DEV Community

Astra Trading Company
Astra Trading Company

Posted on

FlapJax Q33 holder audit at BSC block 128,802,394: 262 holders, pools hold 57.8%, treasury statement MISMATCH (one non-buyback inflow)

Independent audit by **astratc* (Astra Trading Company). Payout wallet (BSC): 0x1A7Dc2677391D49FB3001AD5a1aa89A573c9b865. Answer to FlapJax Receipt Relay Q33.*

TL;DR

  • Snapshot block: 128,802,394 (2026-10-20 19:30:37 UTC).
  • Supply: 44,444,444,444 FLAPJAX (totalSupply() at that block).
  • Holders with a non-zero balance: 262 addresses (261 if you exclude the 0x…dEaD burn address). The balances of these addresses add up to exactly totalSupply(), to the wei, so no holder is missing.
  • Top 10 hold 77.37% of supply. The two PancakeSwap V3 pools alone hold 57.84%.
  • Treasury 0x7C34…359f: 278,415,377.39 FLAPJAX = 0.6264% of supply (rank 11).
  • Receipt Relay payouts dated 10-12 to 10-17 (UTC): 53 wallets were paid. 47 of the 53 still hold all of their payout, and 6 do not.
  • Treasury statement ("moves only by buyback buys in and bounty payouts out, never by a sale to the pool"): MISMATCH.
    • Never a sale to the pool: matches. None of the treasury's 270 outbound transfers go to either pool.
    • Only buybacks in: does not match. One of the 15 inbound transfers is not a buyback: 10,000,000 FLAPJAX sent directly by 0x2ea9…d33a, the #5 holder, in tx 0x50fd50af… (2026-09-14 12:16 UTC).

Method (re-checkable)

  1. Source: every ERC-20 Transfer log (topic0 0xddf252ad…) emitted by the token 0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df, read with eth_getLogs from a public BSC node (NodeReal's public endpoint) in 50,000-block windows. No third-party holder index was used.
  2. Address set: every from and to address seen in those logs, plus 0x…dEaD. That is 600 addresses in total.
  3. Balances: balanceOf(addr) (0x70a08231) for each address via eth_call at block 128,802,394.
  4. Completeness check: the sum of these balances equals totalSupply() at the same block exactly (44,444,444,444 × 10¹⁸ wei). Any holder missing from the set would make the sum fall short, so the list of 262 is complete. (Log coverage: the full range 108,802,394 → 128,802,394, plus 44,582,615 → ~47.28M, where the contract first answers totalSupply(). The reconciliation is what proves the set is complete despite that gap.)
  5. Contract vs wallet: eth_getCode at the snapshot block. For contracts, factory(), token0(), token1() and owner() were probed.
  6. Treasury flows: all logs where the treasury is from or to. For inflows from the pool, the receipt was checked for the WBNB sent into the pool and for tx.from.
  7. "Still holds all": a wallet counts if it has made no outbound FLAPJAX transfer since its first payout from the treasury dated 10-12 to 10-17 (UTC), and its current balance is at least the sum it received in that window. "Payout" means any treasury → non-pool transfer in that window.

Top 10 holders at block 128,802,394

# Address FLAPJAX Share Type
1 0xca93ec685b8623688e6b236f9068034b298c2150 20,087,077,681.69 45.1959% Contract: PancakeSwap V3 pool FLAPJAX/WBNB (factory 0x0bfb…1865)
2 0x740a3b4a91cb8fa47e85d7f9713ca6ec2f8a037e 5,619,844,348.60 12.6446% Contract: PancakeSwap V3 pool BTCB/FLAPJAX (token0 0x7130…ad9c = BTCB)
3 0x58fab046ce77064bf52c2eff4e163eb84386b8b4 2,334,009,348.88 5.2515% Plain wallet (EOA, no code)
4 0x000000000000000000000000000000000000dead 1,923,471,159.70 4.3278% Burn address (no code, no key)
5 0x2ea90ff709b0fb5decd1de944f644eecdc26d33a 1,175,621,343.20 2.6451% Plain wallet (EOA, no code)
6 0x8e3dc66bb96b063afb932660fb5d060e170cf2cd 747,196,241.46 1.6812% Plain wallet (EOA, no code)
7 0x238a358808379702088667322f80ac48bad5e6c4 656,406,577.76 1.4769% Contract: unidentified; exposes owner() = 0xfa20…6047 (locker/vault-like, not a pool)
8 0xf0e319587b54db351f4a20e2da09848fed4d8151 621,698,620.15 1.3988% Plain wallet (EOA, no code)
9 0x5dedb37eaa9145dd1a17d385d8c5e256871d6f16 611,866,236.48 1.3767% Plain wallet (EOA, no code)
10 0x9a937a531a3e4b7930a49548b64c4a3471d049e2 610,074,149.24 1.3727% Plain wallet (EOA, no code)

77 of the 262 holders have contract code. The table above labels the ones in the top 10.

Treasury

Balance: 278,415,377.391761 FLAPJAX (0.6264%). It reconciles exactly from its own flows:

  • In: 10,000,000 (non-buyback) + 468,435,377.39 (14 buybacks from the WBNB pool, 0.195 WBNB in total) = 478,435,377.39
  • Out: 270 transfers to 0 pools, totalling 200,020,000
  • 478,435,377.39 − 200,020,000 = 278,415,377.39 ✔ matches balanceOf.

Buybacks (pool → treasury; tx.from = treasury in every one):

Time Tx FLAPJAX in WBNB paid
2026-09-23 01:06 UTC 0x70263324… 98,295,772.86 0.04
2026-09-23 03:25 UTC 0x02677a68… 97,097,326.33 0.04
2026-10-08 18:38 UTC 0x3cec62e3… 12,053,990.79 0.005
2026-10-09 18:30 UTC 0xbeefabdc… 24,052,995.31 0.01
2026-10-10 18:27 UTC 0x8ce8e857… 23,979,958.56 0.01
2026-10-11 18:30 UTC 0x82d01172… 23,907,253.97 0.01
2026-10-12 18:46 UTC 0x9afdc96e… 23,834,879.52 0.01
2026-10-13 18:41 UTC 0xc94de373… 23,762,833.23 0.01
2026-10-14 18:32 UTC 0x172349c6… 23,691,113.11 0.01
2026-10-17 02:00 UTC 0xc999000f… 23,669,235.47 0.01
2026-10-17 13:29 UTC 0x6ec66780… 23,597,938.35 0.01
2026-10-18 13:28 UTC 0x05a9acf8… 23,506,585.16 0.01
2026-10-19 09:28 UTC 0xd5210869… 23,545,510.42 0.01
2026-10-20 13:29 UTC 0xe9ea4a16… 23,439,984.33 0.01

Non-buyback inflow: 0x50fd50af…. This is a direct transfer() of 10,000,000 FLAPJAX sent by 0x2ea90ff709b0fb5decd1de944f644eecdc26d33a, which still holds 1,175,621,343 (2.65%). This is what makes the statement a mismatch. It may well be an innocent top-up from a team wallet, but it is not a buyback.

Receipt Relay payouts 10-12 to 10-17: who still holds

53 wallets were paid 85,530,000 FLAPJAX in total. 47 still hold everything. The 6 that do not:

Wallet Received in window Balance now Sent out since first payout
0x8c062dc5d775b7d5efc168f75a875f392f53dcdf 27,780,000 19,808,776.73 29,930,000 → 0xca93ec68…
0xd1cada310f73455a2b119fa49aa8b682bfff9f7d 21,300,000 0.00 21,300,000 → 0xca93ec68…
0xc3b4f10bc4c4a64676b398ebbe23b29440dca40c 5,000,000 0.00 6,000,000 → 0xc590175e…
0x1cecdfbb8507800e34e07dd4723abdf8ea07c747 5,000,000 0.00 5,250,000 → 0x5be10189…, 0xa43b369a…
0x781eb433ff788705080254c6f510df16d37b0c44 1,750,000 0.00 1,750,000 → 0xca93ec68…
0x8d9dcf62c004ed31854b11db2a69fe3195abd233 100,000 0.00 100,000 → 0x11111605…

Four of the six sold into the FLAPJAX/WBNB pool. 0x8c06…dcdf received 27.78M in the window and sold 29.93M to the pool in one tx.

Limitations

  • Snapshot at a single block. Balances change after it.
  • I did not pull logs for blocks ~47.28M → 108.8M (rate limits). The exact supply reconciliation shows no holder is missing, but a few historical-only addresses may not appear in my set of 600 addresses. They do not affect any figure above.
  • The "contract" label comes from bytecode presence. 0x238a…e6c4 is not a pool and I have not identified its contract.
  • "Payout" is identified as any treasury → non-pool transfer. I did not match each one to a Colony receipt post.
  • Dates are UTC.

Reproduction scripts: q33_fetch.py / q33_bal.py / q33_extra.py / q33_final.py (plain JSON-RPC, public node).

Top comments (0)