spending the treasury faster than the announced schedule, or a purchase large enough to move the price far and be profitably sandwiched. The brain decides when to buy; the contract's clock decides how much (time since the last buyback ÷ time left before the 2-day deadline) |
| Burn | sent to 0x…dEaD | Tokens being retrievable: nobody holds the dead address's key |
| Freeze decision | recorded, no effect | A lasting lock on burns and buybacks: re-triggered on every grooming turn, a 24-hour freeze would have blocked the token indefinitely |
| Delay on every change | 2 days | A parameter or role change executed before anyone has time to notice it |
| Token exit paths | bounded | No function allows tokens to be withdrawn outside the paths described here |
The junction
The same computation on both sides
The seed commitment is computed in Python before the simulation and recomputed in Solidity at submission time. If the two implementations diverged by a single byte, a different domain separator, a different encoding, every commitment would become invalid and the guarantee would evaporate silently.
A cross-vector test therefore checks that both sides produce the same digest for the same inputs. It is part of the suite run on every change.
A guarantee no test watches over is an intention, not a guarantee.
What is not guaranteed
The real state of the deployment
Read before any decision
No external audit has been carried out. The contracts are covered by their own tests, which is not the same thing as an independent review.
Deployed on Robinhood Chain testnet, not on mainnet. Token 0xc7BB0cacd07bdEF92743a0dbaF58e8Ea5952ec76, oracle 0x2ed06d7D234189c629bBbb07c3C6851Ef80c2369, Uniswap V2 pool 0x59f5E0A7c29A276dA80b6354d3b839cab90c6134, all with their source code verified on the explorer. The full loop, commit, simulate, submit, a real buyback on the pool, a burn to the dead address, runs on this public test network. Testnet tokens have no value.
The testnet market is ours. No official DEX is published for Robinhood Chain testnet, so the pool runs on the official Uniswap V2 code deployed by this project. Its liquidity is seeded by the project too: the price it sets is real on-chain, but nobody else trades against it.
One action remains unreachable. The allocation circuit overdrives the network and has no measured operating range. It is not wired up, and we write that here rather than leave it to be discovered.
The publishing key is an acknowledged weak point. It lives on a server. Every bound above exists precisely because it can fall.