awesome-ton-security

A curated list of awesome Ton security resources, continuously updated.

Articles and Blogs

• Secure Smart Contract Programming in Tact: Popular Mistakes in the TON Ecosystem
• Discovers Critical Vulnerability in TON VM Root Cause and Mitigation Explained
• TACT FOR TON, UNCOVERING THIS LANGUAGE FEATURES AND SECURITY BEST PRACTICES
• Secure Smart Contract Programming in FunC: Top 10 Tips for TON Developers
• Secure Smart Contract Programming
• Things to Focus on while Working with TON Blockchain
• Random number generation
• Generation of block random seed
• TON Connect for Security TON Connect
• TON Blockchain Security Analysis and Potential Risk Assessment
• How does the False Top-up attack break through the defense of the exchange?
• Security risk analysis of FunC language in TON blockchain smart contracts
• Patch Thursday — Identifying Vulnerabilities in TON: Killing All Nodes
• TON Validator Nodes Maintenance and Security Guide
• Risk Analysis of Origin Forgery in the TonConnect SDK
• Introduction to TON: Accounts, Tokens, Transactions, and Security
• TON Ecosystem Phishing Prevention Guide
• How to conduct a comprehensive security audit for projects built on TON?
• TON Ecosystem Panorama and Security Report 2024
• Checklist for Auditing TON Smart Contracts
• Toncoin Smart Contract Security Best Practices
• Beosin 硬核研究 | 从风险到防护：TON 智能合约的安全隐患与优化建议
• TON Ecosystem Security Guide: What are the common forms of fishing?
• TON Security Risks: A Static Analysis Perspective
• BitsLab’s TonBit, Once Again Discovers a Vulnerability in the TON Virtual Machine: RUNVM
• TON Security Primer: Part 1
• Security audit of smart contracts in TON: key mistakes and tips
• Secure Contract Development in TON: Top 9 Pitfalls in Tact & FunC
• From Paradigm Shift to Audit Rift: Exploring Vulnerabilities and Audit Tips for TON Smart Contracts

CTF

• TON Hack Challenge
  • Code
  • Writeup
• Tonbit ctf
  • Tonbit ctf
  • Writeup1
  • Writeup2
  • Writeup3
  • Writeup4
• Hack the Ton
  • Hack the Ton
• PositiveCTF
  • PositiveCTF
  • GitHub Edition

Audit Report

• TonBit
• Certik
• HipoFinance
• Nowarp
• Aqua Protocol
• Aqua Protocol

Hack Event

• https://x.com/TonUP_io/status/1793006027413258631
• https://community.tonup.io/t/incident-report-of-tonup-decimal-discrepancy-of-the-deprecated-up-token/504
• https://x.com/MetaTrustAlert/status/1769956360135844284
• https://x.com/realScamSniffer/status/1788749945459318868
• https://x.com/DegenonTON/status/1779729261001326882
• https://x.com/DegenonTON/status/1783738312966189355
• https://x.com/tonfish_tg/status/1753829630644273215
• https://x.com/_yeminiz/status/1788131616943943874

Tools

• Misti – A static program analyzer for smart contracts on the TON Blockchain.
• Nowarp Scanner – A mass-scan solution for TON smart contracts that demonstrates tooling capabilities and promotes Tact best practices.
• TON Symbolic Analyzer - A static analysis tool that uses symbolic execution to perform automated security verification for TON smart contracts.
• tolk-less – A small Tolk compiler fuzzer focused on arithmetic miscompilations
• Universalmutator - A mutation testing utility for TON smart contracts written in Tolk, FunC and Tact, with support for custom mutation rules. Helps evaluate test robustness and identify weaknesses in test coverage.

Skills

• Trail of Bits: ton-vulnerability-scanner
• elsvv/ton-best-practices-skill
• espritoxyz/ton-ai-audit-skill
• sanbir/ton-auditor-skills

Bug Bounty

• TON security bug bounty
• STON.fi
• Tonstakers
• Ton Whales
• TON Diamonds Web
• Telegram Apps Center
• STON.fi DEX Smart Contracts v2

Auditors

• TON Talent Directory
  • Agencies – small companies and teams in the ecosystem, including auditors
  • Auditors – established security firms
• ton.app: Smart Contract Audit – moderated, community-driven auditors list