Smart Contract Security Review
A transparent review of the contracts behind the FlyANGT Private Round and Vesting: automated static analysis, a manual code review, and a complete disclosure of what the team can and cannot do.
Full transparency. Slither's raw output lists 1 high and 9 medium flags. Every single one
is inside the embedded Uniswap v3-core FullMath library (a well-known Slither false positive on
that audited code — the ^ and divide-before-multiply are intentional) or the deliberate single-field
read of the pool's slot0(). None are vulnerabilities in FlyANGT logic. Don't take our word for it —
reproduce it in a minute:
pip install slither-analyzer solc-select
solc-select install 0.8.20 && solc-select use 0.8.20
npm i @openzeppelin/contracts@5
slither contracts/ --solc-remaps @openzeppelin=node_modules/@openzeppelinContracts in scope
Method
- Automated: Slither static analyzer across all sale-side contracts (16 units, 102 detectors). Result: 0 high, 0 medium. Remaining hits are informational, OpenZeppelin-library noise, or false positives on the audited Uniswap FullMath library.
- Manual: line-by-line review of access control, reentrancy, fund flow, price logic, arithmetic and admin powers. No reentrancy, no arbitrary transfers, no delegatecall/selfdestruct, no tx.origin.
- Design: the sale contract holds no funds — stablecoins move buyer → treasury directly — and never delivers ANGT, so it cannot be drained.
Findings
The sale reads the live spot price from a single Uniswap V3 pool (slot0). On a thin pool this can move within a block. Impact is contained: OtcSale never delivers tokens — it only records the amount owed, and ANGT is delivered manually from the Safe, which sanity-checks each amount before allocating. Recommendation: add a TWAP or a min/max price bound for defence-in-depth.
USD size is computed as amount / 1e6, which assumes 6-decimal stablecoins. Only USDT and USDC (both 6-decimal) are accepted today. Recommendation: validate token decimals when adding a stablecoin.
TreasuryUpdated / TermsUpdated / StableSet emit addresses that are not indexed, making off-chain filtering slightly harder. No security impact.
0.8.20 carries minor known issues. Recommendation: pin to a fixed, newer patch (>=0.8.24).
Slither flags 'incorrect exponentiation' and 'divide-before-multiply' inside mulDiv(). These are false positives: the code is the canonical, audited Uniswap v3-core FullMath library, where those operations are intentional.
Admin powers — full disclosure
Instead of asking you to trust a claim, here is exactly what the team (a Safe multisig) can and cannot do on-chain. The most important guarantee: the vesting duration is a fixed constant and cannot be shortened or changed.
ADMIN_WITHDRAW_DELAY). The full Vesting source is being verified on Polygonscan so anyone
can confirm this sweep can only recover un-allocated surplus and never touches investors' allocated tokens.Toward an independent audit
This internal review is a floor, not a ceiling. The contracts are small, which makes an independent audit fast and affordable. Our path: (1) verify all source on Polygonscan, (2) publish this review, (3) apply the low-severity fixes above, (4) commission an independent audit and publish the report here with its link.
Informational only. Not investment advice. Digital assets carry risk, including total loss. On-chain source is the ultimate reference; where this page and the deployed code differ, the code governs.