ton-vulnerability-scanner
Scans TON smart contracts for 3 critical vulnerabilities: integer-as-boolean misuse, fake Jetton contracts, and unsafe gas forwarding.
- Detects FunC contracts via file extensions (
.fc,.func) and TON project structure (Blueprint, toncli configs) - Identifies three vulnerability patterns: missing sender validation in Jetton handlers, incorrect boolean logic using positive integers instead of -1/0, and forward TON amounts without gas checks
- Provides detailed findings with vulnerable code snippets, attack scenarios, proof-of-concept examples, and recommended fixes
- Includes testing strategies with unit and integration test templates for validating boolean operations, rejecting fake Jetton transfers, and verifying gas constraints
TON Vulnerability Scanner
1. Purpose
Systematically scan TON blockchain smart contracts written in FunC for platform-specific security vulnerabilities related to boolean logic, Jetton token handling, and gas management. This skill encodes 3 critical vulnerability patterns unique to TON's architecture.
2. When to Use This Skill
- Auditing TON smart contracts (FunC language)
- Reviewing Jetton token implementations
- Validating token transfer notification handlers
- Pre-launch security assessment of TON dApps
- Reviewing gas forwarding logic
- Assessing boolean condition handling
3. Platform Detection
File Extensions & Indicators
- FunC files:
.fc,.func
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.2Ksemgrep
>-
3.8Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.8Kcodeql
>-
3.6Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.5Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.4K