# 大表哥: Flap audit submission

Two bound packages: the Vault **UI** source package and the
**contracts** source package. Flap binds them together for the audit round.

## 1. UI source package

    miniapp/flappy-cuz.zip
    SHA-256: b60fd6109a672b8645effaaf98ae5e2f5b972a0acf4d5be1b977e32a876c3701

Template 0.1.29. vault:check / vault:e2e / vault:package / vault:verify-package
all pass in one run. Details in `miniapp/HANDOFF.md`.

## 2. Contracts source package

    contracts-audit/bigcousin-flap-contracts-audit-2026-08-20.zip
    SHA-256: bab9b54ac25fffa1b311daea75947cb5af21b992a0b4321ec9a370dc2088956e
    Size:    93040 bytes

Scope, money flow and trust model: `contracts/AUDIT-SCOPE.md`.
Rule-by-rule compliance evidence: `contracts/FLAP-SPEC-CHECK.md`.

### What is in it

| Contract | Runtime | EIP-170 margin | Role |
|---|---|---|---|
| `BigCousinVaultUpgradeable` | 15,131 B | 9,445 B | Flap tax vault, splits QQQB 30/70 |
| `BigCousinVaultBeaconFactory` | 8,010 B | 16,566 B | BeaconProxy factory via VaultPortal |
| `FlappyCuzTreasury` | 10,667 B | 13,909 B | Holds game QQQB, pays signed receipts |

All three are far inside EIP-170. This vault keeps 9,445 bytes of headroom
because there is no swap route, no TWAP and no oracle.

### Verification

```text
43 unit tests passed; 0 failed
 2 BSC mainnet-fork integration tests passed; 0 failed
45 total; 0 failed
```

The fork test runs the real VaultPortal path against the **live, enabled QQQB
quote token**: 7777 creation, factory-created vault, transfer-plus-wake QQQB
routing, curve buy, tax dispatch, the 30/70 split landing in both treasuries,
DEX graduation, post-DEX sell and dispatch, then a signed payout of real
tax-derived QQQB to a player wallet.

Rebuild:

```bash
cd contracts
forge build --sizes
forge test --no-match-path "test/*mainnet*"
forge test --match-path "test/*mainnet*" --fork-url https://bsc-dataseed.bnbchain.org
```

## Gates before anything is deployed

1. **Internal adversarial review: DONE, 2026-08-21.** Both contracts, the Flap
   bases, the tests and the config were reviewed before this package was sent.
   No exploitable issue was found in the claim/signature path, the vault
   split/accounting path, the beacon/initializer path, or the config guards.
   Three findings, all fixed here: two documentation claims that overstated the
   on-chain protection, and one assertion that could never fail. Details in
   `contracts/AUDIT-SCOPE.md`.

   This is our own review, not a third-party audit. It is offered as evidence of
   diligence, not as a substitute for yours. Nothing is deployed on any network.
2. **Flap's third-party audit.** Self-verification and integration tests are the
   prerequisite; the audit itself is arranged with Flap and removes the vault
   warning on Flap.sh. Better done before launching the token, because after
   launch the vault setup may not be changeable.
3. **Decisions still owned by the project:**
   - the two treasury addresses (immutable once the factory is deployed)
   - the owner key for `FlappyCuzTreasury` (project-held, not Flap's Guardian)
   - `maxClaimPerRun` / `maxDailyPerWallet`, sized against the balance held
   - where the 70% remainder ultimately goes; right now it is one address
   - the points-to-QQQB rate the signer applies (deliberately off-chain)
