AlgoFlow — Smart Contracts

Production Algorand smart contracts behind AlgoFlow, a suite of Web3 tools live on Algorand MainNet. Written in Algorand Python (Puya) and fully ARC-4 / ARC-56 compliant. There is no backend — every action is a real, signed on-chain transaction.

The source here is the exact code behind the apps running on MainNet today. The App IDs below are real — verify them on any Algorand explorer.

Deployed on MainNet

Contract	What it does	App ID	Address
PNET LaunchPad	Bonding-curve token launchpad; auto-graduates to a Tinyman v2 pool at 50 ALGO raised	3609729732	IBCRH6VX…SSUT6GY
AlgoPool (v2)	Permissionless weekly prize draw; winner chosen by Algorand block VRF	3609625951	VB3HH2JY…MAQ6NAY
ProfitLock	Non-custodial time-lock vaults (30 / 90 / 180 / 365 days)	3609696590	KNNIQV2C…WGABYZQ

Fee-discount token: $PNET — ASA 3169177585.

Why this is worth a read

• Admin authority is explicitly bounded. No contract lets the admin touch user principal or the prize pool. AlgoPool v2 is hardened so that a fully compromised admin still cannot change who wins or how much they win.
• Trustless randomness. Winner selection reads the Algorand block VRF seed (Block.blk_seed) committed before entries close — verifiable by anyone on any node.
• Reproducible & verifiable. Compiled TEAL + ARC-56 ABI for each contract is checked in under contracts/artifacts/, so you can diff the deployed program against this source (see Verify the deployment).

Contracts in detail

PNET LaunchPad — contracts/launchpad/contract.py

A bonding-curve launchpad gated by the $PNET token.

• Closed-form pricing. price(t) = 50 + t / 5000 µALGO per token. The exact token amount for a given ALGO input is solved with the quadratic formula using the AVM sqrt opcode — which floors, so the curve always slightly under-fills and never over-pays.
• Split. 50% of supply seeds the curve, 50% is reserved for the creator (claimable after opt-in).
• Tiered launch fees by $PNET balance: Diamond 2 / Gold 3 / Silver 4 / none 5 ALGO.
• Graduation. At 50 ALGO raised, graduate() releases the raised ALGO + remaining tokens to bootstrap a Tinyman v2 pool.
• Storage. Per-token state in a BoxMap keyed by asset ID (documented 81-byte ARC-4 struct).
• Guards. Receiver / close_remainder_to / rekey_to / fee checks on every payment; explicit slippage bounds (min_tokens, min_algo).

AlgoPool v2 — contracts/algo_pool_v2/contract.py

A red-team–hardened weekly prize draw.

• The prize pool is untouchable by admin — it only exits via the VRF-selected pay_winner().
• Two-phase, permissionless settlement: announce_draw() commits a future block → compute_winner() reads the block VRF seed and stores the winner index → pay_winner() pays out. Anyone can drive every step.
• Rules lock once any entry exists. Entry amount, fee split, and all timing parameters can only change between weeks (entry_count == 0), so a mid-week admin compromise cannot alter the game.
• Fees auto-route per entry (LP + platform via inner transactions) — nothing accumulates under admin control.
• Paginated cleanup() (≤ 50 boxes/call) reclaims box MBR after each draw.
• Two-step admin transfer (transfer_admin → accept_admin) to prevent fat-finger lockout.

ProfitLock — contracts/profit_lock/contract.py

Non-custodial time-lock vaults.

• Lock ALGO or any ASA (e.g. $PNET) for 30 / 90 / 180 / 365 days; principal is returned at maturity.
• Only the depositor can unlock — there is no admin bypass on individual vaults.
• set_paused() blocks new deposits but never blocks unlocks — user funds are always retrievable.
• Reentrancy guard: the vault is marked claimed before the inner transfer; the box is deleted on unlock to reclaim MBR.
• ARC-28 events (VaultCreated, VaultUnlocked) for indexer subscriptions.

Security model (cross-cutting)

• ✅ close_remainder_to / asset_close_to pinned to zero on every user deposit
• ✅ rekey_to pinned to zero on every user transaction
• ✅ Inner-transaction fees set to 0 (fee-pooled by the outer transaction)
• ✅ Admin powers explicitly enumerated and bounded — never over user funds
• ✅ Randomness from the Algorand block VRF, committed before entries close
• ✅ ARC-4 ABI method signatures; ARC-28 event logs on all state changes
• ✅ Box minimum-balance reclaimed on unlock / weekly reset

Responsible disclosure is welcome — see SECURITY.md.

Repository layout

contracts/
  launchpad/        PNET LaunchPad — contract, deploy, graduation bot, MBR funding
  algo_pool_v2/     AlgoPool v2    — contract, deploy, settlement cron bot
  profit_lock/      ProfitLock     — contract, deploy, ASA opt-in helper
  artifacts/        Compiled TEAL + ARC-56 JSON (ABI + bytecode) per contract
  tests/            algopy-testing unit tests
pyproject.toml      Poetry + pytest configuration
compile_contracts.ps1

Build from source

Requires Python 3.12+.

python -m venv .venv
.venv\Scripts\pip install algorand-python==3.5.0 puyapy

# Compile everything to contracts/artifacts/<name>/
./compile_contracts.ps1

# …or one contract at a time:
.venv\Scripts\puyapy contracts/profit_lock/contract.py --out-dir contracts/artifacts/profit_lock

Verify the deployment matches this source

Algorand stores each app's approval program on-chain, so you can confirm a deployed contract runs this code:

1. Compile locally (above) to get contracts/artifacts/<name>/<Name>.approval.teal.
2. Fetch the on-chain program and disassemble it:

   curl -s https://mainnet-api.algonode.cloud/v2/applications/3609696590 \
     | jq -r '.params["approval-program"]' | base64 -d > onchain.bytes

3. Compare the disassembled on-chain logic to the local TEAL. The ARC-56 JSON in artifacts/ also embeds the exact deployed bytecode for a direct check.

Test

.venv\Scripts\pip install algorand-python-testing pytest
pytest contracts/tests -v

Coverage (honest): ProfitLock ships a full unit suite using algorand-python-testing — lifecycle, owner-only unlock, double-unlock guard, and the pause-never-blocks-unlock invariant. AlgoPool and LaunchPad are validated on TestNet and in live MainNet usage; their unit suites are being expanded.

Deploy

Per-contract scripts live in each folder. Provide the deployer mnemonic via an environment variable — never commit a mnemonic:

$env:DEPLOYER_MNEMONIC = "your 25 words"
.venv\Scripts\python contracts\profit_lock\deploy.py mainnet

License

MIT — see LICENSE.

---

Part of AlgoFlow by TestedProfit · $PNET on Vestige