Transparency · on-chain

Smart Contract Security Review

A transparent review of the contracts behind the FlyANGT Private Round and Vesting: automated static analysis, a manual code review, and a complete disclosure of what the team can and cannot do.

What this is — and isn't. This is an internal review plus automated analysis, published for transparency. It is not a substitute for an independent third-party audit, which is planned separately. Everything below is verifiable on-chain — read the code yourself on Polygonscan.
Last reviewed: 24 August 2026 · Network: Polygon (chainId 137) · Tools: Slither static analysis + manual review
Confirmed vulnerabilities in FlyANGT code
0
Critical
0
High
0
Medium
1
Design note
4
Low / info

Full transparency. Slither's raw output lists 1 high and 9 medium flags. Every single one is inside the embedded Uniswap v3-core FullMath library (a well-known Slither false positive on that audited code — the ^ and divide-before-multiply are intentional) or the deliberate single-field read of the pool's slot0(). None are vulnerabilities in FlyANGT logic. Don't take our word for it — reproduce it in a minute:

pip install slither-analyzer solc-select
solc-select install 0.8.20 && solc-select use 0.8.20
npm i @openzeppelin/contracts@5
slither contracts/ --solc-remaps @openzeppelin=node_modules/@openzeppelin

Contracts in scope

OtcSale
Records private-round purchases, forwards stablecoin to treasury
0xE2dAc349…cA63Bc
OtcTerms
Public, on-chain discount schedule
0xaF24eA73…35A0b3
Vesting
Multi-cohort daily linear unlock over 1080 days
0xaDb78D28…e99A73
ANGT Token
ERC-20 utility token (Polygon)
0x77313129…19306f
Treasury (Safe)
Multisig that receives funds and delivers allocations
0xBBC7Ee82…52490A

Method

  • Automated: Slither static analyzer across all sale-side contracts (16 units, 102 detectors). Result: 0 high, 0 medium. Remaining hits are informational, OpenZeppelin-library noise, or false positives on the audited Uniswap FullMath library.
  • Manual: line-by-line review of access control, reentrancy, fund flow, price logic, arithmetic and admin powers. No reentrancy, no arbitrary transfers, no delegatecall/selfdestruct, no tx.origin.
  • Design: the sale contract holds no funds — stablecoins move buyer → treasury directly — and never delivers ANGT, so it cannot be drained.

Findings

Design F-1 Spot-price oracle can be nudged on a thin pool

The sale reads the live spot price from a single Uniswap V3 pool (slot0). On a thin pool this can move within a block. Impact is contained: OtcSale never delivers tokens — it only records the amount owed, and ANGT is delivered manually from the Safe, which sanity-checks each amount before allocating. Recommendation: add a TWAP or a min/max price bound for defence-in-depth.

Disclosed · mitigated by manual delivery
Low F-2 6-decimal stablecoin assumption

USD size is computed as amount / 1e6, which assumes 6-decimal stablecoins. Only USDT and USDC (both 6-decimal) are accepted today. Recommendation: validate token decimals when adding a stablecoin.

Accepted · only 6-dec stables enabled
Low F-3 Some event address parameters not indexed

TreasuryUpdated / TermsUpdated / StableSet emit addresses that are not indexed, making off-chain filtering slightly harder. No security impact.

Noted for next revision
Low F-4 Compiler pragma ^0.8.20

0.8.20 carries minor known issues. Recommendation: pin to a fixed, newer patch (>=0.8.24).

Noted for next revision
Info F-5 Uniswap FullMath static-analysis flags

Slither flags 'incorrect exponentiation' and 'divide-before-multiply' inside mulDiv(). These are false positives: the code is the canonical, audited Uniswap v3-core FullMath library, where those operations are intentional.

False positive · matches audited Uniswap code

Admin powers — full disclosure

Instead of asking you to trust a claim, here is exactly what the team (a Safe multisig) can and cannot do on-chain. The most important guarantee: the vesting duration is a fixed constant and cannot be shortened or changed.

OtcSale owner (Safe)
CANPause/unpause sales · set treasury · set terms contract · enable/disable stablecoins · set min ticket & round cap
CANNOTHold or move buyer funds (they go buyer → treasury directly) · mint or deliver ANGT
OtcTerms owner (Safe)
CANUpdate the discount tiers (setTiers)
CANNOTSet a discount above 100%
Vesting owner (Safe)
CANStart vesting · add investor cohorts · fund the contract · sweep tokens after a fixed on-chain delay (ADMIN_WITHDRAW_DELAY)
CANNOTChange the unlock duration — DURATION_DAYS is a fixed constant (1080)
Open item we disclose honestly: the Vesting contract exposes an owner sweep guarded by an on-chain time-delay (ADMIN_WITHDRAW_DELAY). The full Vesting source is being verified on Polygonscan so anyone can confirm this sweep can only recover un-allocated surplus and never touches investors' allocated tokens.

Toward an independent audit

This internal review is a floor, not a ceiling. The contracts are small, which makes an independent audit fast and affordable. Our path: (1) verify all source on Polygonscan, (2) publish this review, (3) apply the low-severity fixes above, (4) commission an independent audit and publish the report here with its link.

Read every line yourself: OtcSale ↗OtcTerms ↗Vesting ↗

Informational only. Not investment advice. Digital assets carry risk, including total loss. On-chain source is the ultimate reference; where this page and the deployed code differ, the code governs.