ton-vulnerability-scanner

Scans FunC smart contracts for integer-as-boolean misuse, fake Jetton exploits, and gas management flaws.

Updated Nov 23, 2025
One-click install
npx skills add https://github.com/manuelbrandner85/Weltenbibliothekapp --skill ton-vulnerability-scanner-manuelbrandner85
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ton-vulnerability-scanner
Source: https://github.com/manuelbrandner85/Weltenbibliothekapp/tree/main/.agents/skills/ton-vulnerability-scanner
Command: npx skills add https://github.com/manuelbrandner85/Weltenbibliothekapp --skill ton-vulnerability-scanner-manuelbrandner85

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill addresses the high-risk security landscape of the TON blockchain by automating the detection of common, critical vulnerabilities in FunC smart contracts that could lead to asset loss or contract drainage.

Core Features & Use Cases

  • Vulnerability Detection: Scans for integer-as-boolean logic errors, fake Jetton contract exploits, and improper gas forwarding.
  • Remediation Guidance: Provides specific code-level fixes and security patterns to harden contract logic.
  • Use Case: Before deploying a new Jetton-based dApp, use this skill to verify that your transfer notification handlers are properly validating sender addresses to prevent unauthorized token minting.

Quick Start

Run the ton-vulnerability-scanner on the contracts directory to identify potential security flaws in your FunC source code.

Frequently Asked Questions about ton-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit TON smart contracts written in FunC for security vulnerabilities?

To audit TON smart contracts written in FunC, scan the source files to identify critical vulnerabilities like integer-as-boolean misuse and fake Jetton contract exploits. The scanner validates message handling logic against established security patterns to prevent asset loss.

What security flaws should I look for in a TON Jetton dApp before launch?

Before launching a TON Jetton dApp, check transfer notification handlers for improper sender address validation to prevent unauthorized token minting. Also scan for fake Jetton contract exploits and improper gas forwarding management.

How does static analysis detect fake Jetton contract exploits in TON blockchain?

Static analysis detects fake Jetton contract exploits in TON blockchain by validating message handling logic against established security patterns in FunC source files. It flags improper sender validation that could lead to unauthorized token minting.

Can I use automated scanning for ongoing maintenance of TON dApps?

Yes, you can use automated scanning for ongoing maintenance of TON dApps. The scanner applies to both pre-launch security audits and continuous maintenance by analyzing FunC source files to detect emerging vulnerabilities like improper gas management.

Does this vulnerability scanner provide code-level fixes for FunC contracts?

Yes, the vulnerability scanner provides specific code-level fixes and security patterns to harden FunC contract logic. It offers remediation guidance alongside detecting vulnerabilities like integer-as-boolean misuse and improper gas forwarding.