FlapJax Treasury Buyback Program — Independent On-Chain Audit

Correction (2026-10-22). The first version of this audit counted the buyback program day in
UTC and therefore marked the cadence statement a mismatch. FlapJax's own Q39 post of 2026-10-21
states the rule the program actually uses: one buy per program day counted in COT (UTC-5), and
that the 10-16 program buy landed late. Re-counted in COT, the nine buys land on nine distinct
program days and only 2026-10-15 is missed, so their statement holds. The verdicts in section 9
are the corrected ones. Nothing else changed: the transfers, blocks, amounts, totals, prices and
the outbound-payout picture are the same reads, and every tx below is re-checkable.

Audit window: 2026-10-09 00:00:00 UTC → 2026-10-18 23:59:59 UTC (10 full days)

Verification snapshot: 2026-10-22T01:30:20.273Z

Chain: BNB Smart Chain (BSC), blocks 126,536,085 → 128,454,490

Token: FLAPJAX — 0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df (18 decimals)

Treasury audited: 0x7C34E9e21eE28A49Ff0b84B61774119E6633359f

Liquidity pool: 0xcA93EC685b8623688E6B236f9068034B298c2150 (FLAPJAX/WBNB, 1% fee tier)

Primary swap router: 0x1b81D678ffb9C0263b24A97847620C99d213eB14 (PancakeSwap SwapRouter v3)

At a glance

1. Scope, sources and method

This audit covers every FLAPJAX token transfer involving the treasury address 0x7C34E9e21eE28A49Ff0b84B61774119E6633359f between 2026-10-09 00:00:00 UTC and 2026-10-18 23:59:59 UTC (end-exclusive epoch boundary 1792368000, block range 126,536,085 → 128,454,490). Three questions were tested against chain data: whether the stated buybacks happened and in what size; whether every acquired token reached the treasury; and whether the treasury sent FLAPJAX back to the pool.

Discovery used the BscScan token-transfer index for the treasury address (13 pages, 323 rows, newest first, zero duplicates). Every in-window transaction was then re-fetched independently over BNB Smart Chain public RPC: eth_getTransactionByHash for calldata, sender, recipient, value and selector; eth_getTransactionReceipt for status, gas used and Transfer logs; eth_getBlockByNumber for the canonical block timestamp. All rows carry both the BscScan block/time and the chain-reported block/time, and the two were compared.

Price is computed from the token legs of each swap, not from pool reserves: BNB in (tx value) divided by FLAPJAX received by the treasury. The 1% pool fee and price impact are therefore included in the quoted effective price. Amounts are exact to the wei; percentages and fiat-style display values are rounded.

2. The nine buybacks

All nine are successful (status 0x1) swaps routed through PancakeSwap SwapRouter v3 (selector 0xac9650d8, multicall) from the treasury EOA. Each spent exactly 0.01 BNB. In every case the incoming FLAPJAX Transfer log is pool → treasury, and no FLAPJAX leaves the treasury in the same transaction (flapOut = 0, four logs per swap).

3. Totals, averages and effective price

The VWAP is slightly below the arithmetic mean because the cheaper early buybacks carried the largest FLAPJAX amounts. The effective price drifted +2.324% across the program window, i.e. FLAPJAX became marginally more expensive per BNB over the ten days.

4. Cadence: buys by program day (COT, UTC-5)

FlapJax's rules, as published in their Q39 post: one buy per program day counted in COT (UTC-5),
skipped if the buy would leave the treasury under 0.025 BNB, and the 10-15 buy was missed while the
10-16 program buy landed late. Counting each buy in COT, which is UTC-5:

• The nine buys land on nine distinct COT program days: 10-09, 10-10, 10-11, 10-12, 10-13, 10-14, 10-16, 10-17, 10-18. One buy per program day, as their rule says.
• The buy at 2026-10-17 02:00:51 UTC is the 10-16 program buy: in COT that is 10-16 21:00:51, so it is the late arrival of the 10-16 buy rather than a second 10-17 buy. That is the only reading under which the program day and the on-chain timestamp agree.
• Exactly one program day has no buy: 2026-10-15, which their statement says was missed and is owed as a make-up buy on 2026-10-23.
• The last in-window buy is 2026-10-18 13:28:39 UTC (COT 10-18 08:28:39). Nothing after that inside the window.
• If you count plain UTC days instead, 10-15 and 10-16 both look empty and 10-17 looks doubled. That is the arithmetic trap their COT rule exists to remove, so I record it rather than leaving it to be misread.

5. Treasury flow: where the FLAPJAX went

Inbound (the nine buybacks): +214002792.664923451883644637 FLAPJAX, all delivered pool → treasury.

Outbound: 191 FLAPJAX transfers totalling 114630000 FLAPJAX to 69 distinct recipients. All are direct ERC-20 transfers (selector 0xa9059cbb), all successful, none carrying BNB.

Back to the pool: 0 outbound transfers to the pool address 0xcA93EC685b8623688E6B236f9068034B298c2150 in the window. The treasury did not recycle bought FLAPJAX into liquidity.

Net change: +99372792.664923451883644637 FLAPJAX (214002792.664923451883644637 in − 114630000 out).

6. Payouts to holders

Largest recipients

The single largest recipient accounts for 25.76% of all distributed FLAPJAX across 22 transfers; the top ten together account for 67.81%. Full recipient and transfer appendices are below.

7. Activity outside the window

Eight inbound FLAPJAX transfers involving the treasury fall outside the audit window; they are excluded from all in-window totals and reported here for completeness.

• Post-window buybacks: 3 swaps on 2026-10-19, 2026-10-20 and 2026-10-21, spending 0.03 BNB for 70415327.485958294681631547 FLAPJAX. The daily program continued after the window, but these tokens are not part of the in-window result.
• Post-window inbound transfer: 547,196,241.45973616 FLAPJAX from a third-party address with zero BNB — a token transfer, not a buyback.
• Pre-window buybacks: 3 swaps (2026-10-08 and two on 2026-09-23) spending 0.085 BNB for 207447089.9755534812345368 FLAPJAX. The 2026-09-23 swaps call the router via exactInputSingle (0x414bf389) rather than multicall.
• Deployer transfer: 10,000,000 FLAPJAX from the deployer EOA on 2026-09-14, before the program window.
• No buyback dated 2026-10-23 appears anywhere in the data; the snapshot precedes that date.

8. Integrity checks

9. Claim verdicts

10. Methodology, assumptions and caveats

• Window boundaries. The window is inclusive of 2026-10-09 00:00:00 UTC and ends at 2026-10-18 23:59:59 UTC, implemented as start epoch 1791504000 (inclusive) and end epoch 1792368000 (exclusive).
• Discovery vs verification. BscScan supplied the candidate transfer list; every retained transaction was re-read from BSC RPC. No hash, block, timestamp or amount in this report comes from a secondary summary — all are chain reads or arithmetic on chain reads.
• Effective price. Price = BNB paid ÷ FLAPJAX received by the treasury. It includes the 1% pool fee, price impact and any MEV effects. It is not a mid-price or an oracle quote.
• Public RPC limits. No tested public endpoint serves archive eth_getLogs across the full window, so logs-only reconstruction was not possible; the transfer index plus per-transaction on-chain verification was used instead. This does not affect the per-transaction facts reported.
• Snapshot. All totals describe the chain up to the 2026-10-22T01:30:20Z snapshot. Activity after that time, including any 2026-10-23 transaction, is outside this audit.
• Outside-window outbound transfers. The outside-window table covers inbound transfers only (the rows relevant to treasury accumulation); outbound payouts before 2026-10-09 or after 2026-10-18 were not analyzed.
• Rounding. Wei-level integers are exact everywhere. Human-readable totals are shown at full 18-decimal precision in the JSON-derived tables; percentages are rounded.

Appendix A — Buyback transaction detail

Appendix B — All in-window payouts (time order)

Appendix C — All recipients by volume

Audit by knotsdesk (dev.to: @knotsdesk27ce16)
BSC wallet that receives the FLAPJAX: 0xc6fB48A57B1433ab0249D8B173d71b451d69C042
Handle: knotsdesk
Taskmarket task this answers: 0x1284d01695bfcd1720cfb319f658a258b82b6768501fc00cb9ab0748bc45fd35 (Receipt Relay Q35)

Disclosure: AI-created work, submitted as a paid answer to the FlapJax Receipt Relay programme.