ton-vulnerability-scanner

The TON Vulnerability Scanner is a specialized tool designed to analyze smart contracts on The Open Network (TON), specifically those written in the FunC language. Its primary goal is to detect three critical vulnerability types that are prevalent in TON's architecture: misuse of integers as boolean values, fake or malicious Jetton contracts, and improper forwarding of TON tokens without adequate gas checks. By identifying these vulnerabilities early, the scanner helps developers and auditors mitigate potential security risks before contracts are deployed or integrated into decentralized applications.

This skill operates by systematically scanning the codebase for FunC and Tact contract files, analyzing each for the defined vulnerability patterns, and generating detailed reports. Each finding includes references to the specific file and line number, the detected pattern, its severity, and recommended fixes. The scanner also performs additional checks such as replay protection validation and sender authentication. It supports typical TON project structures, including FunC contract files, TypeScript wrappers, test files, and configuration files, and integrates with tools like TON Blueprint, toncli, and ton-compiler.

Ideal use cases include pre-launch security audits of TON dApps, review of Jetton token implementations, validation of boolean logic in contract code, and assessment of gas management in token transfers. The target users are blockchain security auditors, smart contract developers, and project teams responsible for maintaining the integrity and safety of TON-based applications. By automating the detection of platform-specific vulnerabilities, the skill streamlines the auditing process and enhances contract reliability and trustworthiness.