TON Smart Contract Security Scanner

Detect security flaws in TON smart contracts written in FunC and Tact.

56|9|Updated Jan 25, 2026
One-click install
npx skills add https://github.com/0x-Shashi/WEB3-AUDIT-SKILLS --skill ton-smart-contract-security-scanner
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: TON Smart Contract Security Scanner
Source: https://github.com/0x-Shashi/WEB3-AUDIT-SKILLS/tree/main/skills/ton-scanner
Command: npx skills add https://github.com/0x-Shashi/WEB3-AUDIT-SKILLS --skill ton-smart-contract-security-scanner

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

TON security auditing for TON smart contracts is complex due to asynchronous message flows and actor-model semantics. This Skill provides a structured approach to detect and remediate vulnerabilities unique to TON, including bounce handling, replay protection, gas accounting, and storage costs.

Core Features & Use Cases

  • TON Contract Analysis: detect critical issues like missing bounce handling, replay attacks, and unbounded storage growth across FunC and Tact contracts.
  • Audit Workflows & Patterns: reference TON audit workflow and vulnerability patterns to guide end-to-end security reviews for DeFi, jettons, and NFT contracts on TON.
  • Findings & Remediation: produce actionable security findings with concrete fixes and safe defaults for TON protocols.

Quick Start

Use TON Scanner to start a TON contract audit by loading a sample contract and running the TON patterns.

Frequently Asked Questions about TON Smart Contract Security Scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit TON smart contracts for asynchronous message flow vulnerabilities?

To audit TON smart contracts for asynchronous message flow vulnerabilities, you need to detect missing bounce handling, replay attacks, and gas accounting issues across FunC and Tact code. The scanner provides structured workflows and vulnerability patterns to guide end-to-end security reviews for actor-model semantics.

What security issues should I look for in FunC and Tact contracts?

Critical security issues to look for in FunC and Tact contracts include missing bounce handling, replay protection failures, unbounded storage growth, and improper gas accounting. Analyzing message flows and serialization helps identify these vulnerabilities unique to TON.

Can I use this scanner to review DeFi, jetton, and NFT protocols on TON?

Yes, you can use this scanner to review DeFi, jetton, and NFT protocols on TON. It detects vulnerabilities like replay protection failures and unbounded storage growth, producing actionable findings with concrete fixes and safe defaults tailored for these contract types.

How do I start a TON contract security audit?

To start a TON contract security audit, load a sample contract and run the TON vulnerability patterns. The scanner applies structured audit workflows to detect critical flaws in message flows, gas accounting, and serialization, guiding an end-to-end security review.

Why does my TON smart contract fail on bounce handling and storage costs?

Your TON smart contract fails on bounce handling and storage costs due to unhandled asynchronous message returns and unbounded storage growth. The scanner identifies these actor-model flaws and provides actionable remediation with concrete fixes and safe defaults.

Does this scanner support both FunC and Tact programming languages?

Yes, this scanner supports both FunC and Tact programming languages. It comprehensively detects critical vulnerabilities like missing bounce handling, replay protection, and unbounded storage growth across message flows, gas accounting, and serialization in both languages.