This page was compiled by Blockworks using publicly available information reviewed consistent with the TTF, possibly together with information supplied directly by the project where provided. Project-supplied information may correct, update, or supplement the public record, and may not be independently verifiable; Blockworks presents it as provided and does not verify or warrant its accuracy. Because this page depends on what has been disclosed, it may be incomplete — certain categories are more likely to include undisclosed items (e.g., non-announced fundraisings or material relationships), and the absence of an entry should not be read as confirmation that none exists.
Provide a concise narrative that clearly states each of (a)–(e) below.
Response
Flow is a layer 1 blockchain built by the team behind CryptoKitties to support high-performance ecosystems of consumer apps and games without giving up decentralization. Dapper Labs announced Flow in September 2019 to address blockchain scalability for consumer applications. Dapper Labs runs consumer products on Flow such as NBA Top Shot.
(Source: Dapper Labs Announces Flow, FLOW Token Distribution Paper 2020, Bitstamp, What is Dapper Labs?)
The Flow Foundation, established in October 2021, took over Flow engineering from Dapper Labs by 2023 and funds ongoing work from the Ecosystem Reserve, which received 400,200,000 FLOW at genesis and whose current balance is not published. A $725 million ecosystem fund announced in May 2022 by a16z, Coatue, Dapper Ventures and others backs developers with investments, FLOW grants and in-kind support. In February 2026 the Foundation set out a token economy plan for 2026 that combines a supply reduction, open-market purchases of FLOW and new market-making partnerships.
(Source: Protocol Autonomy Roadmap, Flow Tokenomics Technical Overview, Flow Launches $725 Million Ecosystem Fund, Flow Foundation, A Commitment to Flow)
Flow is a proof-of-stake network that splits validation work across five node roles, namely Collection, Consensus, Execution, Verification and Access nodes, and the ecosystem counts more than 356 nodes. Nodes stake FLOW and are paid rewards in roughly week-long epochs. Smart contracts are written in the Cadence language, and since June 2022 developers have been able to deploy and upgrade contracts on mainnet without a permission review.
FLOW is the native coin of the Flow protocol and is used for all protocol-level fee payments, rewards and staking transactions. Holders stake or delegate FLOW to secure the network and earn rewards, pay transaction and storage fees, use it as a medium of exchange and as collateral in Flow DeFi, and the governance docs state that staked FLOW will carry voting rights once onchain governance is enabled.
Protocol changes are managed through a multisig approach, and adjustments must be approved and signed by a board of node operators and community representatives. The Flow Foundation still coordinates major upgrades by gathering collector signatures and returning root collections to collector clusters. After the December 2025 exploit, validators granted the Community Governance Council temporary recovery permissions through Height Coordinated Upgrades, and the Council committed to revoke them, with January 13, 2026 reported as the target date. The Council carried out the January 30, 2026 burn after that date, and no public confirmation that they were revoked was located as of 2026-10-05. The published governance design calls for council decisions to be ratified by a public vote weighted by staked FLOW.
(Source: Protocol Autonomy Roadmap, Dec 27 Technical Post-Mortem, Flow Governance Docs, Bitget, Flow Council Recovery Permissions, Flow Token Burn Summary)
For each existing entity: Labs/DevCo (e.g., Founder, CEO, CTO, COO), Foundation (e.g., President, Executive Director, CFO, COO), and DAO / onchain governance leadership (if applicable) list the: (a) full names, (b) official titles, (c) and prior experience of key team members. For any non-existent entity, explicitly mention it does not exist. External links may be included but they will not factor into the score.
Response
Full Name | Entity | Official Title | Prior Experience |
|---|---|---|---|
Roham Gharegozlou | Labs/DevCo | He is CEO of Dapper Labs, the company that created Flow, and he has held the role since the company's launch (Bitstamp, What is Dapper Labs?, Dapper Labs Announces Flow). | He has led Dapper Labs since it was formed in February 2018 out of Axiom Zen, the studio that created CryptoKitties, and he announced Flow as CEO in September 2019 (Dapper Labs Announces Flow, Bitstamp, What is Dapper Labs?). |
Dieter Shirley | Foundation | He serves as Chief System Architect at the Flow Foundation (Bitstamp, What is Dapper Labs?). | He was CTO of Dapper Labs until January 2024 and was the lead developer of the ERC-721 non-fungible token standard (Bitstamp, What is Dapper Labs?). |
Roham Gharegozlou | Foundation | He is a Board Member at the Flow Foundation while also serving as CEO of Dapper Labs (Flow and HTX Confirm Full Protection of User Assets). | He has been CEO of Dapper Labs since its launch and led the company that created CryptoKitties and Flow (Bitstamp, What is Dapper Labs?). |
Flow has no DAO entity or legal wrapper, and onchain governance actions are carried out by a multisig of node operators and community representatives and by the Community Governance Council, whose members are not publicly named (Protocol Autonomy Roadmap, Flow Token Burn Summary). | DAO/Onchain Governance | No individual governance titles are published for the multisig signers or the Community Governance Council members (Flow Governance Docs, Flow Network Governance). | No governance officeholders are named, so there is no prior experience to report. |
Provide a structured description of the DAO's governance, powers, and economic rights. If a DAO does not exist, state so. Address the lettered items below. Even if there is no DAO, there must be an answer to (d).
Response
Flow does not have a DAO as a legal entity, and governance runs through a node-operator multisig, the Community Governance Council and community proposals known as FLIPs. No IP is held by any DAO. The Protocol Autonomy Roadmap places Flow engineering with the Flow Foundation since 2023, and none of the reviewed governance pages assigns code, trademarks or brands to a governance body.
(Source: Protocol Autonomy Roadmap, Flow Network Governance, Flow Governance Docs)
Protocol adjustments are approved and signed through a multisig by a board of node operators and community representatives, and the board members are not published. The service account 0xe467b9dd11fa00df, which holds the FlowToken Administrator and the staking and epoch admin resources, had six active keys of weight 250 against a signing threshold of 1,000 in an onchain read on 2026-10-06, so any four of the six keys can sign, and the holders of those keys are not published. Nodes join the network only when authorized by the service account. During the December 2025 recovery, validators granted the Community Governance Council temporary recovery permissions through Height Coordinated Upgrades, and the Council used them to restrict attacker accounts and to destroy counterfeit FLOW onchain on January 6 and January 30, 2026. The Council committed to revoke these permissions, with January 13, 2026 reported as the target date, and no public confirmation of revocation was located as of 2026-10-05. No standing pause role is disclosed outside a coordinated validator halt.
(Source: Protocol Autonomy Roadmap, Flow Staking Docs, Dec 27 Technical Post-Mortem, Flow Token Burn Summary, Flow Access API, Service Account 0xe467b9dd11fa00df, Bitget, Flow Council Recovery Permissions)
FLOW can be staked by node operators or delegated to a node, and stakers earn rewards each epoch, with delegators keeping 92% of their calculated reward and the node keeping 8%. Unstaked tokens become withdrawable only after an additional epoch. The governance docs state that staking gives voting rights, that votes are weighted by locked tokens and that council decisions must be ratified by a public vote. Once governance is enabled, the governance docs state that stakers will be able to weigh in on protocol upgrades, ecosystem fund management, council selection and Foundation budgets.
(Source: Flow Staking Docs, Flow Governance Docs, Flow Network Governance)
FLOW holders have no right to a share of protocol revenue or to distributions from the Foundation treasury. Stakers and delegators receive rewards equal to about 5% of total supply each year, funded by new issuance and by transaction fees collected in a pool rather than burned. The Foundation reported staking returns of about 9% APY in February 2026. Holders do not control the Ecosystem Reserve, which the Foundation manages.
(Source: Flow Tokenomics Technical Overview, Flow Foundation, A Commitment to Flow)
No DAO legal wrapper exists for Flow, so no party holds authority to dissolve one. The governance docs, the network governance page and the Protocol Autonomy Roadmap set out no wind-down mechanism or dissolution vote threshold.
(Source: Flow Governance Docs, Flow Network Governance, Protocol Autonomy Roadmap)
For the Primary Foundation do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist. Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
Response
The Flow Foundation was established in October 2021 to support the Flow ecosystem, and its own page describes it as a non-profit organization that is not a company nor a traditional non-profit. Its January 30, 2026 release on the exploit remediation was datelined George Town, Cayman Islands. Its registered legal name, entity type and jurisdiction of incorporation are not published on the Foundation page, the Protocol Autonomy Roadmap or the Foundation's 2026 posts. The Flow Wallet terms of service are governed by the laws of the Cayman Islands, but they name the operator only as Flow or Flow Digital and do not identify the Foundation as a party.
(Source: Flow Foundation, Protocol Autonomy Roadmap, Flow Wallet Terms of Service, GlobeNewswire, Final Remediation Update on the Flow Security Incident)
By 2023 Flow engineering moved from Dapper Labs to the Flow Foundation, and the nodes that Dapper and the Foundation had run jointly were operationally separated. The Foundation therefore leads core protocol development, and the core repositories carry its copyright notices. The flow-go node software is licensed under AGPL-3.0 with a notice of copyright 2019-2024 Flow Foundation, the Cadence language is licensed under Apache-2.0 with the same Flow Foundation notice, and the core contracts are released into the public domain under the Unlicense. The Canadian FLOW trademark TMA1346402, registered on September 15, 2025, is held by Dapper Labs Inc. and not by the Foundation. The Foundation discloses no subsidiaries.
(Source: Protocol Autonomy Roadmap, Flow Foundation, GitHub, flow-go NOTICE and License, GitHub, Cadence NOTICE and License, GitHub, flow-core-contracts License, CIPO, FLOW Trademark TMA1346402)
The Foundation manages the Ecosystem Reserve, which received 400,200,000 FLOW at genesis, and under the June 2024 class action settlement Dapper Labs agreed to give up control of its remaining FLOW to the Foundation. On February 23, 2026 the Foundation destroyed 50,343,896.87 FLOW, and it committed to acquire at least 50,000,000 more FLOW from the market. It coordinates major upgrades by gathering collector signatures. Protocol changes pass through a multisig of node operators and community representatives, and no unilateral Foundation power over them is disclosed. Onchain, the service account that holds the FlowToken Administrator and the staking and epoch admin resources required any four of its six keys to sign as of 2026-10-06, and the parties holding those keys are not published.
(Source: Flow Tokenomics Technical Overview, CoinDesk, Dapper Labs Settlement, Flow Foundation, A Commitment to Flow, Protocol Autonomy Roadmap, Flow Access API, Service Account 0xe467b9dd11fa00df)
The Foundation has no disclosed ownership of or contractual control over Dapper Labs. The two entities share leadership, because Dapper Labs CEO Roham Gharegozlou also sits on the Foundation's board, and Foundation Chief System Architect Dieter Shirley was Dapper's CTO until January 2024. This gives each side indirect influence over the other.
(Source: Flow and HTX Confirm Full Protection of User Assets, Bitstamp, What is Dapper Labs?)
The Foundation holds no disclosed exclusive pause, upgrade or executor role. Protocol changes are signed through a multisig of node operators and community representatives and the service account 0xe467b9dd11fa00df that holds the FlowToken Administrator resource required any four of its six keys to sign in an onchain read on 2026-10-06, and the Foundation's documented role in upgrades is to gather collector signatures and distribute root collections. The FlowToken Minter resource is stored in the staking account 0x8624b52f9ddcd04a, which uses the same four-of-six key setup, and the FlowToken contract account 0x1654653399040a61 and the FlowFees account 0xf919ee77447b7497 each carry a single full-weight key. The Foundation does not disclose which of these keys it holds.
(Source: Protocol Autonomy Roadmap, FlowToken Contract Docs, Flow Access API, Service Account 0xe467b9dd11fa00df, Flow Access API, Staking Account 0x8624b52f9ddcd04a, Flow Access API, FlowToken Account 0x1654653399040a61, Flow Access API, FlowFees Account 0xf919ee77447b7497)
The Foundation holds and directs the Ecosystem Reserve, which received 400,200,000 FLOW at genesis, for ecosystem growth, and Dapper Labs agreed under the 2024 settlement to relinquish control of its remaining FLOW to the Foundation. Its open-market purchase commitment of at least 50,000,000 FLOW, announced in February 2026, directs tokens to its treasury. No transaction fee or revenue stream is directed to the Foundation, because fees go to the pool that funds staking rewards.
(Source: Flow Tokenomics Technical Overview, CoinDesk, Dapper Labs Settlement, Flow Foundation, A Commitment to Flow)
For the Primary DevCo do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist. Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
Response
Dapper Labs Inc. is a corporation incorporated in British Columbia, Canada in 2018, with its principal place of business at 600-565 Great Northern Way, Vancouver, according to its SEC Form D filings. It is the corporate entity that funded the development of the Flow technology, and it was formed in February 2018 out of Axiom Zen.
(Source: Dapper Labs Settlement, ClaimDepot, Bitstamp, What is Dapper Labs?, Dapper Labs Announces Flow, Flow Tokenomics Technical Overview, SEC Form D, Dapper Labs Inc., 2021)
Dapper Labs built the original Flow technology and runs consumer products on Flow, including CryptoKitties and NBA Top Shot. Flow engineering passed to the Flow Foundation by 2023, and the core repositories now carry Flow Foundation copyright notices. Dapper Labs Inc. holds the Canadian FLOW trademark TMA1346402, registered on September 15, 2025, and no license of it to the Foundation is published. Dapper Ventures participated in the $725 million Flow ecosystem fund in 2022. The reviewed sources do not describe Dapper Labs' subsidiaries or Dapper Ventures' relationship to it.
(Source: Bitstamp, What is Dapper Labs?, Protocol Autonomy Roadmap, Flow Launches $725 Million Ecosystem Fund, CIPO, FLOW Trademark TMA1346402, GitHub, flow-go NOTICE and License)
Dapper Labs holds no disclosed power over Flow governance, the Ecosystem Reserve or token administration. Its nodes were operationally separated from the Foundation's by 2023, and under a proposed June 2024 class action settlement it agreed to give up control of its remaining FLOW to the Flow Foundation to support the decentralization of the ecosystem.
(Source: Protocol Autonomy Roadmap, CoinDesk, Dapper Labs Settlement)
Dapper Labs has no disclosed ownership of or control over the Flow Foundation. Its CEO Roham Gharegozlou sits on the Foundation's board, which gives Dapper indirect influence through shared leadership, and the two acted together in March 2026 when they jointly asked the Seoul Central District Court to suspend FLOW delistings.
(Source: Flow and HTX Confirm Full Protection of User Assets, Flow Ecosystem March 2026 Update)
Dapper Labs holds no disclosed pause, upgrade or executor authority over the Flow protocol or the FlowToken contract. Protocol changes run through the node-operator multisig, and the Community Governance Council held the temporary recovery permissions granted after the December 2025 exploit, with neither path naming Dapper Labs.
(Source: Protocol Autonomy Roadmap, Dec 27 Technical Post-Mortem)
Dapper Labs received 250,000,000 FLOW, or 20% of the genesis supply, as a long-term treasury, and the 2020 distribution paper required any sales to carry lockups of at least one year from the time of sale. That allocation was fully unlocked by November 2023. Under the 2024 settlement Dapper agreed to give up control of its remaining FLOW to the Foundation. No fee, revenue or reward stream is directed to Dapper Labs.
(Source: Flow Tokenomics Technical Overview, FLOW Token Distribution Paper 2020, FLOW Circulating Supply Updates, CoinDesk, Dapper Labs Settlement)
Disclose launch and initial supply details in a single initial allocation schedule covering the token's launch.
Response
The genesis block created 1,250,000,000 FLOW in 2020. The 2020 distribution paper states that all genesis tokens were fully locked for at least one year and could be used only for staking during that time, so no FLOW was unlocked at launch. Flow's own pages date the genesis block differently, with the token distribution page saying June 2020 and the tokenomics overview saying October 2020.
(Source: FLOW Token Distribution Paper 2020, Flow Token Distribution, Flow Tokenomics Technical Overview)
(Source: Flow Tokenomics Technical Overview, FLOW Token Distribution Paper 2020)
The CoinList community sale ran from September 21 to October 2, 2020 at the same price paid by venture backers, with a cap of 10,000 FLOW per user for $1,000, which works out to $0.10 per FLOW. A separate CoinList auction sold 25,000,000 FLOW and closed at $0.38 per token. No exchange opening price is set out in the Flow or CoinList sources reviewed.
(Source: Flow Raises $18M on CoinList)
FLOW.
(Source: Flow Tokenomics Technical Overview)
FLOW has no fixed supply. About 5% of total supply is issued each year as staking rewards, and transaction fees are pooled to fund those rewards, so no extra FLOW is minted when fees exceed the reward budget, which happens at sustained throughput of about 250 transactions per second. Total supply was 1,469,831,716 FLOW on November 14, 2023, including 219,831,716 FLOW of staking rewards. The Foundation destroyed 50,343,896.87 FLOW on February 23, 2026 and does not publish a newer total supply figure. An onchain read of FlowToken.totalSupply returned 1,693,297,500.52 FLOW at sealed block 166905050 on 2026-10-06. Since the FLIP 370 fee recalibration announced on July 27, 2026, staking rewards are paid from transaction fees first and new FLOW is minted only to cover the shortfall, which Flow estimated cuts issuance by about 171,000 FLOW per month at then-current volume.
(Source: Flow Tokenomics Technical Overview, FLOW Circulating Supply Updates, Flow Foundation, A Commitment to Flow, Flow Access API, FlowToken.totalSupply Script, Flow, Transaction Fees Are Rising and FLOW Issuance Is Falling)
(Source: FLOW Token Distribution Paper 2020, Flow Raises $18M on CoinList, Flow Token Distribution, Flow Tokenomics Technical Overview, FLOW Circulating Supply Updates)
Address each of the following sub-items based on the project's airdrop status. If a sub-item does not apply to the project's situation, state that explicitly.
Response
Planned but not yet executed airdrop
Not applicable. FLOW launched in 2020 through genesis allocations and token sales, and no planned airdrop is announced.
(Source: Flow Token Distribution)
Executed airdrop
Not applicable. The reviewed launch and tokenomics materials record no executed FLOW airdrop.
(Source: Flow Tokenomics Technical Overview)
No airdrop planned or conducted
Flow has not conducted a FLOW airdrop and has not announced one. The genesis supply was distributed to convertible-note backers, CoinList community sale and auction buyers, the development team, Dapper Labs and the Ecosystem Reserve, and later new supply has come only from staking rewards. The 2020 distribution paper, the token distribution page and the tokenomics overview describe no airdrop program.
(Source: FLOW Token Distribution Paper 2020, , )
Projects must disclose all material terms of market-making arrangements that affect token liquidity. If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. For each market maker, include in a table:
If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. If no native tokens were loaned or allocated to market makers, state that explicitly; cash/fiat retainers or fees are not required for this item.
Response
Projects must disclose all material terms of centralized or decentralized exchange listings that affect token liquidity. For each listing, include in a table:
If the project has no agreements or deals with CEX or DEX, state that explicitly; doing so earns full credit; cash/fiat fee amounts are not required for this item.
Response
Disclose all prior token sales by the Project — including fundraising rounds, any material OTC sales to investors, and any discounted market-maker sales. For each sale, provide:
If no prior sales occurred, state that explicitly (e.g., "No prior fundraising, OTC, or discounted MM sales have occurred.").
Response
If any, list prior exploits or incidents that directly affected the token, token supply, tokenholder balances, token contract, minting controls, burn mechanics, or custody of token supply. This question is not asking about general protocol, application, or smart contract exploits unless the incident directly affected the native token itself. If no prior incidents, state this explicitly (e.g., "No exploits affecting tokenholders or protocol funds as of YYYY-MM-DD").
Response
The Cadence counterfeiting exploit ran from 2025-12-26 at block 137363398 until validators halted Flow mainnet early on 2025-12-27 PST. It affected the Cadence runtime v1.8.8 on Flow mainnet and the supply of FLOW and 12 other fungible tokens. On August 31, 2026 a flaw in Ankr's ankrFLOW liquid staking contract let an attacker create about 8.6 million unbacked ankrFLOW and drain about 15.5 million WFLOW, worth about $410,000, from the MORE Markets lending protocol, and Flow stated that this was not an exploit of Flow EVM or the Flow protocol and did not affect FLOW tokenomics. No other exploit affecting FLOW has been publicly reported as of 2026-10-05.
(Source: Dec 27 Technical Post-Mortem, Flow, Statement on the Ankr Liquid Staking Exploit)
The attacker chained three type-confusion flaws in the Cadence runtime. A bypass of import validation for attachments, a bypass of defensive checks using built-in types such as PublicKey, and a static-type mismatch in a contract initializer together let the attacker copy resources that should have been unique. This allowed counterfeit FLOW to be created without touching existing balances.
Describe material risk factors across the three categories below. Each category includes prompts to address at a minimum.
(a) Regulatory, Legal & Tax Risks — Describe how evolving laws and regulations could affect the project by answering, at a minimum, questions like:
Impact of Regulatory Change on TGE and Listings: (If applicable) How could evolving or conflicting laws and regulations affect your ability to complete the TGE, deliver tokens to purchasers, and list or maintain the token on trading venues in key jurisdictions?
Entity-Level Regulatory Impact: (If applicable) How could regulatory or legal changes impact your core entities (Foundation, DevCo, DAO, affiliated service providers), including enforcement actions, licensing requirements, or forced changes to structure or operations?
Tokenholder Tax Treatment: (If applicable) What uncertainties exist around how tokenholders may be taxed, and make clear that tokenholders are responsible for understanding their own tax obligations?
Jurisdictional & User Access Restrictions: (If applicable) If the project restricts access for certain jurisdictions or user types (e.g., U.S. persons, sanctioned countries, retail vs. professional), what are those restrictions and what risks do they create for users and for the project?
(b) Protocol, Technology & Security Risks — Describe risks to network and contract reliability, correctness, and safety by answering, at a minimum, questions like:
Bugs and Design Flaws: (If applicable) What bugs, design flaws, or implementation errors could exist in your core protocol code, smart contracts, and any bridges, rollups, or oracles that you depend on, and how could these lead to loss of funds or disruption of the protocol?
Security Measures & Their Limitations: (If applicable) What security measures have you taken (audits, formal verification, bug bounties), and what types of failures might these measures still fail to detect or prevent?
(c) Token Economics, Unlocks & Incentive Risks — Describe how the token's economic design and supply schedule could affect holders by answering, at a minimum, questions like:
Critical Economic Assumptions: (If applicable) Which economic assumptions (e.g., staking yields, fee revenue, liquidity incentives, MEV capture, demand for blockspace) are critical for protocol security, utility, and governance, and what happens if those assumptions fail?
This Token Transparency Filing is provided for general informational purposes only and does not verify or warrant the accuracy of individual answers.
(Source: Dec 27 Technical Post-Mortem)
The attacker counterfeited 87.96 billion FLOW plus 12 other fungible tokens and bridged about $3.9 million off the network. Flow restricted 1,060 accounts, under 0.01% of all accounts, and the post-mortem states that no existing user balances were accessed or compromised. About 50 million counterfeit FLOW were mixed with valid tokens on DEXes and could not be separated.
Validators halted the network on December 27, 2025, chose an Isolated Recovery Plan over a rollback to a pre-exploit checkpoint, shipped three Cadence patches and used Height Coordinated Upgrades to give the Community Governance Council temporary recovery permissions. OKX, Gate.io and MEXC returned more than 484.4 million counterfeit FLOW. The Council destroyed 484,434,923.21 FLOW on January 6, 2026 and 87,426,151,401.99 FLOW on January 30, 2026. To offset the commingled tokens, the Foundation destroyed 50,343,896.87 FLOW from treasury funds and open-market purchases on February 23, 2026. Flow also expanded its bug bounty and commissioned forensic work by zeroShadow and Find Labs.
(Source: Dec 27 Technical Post-Mortem, Flow Token Burn Summary, Flow Foundation, A Commitment to Flow)
The incident is resolved at the protocol level. The network was restored on December 29, 2025, all seized counterfeit FLOW has been destroyed and monitoring tags were removed by March 2026. Binance and HTX restored full FLOW services. Upbit, Bithumb and Coinone ended FLOW trading on March 16, 2026 after the Seoul Central District Court rejected the injunction sought by the Foundation and Dapper Labs. The Council has committed to revoke its temporary recovery permissions.
(Source: Dec 27 Technical Post-Mortem, Flow Token Burn Summary, Flow Ecosystem March 2026 Update, Phemex, Court Upholds FLOW Delisting)
The technical post-mortem, the token burn summary and the joint Flow and HTX statement are the primary references for this incident.
(Source: Dec 27 Technical Post-Mortem, Flow Token Burn Summary, Flow and HTX Confirm Full Protection of User Assets)
Governance Control over Monetary Policy & Rewards: (If applicable) To what extent can governance change monetary policy, fee parameters, or reward allocations (e.g., inflation rate, treasury flows, incentive programs), and how could such changes adversely affect tokenholders?
Response
Impact of Regulatory Change on TGE and Listings:
FLOW's TGE and all genesis unlocks are complete, so the main exposure is to listings. The 2026 South Korean delistings show that venues can end support after a security event and that courts may defer to them, since the Seoul Central District Court found the exchanges' risk assessments were not obviously wrong. Stricter listing rules for tokens with past exploits, or changes in how regulators classify network tokens, could narrow FLOW's trading venues and liquidity in key markets.
(Source: Flow Ecosystem March 2026 Update, Bitget, Court Rejects Flow Foundation Request, FLOW Circulating Supply Updates)
Entity-Level Regulatory Impact:
Dapper Labs settled Friel v. Dapper Labs, a class action that alleged NBA Top Shot Moments were unregistered securities, for $4 million in 2024, and as part of that settlement agreed to give up control of its remaining FLOW to the Flow Foundation. The Foundation's jurisdiction of incorporation is not published, which makes its regulatory exposure hard to assess. On September 22, 2026 the Rosen Law Firm said it continues to investigate potential securities claims on behalf of FLOW investors over allegations that the Flow Foundation may have issued materially misleading business information, and that it is preparing a class action. New securities, licensing or enforcement action against Dapper Labs or the Foundation could force further changes to how Flow is funded and governed.
(Source: The Block, Dapper Labs Settlement, CoinDesk, Dapper Labs Settlement, Flow Foundation, GlobeNewswire, Rosen Law Firm on FLOW)
Tokenholder Tax Treatment:
Flow publishes no tax guidance for holding, staking or trading FLOW, and the Flow Wallet terms of service contain no tax clause. Staking rewards paid each epoch may be taxed as income on receipt in some jurisdictions and only on disposal in others, and the 2026 token destruction and open-market purchases may raise further questions about cost basis. Tokenholders are responsible for understanding their own tax obligations.
(Source: Flow Wallet Terms of Service, Flow Staking Docs, Flow Foundation, A Commitment to Flow)
Jurisdictional & User Access Restrictions:
The Flow Wallet terms bar Sanctions Targets and Prohibited Users under U.S., UN, UK and EU sanctions lists, require binding individual arbitration with a class action waiver and are governed by Cayman Islands law. These terms make disputes costly for users elsewhere and exclude sanctioned persons. Separately, Upbit, Bithumb and Coinone announced they would end FLOW trading on March 16, 2026, while Korbit continues to support FLOW trading.
(Source: Flow Wallet Terms of Service, Flow Ecosystem March 2026 Update)
Bugs and Design Flaws:
The December 2025 exploit showed that a bug in the Cadence runtime can create counterfeit native tokens at scale, since three chained type-confusion flaws let an attacker duplicate 87.96 billion fake FLOW. Bridges add risk, because about $3.9 million left the network before the halt. Since June 2022 contracts can be deployed and upgraded on mainnet without review, so faulty or malicious application contracts can reach users directly.
(Source: Dec 27 Technical Post-Mortem, Flow Permissionless Deployment)
Security Measures & Their Limitations:
Flow ran a Secure Cadence code-hardening and audit process that concluded in June 2022 and a public bug bounty from May 2022, which it expanded after the 2025 exploit. These measures did not catch the Cadence flaws exploited in December 2025. The response then relied on a validator halt and temporary Council recovery powers, which shows that recovery depends on coordinated action by a small set of operators and no public confirmation that those permissions were revoked was located as of 2026-10-05.
(Source: Flow Permissionless Deployment, Dec 27 Technical Post-Mortem, Bitget, Flow Council Recovery Permissions)
Critical Economic Assumptions:
Network security relies on staking rewards of about 5% of total supply each year, and FLOW turns net deflationary only when fees exceed new issuance at sustained throughput of about 250 transactions per second. If activity stays below that level, issuance keeps diluting non-stakers. All genesis allocations are unlocked, so there is no remaining unlock schedule, and the Ecosystem Reserve is not subject to transfer restrictions. The Foundation's commitment to buy at least 50 million FLOW is not backed by a published schedule.
(Source: Flow Tokenomics Technical Overview, FLOW Circulating Supply Updates, Flow Foundation, A Commitment to Flow)
Governance Control over Monetary Policy & Rewards:
Fee parameters and reward funding are protocol settings changed through the node-operator multisig, and a December 2025 update raised fees so that more validator rewards come from activity rather than issuance. The FLIP 370 recalibration announced on July 27, 2026 raised most transaction fees two to four times, which Flow estimated cuts issuance by about 171,000 FLOW per month at then-current volume. The Foundation can destroy treasury FLOW or buy tokens at its discretion, as it did on February 23, 2026. Future changes to issuance, fees or Ecosystem Reserve spending could reduce staking yields or dilute holders, and holders have no binding veto.
(Source: Flow Foundation, A Commitment to Flow, Protocol Autonomy Roadmap, Flow Tokenomics Technical Overview, Flow, Transaction Fees Are Rising and FLOW Issuance Is Falling)
