大表哥 / Big Cousin: Flap handoff

Download

The bundle is everything in one file, including both zips, both handoff notes, the audit scope, the spec-compliance evidence, the full E2E report with screenshots, and a SHA256SUMS to verify against. The individual zips are the exact same bytes, offered separately if you only want one.

Full handoff bundle

Everything the Flap team needs, in one archive.

bigcousin-flap-handoff-2026-08-21.zip3,913,032 bytes

SHA-256 5b7f711ee9e4e1a60ba06eeffa85c54b00d1f7e9991176726c56909231287f9b

Download bundle

UI source package

Upload this to the Artifact Workbench exactly as shipped. Do not hand-assemble a replacement: the Workbench rejects packages without the flap-vault-package.json marker.

flappy-cuz.zip132,739 bytestemplate 0.1.29

SHA-256 b60fd6109a672b8645effaaf98ae5e2f5b972a0acf4d5be1b977e32a876c3701

Download

Contracts source package

Solidity source, Foundry config, the full test suite, the audit scope and the rule-by-rule spec compliance evidence.

bigcousin-flap-contracts-audit-2026-08-20.zip96,057 bytes

SHA-256 066ed55954f82d9e780ccbe901a739ab126c6f7b59aedc5828b042e38b748a68

Download

Package status, UI

All four commands ran in one pass against a clean checkout synced to origin/main, with no source edits between them.

Command	Result
yarn vault:check flappy-cuz	PASSED, 0 blocking, 1 manual-review warning
yarn vault:e2e flappy-cuz	PASSED, 17 checks, 0 issues
yarn vault:package flappy-cuz	PASSED
yarn vault:verify-package	PASSED (marker, file list, metadata, hashes)

E2E covered PC, iPad and H5 across default, internal-market, dex-listed, wrong-network, WebGL2-fallback, reduced-motion and context-loss. Every screenshot the harness took is in ui/e2e-report/.
The one warning is the expected manual-review/mini-app-3d, the standard three-r3f-v1 review of performance tiers, asset provenance and fallback. It is expected for any package that ships local 3D art.
Mode mini-app, capability three-r3f-v1. Locales en and zh, with 中文 primary. Title 中文 "Flappy 大表哥", EN "Flappy Cuz".
The Mini App plays the game only. No wallet, no contract calls, no Vault state read, no transactions, so it needs no ABI surface.
The simulation is the same pure engine the website runs, copied unchanged, so the physics are identical on both surfaces. Only the renderer differs: R3F with an orthographic camera mapped one world unit to one logical pixel.
If WebGL2 is unavailable the same engine drives a plain 2D canvas that genuinely plays, drawn from primitives, rather than a "not supported" panel.

The token binding is audit-stage and must be rebound before production

$大表哥 has no contract address yet. The manifest binds to 0x9adc2f9dbc4578808f0cdb30d51b5199ff4b8888, a real deployed TEST token used purely as Workbench and E2E proof, because tokenAddresses must be a real deployed ERC20 ending in 7777 or 8888 and the contract forbids substituting a plausible-looking placeholder.

Once the real token exists, apply the final production binding in Workbench, or regenerate the package with the real token and rerun the same four commands. Suggested caRestrictionMode: reserved.

Contracts

Three contracts, all far inside EIP-170. This vault keeps 9,445 bytes of headroom, because there is no swap route, no TWAP and no oracle.

Contract	Runtime	EIP-170 margin	Role
BigCousinVaultUpgradeable	15,131 B	9,445 B	Flap tax vault, splits QQQB 30/70
BigCousinVaultBeaconFactory	8,010 B	16,566 B	BeaconProxy factory via VaultPortal
FlappyCuzTreasury	10,667 B	13,909 B	Holds game QQQB, pays signed receipts

43 unit tests passed, 2 BSC mainnet-fork integration tests passed, 45 total, 0 failed.
The fork test runs the real VaultPortal path against the live, enabled QQQB quote token 0x205812CdBed920aFf76C6580abD681a46D11efc7: 7777 creation, factory-created vault, transfer-plus-wake QQQB routing, curve buy, tax dispatch, the 30/70 split landing in both treasuries, DEX graduation, post-DEX sell and dispatch, then a signed payout of real tax-derived QQQB to a player wallet.
Scope, money flow and trust model are in contracts/AUDIT-SCOPE.md. Rule-by-rule compliance evidence is in contracts/FLAP-SPEC-CHECK.md.

What to do with it

Verify the checksums: shasum -a 256 -c SHA256SUMS
Upload ui/flappy-cuz.zip to the Artifact Workbench, unmodified.
Take contracts/bigcousin-flap-contracts-audit-2026-08-20.zip into the audit round.
Rebind the Mini App to the real token once $大表哥 exists, then rerun the four vault commands.

Open on our side

Ours to close, not Flap's, but they affect the audit.

code-auditor has not yet run. Per our own standing rule, anything touching real funds passes it before deploy. This submission is source-only.
Immutable-once-set values still to be decided: the two treasury addresses, the owner key for FlappyCuzTreasury, and maxClaimPerRun / maxDailyPerWallet sized against the balance actually held.
Where the 70% remainder ultimately goes. Right now it is a single address.
The points-to-QQQB rate the signer applies, which is deliberately off-chain.