skills.rest
TECH-HY
TECH-HYOFFICIAL
Explore all skills by this author →
GitHub

ton-vulnerability-scanner

Scans TON FunC smart contracts for boolean logic, Jetton validation, and gas handling vulnerabilities.

Updated Mar 22, 2026
Search Tags:#security audit#blockchain#smart contract#vulnerability scanning#ton#jetton#func
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill ton-vulnerability-scanner-tech-hy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ton-vulnerability-scanner
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/ton-vulnerability-scanner
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill ton-vulnerability-scanner-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Auditing TON blockchain smart contracts written in FunC requires deep knowledge of platform-specific pitfalls like integer-as-boolean misuse, fake Jetton transfer notifications, and unvalidated forward TON amounts. This Skill systematically detects these three critical vulnerability patterns so auditors and developers catch them before deployment. ## Core Features & Use Cases - Boolean Logic Analysis: Detects positive integers used as booleans in FunC, where the bitwise NOT operator ~ produces unexpected truthy results (e.g., ~1 = -2). - Fake Jetton Detection: Identifies transfer_notification handlers that fail to validate the sender against the stored Jetton wallet address, preventing unauthorized token crediting. - Gas & Forward Amount Review: Flags user-controlled forward_ton_amount values that lack msg_value validation, which can drain contract balances. - Use Case: Before launching a TON staking dApp, run this Skill against your contracts/*.fc files to receive a severity-ranked report with vulnerable code snippets, attack scenarios, and secure mitigation patterns. ## Quick Start Scan the FunC contracts in this repository for TON-specific vulnerabilities and report any findings with severity and fixes.

Frequently Asked Questions about ton-vulnerability-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit TON smart contracts for security vulnerabilities?▼

Scan FunC contract files (.fc, .func) for three critical patterns: positive integers used as booleans, transfer_notification handlers without sender validation, and user-controlled forward_ton_amount without gas checks. Each finding includes severity, vulnerable code, and a secure fix.

What is the fake Jetton contract vulnerability in TON?▼

Any contract can send a transfer_notification message, so handlers that skip sender validation let attackers claim fake token deposits. The fix stores the expected Jetton wallet address and rejects notifications from any other sender using equal_slices comparison.

Why does FunC boolean logic break with positive integers?▼

FunC uses -1 for true and 0 for false, and the bitwise NOT operator ~ on positive integers yields truthy results (~1 = -2). Conditions using ~ on values like 1 therefore always execute, causing logic errors. Use -1 and 0 consistently.

Does this scanner work with Tact contracts or only FunC?▼

The detection patterns target FunC source files (.fc, .func) and FunC-specific idioms like recv_internal, load_coins, and send_raw_message. Tact projects compile to FunC but the documented patterns and code examples are written for FunC review.

How do I prevent forward TON amount attacks in my contract?▼

Prefer fixed or bounded forward amounts defined as constants. If users must specify forward_ton_amount, validate that msg_value covers the transaction fee plus the forward amount before calling send_raw_message, and avoid flag 128 with user-controlled values.

What are the limitations of automated TON contract scanning?▼

TON contracts require thorough manual review beyond pattern matching, especially for message parsing, gas economics, and storage serialization. The scanner covers three documented patterns and recommends unit and integration tests with @ton/sandbox plus testnet deployment before mainnet.

Related Skills

Explore More Software Engineering Skills→
Ayoub-ouederniAyoub-ouederni

ton-vulnerability-scanner

Scans TON FunC smart contracts for boolean logic, fake Jetton, and gas vulnerabilities.

Community
Intermediate
iiammaeiiammae

ton-vulnerability-scanner

Detect critical security vulnerabilities in TON smart contracts.

Community
Advanced
0x-Shashi0x-Shashi
56

TON Smart Contract Security Scanner

Detect security flaws in TON smart contracts written in FunC and Tact.

Community
Advanced
golemcloudgolemcloud
1.5k

moonbit-refactoring

Refactor MoonBit code to shrink public APIs, convert functions to methods, and apply pattern matching.

Official
Intermediate