[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-ton-vulnerability-scanner":3,"mdc-pitsma-key":41,"related-repo-trail-of-bits-ton-vulnerability-scanner":2751,"related-org-trail-of-bits-ton-vulnerability-scanner":2844},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":36,"sourceUrl":39,"mdContent":40},"ton-vulnerability-scanner","scan TON smart contracts for vulnerabilities","Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20,23,26],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Blockchain","blockchain",{"name":21,"slug":22,"type":16},"Audit","audit",{"name":24,"slug":25,"type":16},"Smart Contracts","smart-contracts",{"name":27,"slug":28,"type":16},"Code Analysis","code-analysis",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-18T05:47:38.757658",null,541,[35],"agent-skills",{"repoUrl":30,"stars":29,"forks":33,"topics":37,"description":38},[35],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Fbuilding-secure-contracts\u002Fskills\u002Fton-vulnerability-scanner","---\nname: ton-vulnerability-scanner\ndescription: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.\n---\n\n# TON Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan TON blockchain smart contracts written in FunC for platform-specific security vulnerabilities related to boolean logic, Jetton token handling, and gas management. This skill encodes 3 critical vulnerability patterns unique to TON's architecture.\n\n## 2. When to Use This Skill\n\n- Auditing TON smart contracts (FunC language)\n- Reviewing Jetton token implementations\n- Validating token transfer notification handlers\n- Pre-launch security assessment of TON dApps\n- Reviewing gas forwarding logic\n- Assessing boolean condition handling\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **FunC files**: `.fc`, `.func`\n\n### Language\u002FFramework Markers\n```func\n;; FunC contract indicators\n#include \"imports\u002Fstdlib.fc\";\n\n() recv_internal(int my_balance, int msg_value, cell in_msg_full, slice in_msg_body) impure {\n    ;; Contract logic\n}\n\n() recv_external(slice in_msg) impure {\n    ;; External message handler\n}\n\n;; Common patterns\nsend_raw_message()\nload_uint(), load_msg_addr(), load_coins()\nbegin_cell(), end_cell(), store_*()\ntransfer_notification operation\nop::transfer, op::transfer_notification\n.store_uint().store_slice().store_coins()\n```\n\n### Project Structure\n- `contracts\u002F*.fc` - FunC contract source\n- `wrappers\u002F*.ts` - TypeScript wrappers\n- `tests\u002F*.spec.ts` - Contract tests\n- `ton.config.ts` or `wasm.config.ts` - TON project config\n\n### Tool Support\n- **TON Blueprint**: Development framework for TON\n- **toncli**: CLI tool for TON contracts\n- **ton-compiler**: FunC compiler\n- Manual review primarily (limited automated tools)\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for FunC\u002FTact contracts\n2. **Analyze each contract** for the 3 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check replay protection** and sender validation\n\n---\n\n## 5. Example Output\n\nWhen vulnerabilities are found, you'll get a report like this:\n\n```\n=== TON VULNERABILITY SCAN RESULTS ===\n\nProject: my-ton-contract\nFiles Scanned: 3 (.fc, .tact)\nVulnerabilities Found: 2\n\n---\n\n[CRITICAL] Missing Replay Protection\nFile: contracts\u002Fwallet.fc:45\nPattern: No sequence number or nonce validation\n\n\n---\n\n## 5. Vulnerability Patterns (3 Patterns)\n\nI check for 3 critical vulnerability patterns unique to TON. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Missing Sender Check** ⚠️ CRITICAL - No sender validation on privileged operations\n2. **Integer Overflow** ⚠️ CRITICAL - Unchecked arithmetic in FunC\n3. **Improper Gas Handling** ⚠️ HIGH - Insufficient gas reservations\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify FunC language (`.fc` or `.func` files)\n2. Check for TON Blueprint or toncli project structure\n3. Locate contract source files\n4. Identify Jetton-related contracts\n\n### Step 2: Boolean Logic Review\n```bash\n# Find boolean-like variables\nrg \"int.*is_|int.*has_|int.*flag|int.*enabled\" contracts\u002F\n\n# Check for positive integers used as booleans\nrg \"= 1;|return 1;\" contracts\u002F | grep -E \"is_|has_|flag|enabled|valid\"\n\n# Look for NOT operations on boolean-like values\nrg \"~.*\\(|~ \" contracts\u002F\n```\n\nFor each boolean:\n- [ ] Uses -1 for true, 0 for false\n- [ ] NOT using 1 or other positive integers\n- [ ] Logic operations work correctly\n\n### Step 3: Jetton Handler Analysis\n```bash\n# Find transfer_notification handlers\nrg \"transfer_notification|op::transfer_notification\" contracts\u002F\n```\n\nFor each Jetton handler:\n- [ ] Validates sender address\n- [ ] Sender checked against stored Jetton wallet address\n- [ ] Cannot trust forward_payload without sender validation\n- [ ] Has admin function to set Jetton wallet address\n\n### Step 4: Gas\u002FForward Amount Review\n```bash\n# Find forward amount usage\nrg \"forward_ton_amount|forward_amount\" contracts\u002F\nrg \"load_coins\\(\\)\" contracts\u002F\n\n# Find send_raw_message calls\nrg \"send_raw_message\" contracts\u002F\n```\n\nFor each outgoing message:\n- [ ] Forward amounts are fixed\u002Fbounded\n- [ ] OR user-provided amounts validated against msg_value\n- [ ] Cannot drain contract balance\n- [ ] Appropriate send_raw_message flags used\n\n### Step 5: Manual Review\nTON contracts require thorough manual review:\n- Boolean logic with `~`, `&`, `|` operators\n- Message parsing and validation\n- Gas economics and fee calculations\n- Storage operations and data serialization\n\n---\n\n## 6. Reporting Format\n\n### Finding Template\n```markdown\n## [CRITICAL] Fake Jetton Contract - Missing Sender Validation\n\n**Location**: `contracts\u002Fstaking.fc:85-95` (recv_internal, transfer_notification handler)\n\n**Description**:\nThe `transfer_notification` operation handler does not validate that the sender is the expected Jetton wallet contract. Any attacker can send a fake `transfer_notification` message claiming to have transferred tokens, crediting themselves without actually depositing any Jettons.\n\n**Vulnerable Code**:\n```func\n\u002F\u002F staking.fc, line 85\nif (op == op::transfer_notification) {\n    int jetton_amount = in_msg_body~load_coins();\n    slice from_user = in_msg_body~load_msg_addr();\n\n    ;; WRONG: No validation of sender_address!\n    ;; Attacker can claim any jetton_amount\n\n    credit_user(from_user, jetton_amount);\n}\n```\n\n**Attack Scenario**:\n1. Attacker deploys malicious contract\n2. Malicious contract sends `transfer_notification` message to staking contract\n3. Message claims attacker transferred 1,000,000 Jettons\n4. Staking contract credits attacker without checking sender\n5. Attacker can now withdraw from contract or gain benefits without depositing\n\n**Proof of Concept**:\n```typescript\n\u002F\u002F Attacker sends fake transfer_notification\nconst attackerContract = await blockchain.treasury(\"attacker\");\n\nawait stakingContract.sendInternalMessage(attackerContract.getSender(), {\n  op: OP_CODES.TRANSFER_NOTIFICATION,\n  jettonAmount: toNano(\"1000000\"), \u002F\u002F Fake amount\n  fromUser: attackerContract.address,\n});\n\n\u002F\u002F Attacker successfully credited without sending real Jettons\nconst balance = await stakingContract.getUserBalance(attackerContract.address);\nexpect(balance).toEqual(toNano(\"1000000\")); \u002F\u002F Attack succeeded\n```\n\n**Recommendation**:\nStore expected Jetton wallet address and validate sender:\n```func\nglobal slice jetton_wallet_address;\n\n() recv_internal(...) impure {\n    load_data();  ;; Load jetton_wallet_address from storage\n\n    slice cs = in_msg_full.begin_parse();\n    int flags = cs~load_uint(4);\n    slice sender_address = cs~load_msg_addr();\n\n    int op = in_msg_body~load_uint(32);\n\n    if (op == op::transfer_notification) {\n        ;; CRITICAL: Validate sender\n        throw_unless(error::wrong_jetton_wallet,\n            equal_slices(sender_address, jetton_wallet_address));\n\n        int jetton_amount = in_msg_body~load_coins();\n        slice from_user = in_msg_body~load_msg_addr();\n\n        ;; Safe to credit user\n        credit_user(from_user, jetton_amount);\n    }\n}\n```\n\n**References**:\n- building-secure-contracts\u002Fnot-so-smart-contracts\u002Fton\u002Ffake_jetton_contract\n```\n\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Fake Jetton contract (unauthorized minting\u002Fcrediting)\n\n### High (Fix Before Launch)\n- Integer as boolean (logic errors, broken conditions)\n- Forward TON without gas check (balance drainage)\n\n---\n\n## 8. Testing Recommendations\n\n### Unit Tests\n```typescript\nimport { Blockchain } from \"@ton\u002Fsandbox\";\nimport { toNano } from \"ton-core\";\n\ndescribe(\"Security tests\", () => {\n  let blockchain: Blockchain;\n  let contract: Contract;\n\n  beforeEach(async () => {\n    blockchain = await Blockchain.create();\n    contract = blockchain.openContract(await Contract.fromInit());\n  });\n\n  it(\"should use correct boolean values\", async () => {\n    \u002F\u002F Test that TRUE = -1, FALSE = 0\n    const result = await contract.getFlag();\n    expect(result).toEqual(-1n); \u002F\u002F True\n    expect(result).not.toEqual(1n); \u002F\u002F Not 1!\n  });\n\n  it(\"should reject fake jetton transfer\", async () => {\n    const attacker = await blockchain.treasury(\"attacker\");\n\n    const result = await contract.send(\n      attacker.getSender(),\n      { value: toNano(\"0.05\") },\n      {\n        $$type: \"TransferNotification\",\n        query_id: 0n,\n        amount: toNano(\"1000\"),\n        from: attacker.address,\n      }\n    );\n\n    expect(result.transactions).toHaveTransaction({\n      success: false, \u002F\u002F Should reject\n    });\n  });\n\n  it(\"should validate gas for forward amount\", async () => {\n    const result = await contract.send(\n      user.getSender(),\n      { value: toNano(\"0.01\") }, \u002F\u002F Insufficient gas\n      {\n        $$type: \"Transfer\",\n        to: recipient.address,\n        forward_ton_amount: toNano(\"1\"), \u002F\u002F Trying to forward 1 TON\n      }\n    );\n\n    expect(result.transactions).toHaveTransaction({\n      success: false,\n    });\n  });\n});\n```\n\n### Integration Tests\n```typescript\n\u002F\u002F Test with real Jetton wallet\nit(\"should accept transfer from real jetton wallet\", async () => {\n  \u002F\u002F Deploy actual Jetton minter and wallet\n  const jettonMinter = await blockchain.openContract(JettonMinter.create());\n  const userJettonWallet = await jettonMinter.getWalletAddress(user.address);\n\n  \u002F\u002F Set jetton wallet in contract\n  await contract.setJettonWallet(userJettonWallet);\n\n  \u002F\u002F Real transfer from Jetton wallet\n  const result = await userJettonWallet.sendTransfer(\n    user.getSender(),\n    contract.address,\n    toNano(\"100\"),\n    {}\n  );\n\n  expect(result.transactions).toHaveTransaction({\n    to: contract.address,\n    success: true,\n  });\n});\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fton\u002F`\n- **TON Documentation**: https:\u002F\u002Fdocs.ton.org\u002F\n- **FunC Documentation**: https:\u002F\u002Fdocs.ton.org\u002Fdevelop\u002Ffunc\u002Foverview\n- **TON Blueprint**: https:\u002F\u002Fgithub.com\u002Fton-org\u002Fblueprint\n- **Jetton Standard**: https:\u002F\u002Fgithub.com\u002Fton-blockchain\u002FTEPs\u002Fblob\u002Fmaster\u002Ftext\u002F0074-jettons-standard.md\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing TON contract audit:\n\n**Boolean Logic (HIGH)**:\n- [ ] All boolean values use -1 (true) and 0 (false)\n- [ ] NO positive integers (1, 2, etc.) used as booleans\n- [ ] Functions returning booleans return -1 for true\n- [ ] Boolean logic with `~`, `&`, `|` uses correct values\n- [ ] Tests verify boolean operations work correctly\n\n**Jetton Security (CRITICAL)**:\n- [ ] `transfer_notification` handler validates sender address\n- [ ] Sender checked against stored Jetton wallet address\n- [ ] Jetton wallet address stored during initialization\n- [ ] Admin function to set\u002Fupdate Jetton wallet\n- [ ] Cannot trust forward_payload without sender validation\n- [ ] Tests with fake Jetton contracts verify rejection\n\n**Gas & Forward Amounts (HIGH)**:\n- [ ] Forward TON amounts are fixed\u002Fbounded\n- [ ] OR user-provided amounts validated: `msg_value >= tx_fee + forward_amount`\n- [ ] Contract balance protected from drainage\n- [ ] Appropriate `send_raw_message` flags used\n- [ ] Tests verify cannot drain contract with excessive forward amounts\n\n**Testing**:\n- [ ] Unit tests for all three vulnerability types\n- [ ] Integration tests with real Jetton contracts\n- [ ] Gas cost analysis for all operations\n- [ ] Testnet deployment before mainnet\n",{"data":42,"body":43},{"name":4,"description":6},{"type":44,"children":45},"root",[46,54,61,67,73,108,114,121,150,156,329,335,390,396,434,438,444,449,503,506,512,517,527,532,567,573,622,627,667,673,775,780,820,826,831,876,879,885,891,1163,1173,1208,1217,1613,1623,1811,1820,1828,1837,1843,2374,2377,2383,2462,2465,2471,2476,2485,2553,2562,2625,2634,2696,2705,2745],{"type":47,"tag":48,"props":49,"children":50},"element","h1",{"id":4},[51],{"type":52,"value":53},"text","TON Vulnerability Scanner",{"type":47,"tag":55,"props":56,"children":58},"h2",{"id":57},"_1-purpose",[59],{"type":52,"value":60},"1. Purpose",{"type":47,"tag":62,"props":63,"children":64},"p",{},[65],{"type":52,"value":66},"Systematically scan TON blockchain smart contracts written in FunC for platform-specific security vulnerabilities related to boolean logic, Jetton token handling, and gas management. This skill encodes 3 critical vulnerability patterns unique to TON's architecture.",{"type":47,"tag":55,"props":68,"children":70},{"id":69},"_2-when-to-use-this-skill",[71],{"type":52,"value":72},"2. When to Use This Skill",{"type":47,"tag":74,"props":75,"children":76},"ul",{},[77,83,88,93,98,103],{"type":47,"tag":78,"props":79,"children":80},"li",{},[81],{"type":52,"value":82},"Auditing TON smart contracts (FunC language)",{"type":47,"tag":78,"props":84,"children":85},{},[86],{"type":52,"value":87},"Reviewing Jetton token implementations",{"type":47,"tag":78,"props":89,"children":90},{},[91],{"type":52,"value":92},"Validating token transfer notification handlers",{"type":47,"tag":78,"props":94,"children":95},{},[96],{"type":52,"value":97},"Pre-launch security assessment of TON dApps",{"type":47,"tag":78,"props":99,"children":100},{},[101],{"type":52,"value":102},"Reviewing gas forwarding logic",{"type":47,"tag":78,"props":104,"children":105},{},[106],{"type":52,"value":107},"Assessing boolean condition handling",{"type":47,"tag":55,"props":109,"children":111},{"id":110},"_3-platform-detection",[112],{"type":52,"value":113},"3. Platform Detection",{"type":47,"tag":115,"props":116,"children":118},"h3",{"id":117},"file-extensions-indicators",[119],{"type":52,"value":120},"File Extensions & Indicators",{"type":47,"tag":74,"props":122,"children":123},{},[124],{"type":47,"tag":78,"props":125,"children":126},{},[127,133,135,142,144],{"type":47,"tag":128,"props":129,"children":130},"strong",{},[131],{"type":52,"value":132},"FunC files",{"type":52,"value":134},": ",{"type":47,"tag":136,"props":137,"children":139},"code",{"className":138},[],[140],{"type":52,"value":141},".fc",{"type":52,"value":143},", ",{"type":47,"tag":136,"props":145,"children":147},{"className":146},[],[148],{"type":52,"value":149},".func",{"type":47,"tag":115,"props":151,"children":153},{"id":152},"languageframework-markers",[154],{"type":52,"value":155},"Language\u002FFramework Markers",{"type":47,"tag":157,"props":158,"children":163},"pre",{"className":159,"code":160,"language":161,"meta":162,"style":162},"language-func shiki shiki-themes material-theme-lighter material-theme material-theme-palenight",";; FunC contract indicators\n#include \"imports\u002Fstdlib.fc\";\n\n() recv_internal(int my_balance, int msg_value, cell in_msg_full, slice in_msg_body) impure {\n    ;; Contract logic\n}\n\n() recv_external(slice in_msg) impure {\n    ;; External message handler\n}\n\n;; Common patterns\nsend_raw_message()\nload_uint(), load_msg_addr(), load_coins()\nbegin_cell(), end_cell(), store_*()\ntransfer_notification operation\nop::transfer, op::transfer_notification\n.store_uint().store_slice().store_coins()\n","func","",[164],{"type":47,"tag":136,"props":165,"children":166},{"__ignoreMap":162},[167,178,187,197,206,215,224,232,241,250,258,266,275,284,293,302,311,320],{"type":47,"tag":168,"props":169,"children":172},"span",{"class":170,"line":171},"line",1,[173],{"type":47,"tag":168,"props":174,"children":175},{},[176],{"type":52,"value":177},";; FunC contract indicators\n",{"type":47,"tag":168,"props":179,"children":181},{"class":170,"line":180},2,[182],{"type":47,"tag":168,"props":183,"children":184},{},[185],{"type":52,"value":186},"#include \"imports\u002Fstdlib.fc\";\n",{"type":47,"tag":168,"props":188,"children":190},{"class":170,"line":189},3,[191],{"type":47,"tag":168,"props":192,"children":194},{"emptyLinePlaceholder":193},true,[195],{"type":52,"value":196},"\n",{"type":47,"tag":168,"props":198,"children":200},{"class":170,"line":199},4,[201],{"type":47,"tag":168,"props":202,"children":203},{},[204],{"type":52,"value":205},"() recv_internal(int my_balance, int msg_value, cell in_msg_full, slice in_msg_body) impure {\n",{"type":47,"tag":168,"props":207,"children":209},{"class":170,"line":208},5,[210],{"type":47,"tag":168,"props":211,"children":212},{},[213],{"type":52,"value":214},"    ;; Contract logic\n",{"type":47,"tag":168,"props":216,"children":218},{"class":170,"line":217},6,[219],{"type":47,"tag":168,"props":220,"children":221},{},[222],{"type":52,"value":223},"}\n",{"type":47,"tag":168,"props":225,"children":227},{"class":170,"line":226},7,[228],{"type":47,"tag":168,"props":229,"children":230},{"emptyLinePlaceholder":193},[231],{"type":52,"value":196},{"type":47,"tag":168,"props":233,"children":235},{"class":170,"line":234},8,[236],{"type":47,"tag":168,"props":237,"children":238},{},[239],{"type":52,"value":240},"() recv_external(slice in_msg) impure {\n",{"type":47,"tag":168,"props":242,"children":244},{"class":170,"line":243},9,[245],{"type":47,"tag":168,"props":246,"children":247},{},[248],{"type":52,"value":249},"    ;; External message handler\n",{"type":47,"tag":168,"props":251,"children":253},{"class":170,"line":252},10,[254],{"type":47,"tag":168,"props":255,"children":256},{},[257],{"type":52,"value":223},{"type":47,"tag":168,"props":259,"children":261},{"class":170,"line":260},11,[262],{"type":47,"tag":168,"props":263,"children":264},{"emptyLinePlaceholder":193},[265],{"type":52,"value":196},{"type":47,"tag":168,"props":267,"children":269},{"class":170,"line":268},12,[270],{"type":47,"tag":168,"props":271,"children":272},{},[273],{"type":52,"value":274},";; Common patterns\n",{"type":47,"tag":168,"props":276,"children":278},{"class":170,"line":277},13,[279],{"type":47,"tag":168,"props":280,"children":281},{},[282],{"type":52,"value":283},"send_raw_message()\n",{"type":47,"tag":168,"props":285,"children":287},{"class":170,"line":286},14,[288],{"type":47,"tag":168,"props":289,"children":290},{},[291],{"type":52,"value":292},"load_uint(), load_msg_addr(), load_coins()\n",{"type":47,"tag":168,"props":294,"children":296},{"class":170,"line":295},15,[297],{"type":47,"tag":168,"props":298,"children":299},{},[300],{"type":52,"value":301},"begin_cell(), end_cell(), store_*()\n",{"type":47,"tag":168,"props":303,"children":305},{"class":170,"line":304},16,[306],{"type":47,"tag":168,"props":307,"children":308},{},[309],{"type":52,"value":310},"transfer_notification operation\n",{"type":47,"tag":168,"props":312,"children":314},{"class":170,"line":313},17,[315],{"type":47,"tag":168,"props":316,"children":317},{},[318],{"type":52,"value":319},"op::transfer, op::transfer_notification\n",{"type":47,"tag":168,"props":321,"children":323},{"class":170,"line":322},18,[324],{"type":47,"tag":168,"props":325,"children":326},{},[327],{"type":52,"value":328},".store_uint().store_slice().store_coins()\n",{"type":47,"tag":115,"props":330,"children":332},{"id":331},"project-structure",[333],{"type":52,"value":334},"Project Structure",{"type":47,"tag":74,"props":336,"children":337},{},[338,349,360,371],{"type":47,"tag":78,"props":339,"children":340},{},[341,347],{"type":47,"tag":136,"props":342,"children":344},{"className":343},[],[345],{"type":52,"value":346},"contracts\u002F*.fc",{"type":52,"value":348}," - FunC contract source",{"type":47,"tag":78,"props":350,"children":351},{},[352,358],{"type":47,"tag":136,"props":353,"children":355},{"className":354},[],[356],{"type":52,"value":357},"wrappers\u002F*.ts",{"type":52,"value":359}," - TypeScript wrappers",{"type":47,"tag":78,"props":361,"children":362},{},[363,369],{"type":47,"tag":136,"props":364,"children":366},{"className":365},[],[367],{"type":52,"value":368},"tests\u002F*.spec.ts",{"type":52,"value":370}," - Contract tests",{"type":47,"tag":78,"props":372,"children":373},{},[374,380,382,388],{"type":47,"tag":136,"props":375,"children":377},{"className":376},[],[378],{"type":52,"value":379},"ton.config.ts",{"type":52,"value":381}," or ",{"type":47,"tag":136,"props":383,"children":385},{"className":384},[],[386],{"type":52,"value":387},"wasm.config.ts",{"type":52,"value":389}," - TON project config",{"type":47,"tag":115,"props":391,"children":393},{"id":392},"tool-support",[394],{"type":52,"value":395},"Tool Support",{"type":47,"tag":74,"props":397,"children":398},{},[399,409,419,429],{"type":47,"tag":78,"props":400,"children":401},{},[402,407],{"type":47,"tag":128,"props":403,"children":404},{},[405],{"type":52,"value":406},"TON Blueprint",{"type":52,"value":408},": Development framework for TON",{"type":47,"tag":78,"props":410,"children":411},{},[412,417],{"type":47,"tag":128,"props":413,"children":414},{},[415],{"type":52,"value":416},"toncli",{"type":52,"value":418},": CLI tool for TON contracts",{"type":47,"tag":78,"props":420,"children":421},{},[422,427],{"type":47,"tag":128,"props":423,"children":424},{},[425],{"type":52,"value":426},"ton-compiler",{"type":52,"value":428},": FunC compiler",{"type":47,"tag":78,"props":430,"children":431},{},[432],{"type":52,"value":433},"Manual review primarily (limited automated tools)",{"type":47,"tag":435,"props":436,"children":437},"hr",{},[],{"type":47,"tag":55,"props":439,"children":441},{"id":440},"_4-how-this-skill-works",[442],{"type":52,"value":443},"4. How This Skill Works",{"type":47,"tag":62,"props":445,"children":446},{},[447],{"type":52,"value":448},"When invoked, I will:",{"type":47,"tag":450,"props":451,"children":452},"ol",{},[453,463,473,483,493],{"type":47,"tag":78,"props":454,"children":455},{},[456,461],{"type":47,"tag":128,"props":457,"children":458},{},[459],{"type":52,"value":460},"Search your codebase",{"type":52,"value":462}," for FunC\u002FTact contracts",{"type":47,"tag":78,"props":464,"children":465},{},[466,471],{"type":47,"tag":128,"props":467,"children":468},{},[469],{"type":52,"value":470},"Analyze each contract",{"type":52,"value":472}," for the 3 vulnerability patterns",{"type":47,"tag":78,"props":474,"children":475},{},[476,481],{"type":47,"tag":128,"props":477,"children":478},{},[479],{"type":52,"value":480},"Report findings",{"type":52,"value":482}," with file references and severity",{"type":47,"tag":78,"props":484,"children":485},{},[486,491],{"type":47,"tag":128,"props":487,"children":488},{},[489],{"type":52,"value":490},"Provide fixes",{"type":52,"value":492}," for each identified issue",{"type":47,"tag":78,"props":494,"children":495},{},[496,501],{"type":47,"tag":128,"props":497,"children":498},{},[499],{"type":52,"value":500},"Check replay protection",{"type":52,"value":502}," and sender validation",{"type":47,"tag":435,"props":504,"children":505},{},[],{"type":47,"tag":55,"props":507,"children":509},{"id":508},"_5-example-output",[510],{"type":52,"value":511},"5. Example Output",{"type":47,"tag":62,"props":513,"children":514},{},[515],{"type":52,"value":516},"When vulnerabilities are found, you'll get a report like this:",{"type":47,"tag":157,"props":518,"children":522},{"className":519,"code":521,"language":52},[520],"language-text","=== TON VULNERABILITY SCAN RESULTS ===\n\nProject: my-ton-contract\nFiles Scanned: 3 (.fc, .tact)\nVulnerabilities Found: 2\n\n---\n\n[CRITICAL] Missing Replay Protection\nFile: contracts\u002Fwallet.fc:45\nPattern: No sequence number or nonce validation\n\n\n---\n\n## 5. Vulnerability Patterns (3 Patterns)\n\nI check for 3 critical vulnerability patterns unique to TON. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Missing Sender Check** ⚠️ CRITICAL - No sender validation on privileged operations\n2. **Integer Overflow** ⚠️ CRITICAL - Unchecked arithmetic in FunC\n3. **Improper Gas Handling** ⚠️ HIGH - Insufficient gas reservations\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify FunC language (`.fc` or `.func` files)\n2. Check for TON Blueprint or toncli project structure\n3. Locate contract source files\n4. Identify Jetton-related contracts\n\n### Step 2: Boolean Logic Review\n```bash\n# Find boolean-like variables\nrg \"int.*is_|int.*has_|int.*flag|int.*enabled\" contracts\u002F\n\n# Check for positive integers used as booleans\nrg \"= 1;|return 1;\" contracts\u002F | grep -E \"is_|has_|flag|enabled|valid\"\n\n# Look for NOT operations on boolean-like values\nrg \"~.*\\(|~ \" contracts\u002F\n",[523],{"type":47,"tag":136,"props":524,"children":525},{"__ignoreMap":162},[526],{"type":52,"value":521},{"type":47,"tag":62,"props":528,"children":529},{},[530],{"type":52,"value":531},"For each boolean:",{"type":47,"tag":74,"props":533,"children":536},{"className":534},[535],"contains-task-list",[537,549,558],{"type":47,"tag":78,"props":538,"children":541},{"className":539},[540],"task-list-item",[542,547],{"type":47,"tag":543,"props":544,"children":546},"input",{"disabled":193,"type":545},"checkbox",[],{"type":52,"value":548}," Uses -1 for true, 0 for false",{"type":47,"tag":78,"props":550,"children":552},{"className":551},[540],[553,556],{"type":47,"tag":543,"props":554,"children":555},{"disabled":193,"type":545},[],{"type":52,"value":557}," NOT using 1 or other positive integers",{"type":47,"tag":78,"props":559,"children":561},{"className":560},[540],[562,565],{"type":47,"tag":543,"props":563,"children":564},{"disabled":193,"type":545},[],{"type":52,"value":566}," Logic operations work correctly",{"type":47,"tag":115,"props":568,"children":570},{"id":569},"step-3-jetton-handler-analysis",[571],{"type":52,"value":572},"Step 3: Jetton Handler Analysis",{"type":47,"tag":157,"props":574,"children":578},{"className":575,"code":576,"language":577,"meta":162,"style":162},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Find transfer_notification handlers\nrg \"transfer_notification|op::transfer_notification\" contracts\u002F\n","bash",[579],{"type":47,"tag":136,"props":580,"children":581},{"__ignoreMap":162},[582,591],{"type":47,"tag":168,"props":583,"children":584},{"class":170,"line":171},[585],{"type":47,"tag":168,"props":586,"children":588},{"style":587},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[589],{"type":52,"value":590},"# Find transfer_notification handlers\n",{"type":47,"tag":168,"props":592,"children":593},{"class":170,"line":180},[594,600,606,612,617],{"type":47,"tag":168,"props":595,"children":597},{"style":596},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[598],{"type":52,"value":599},"rg",{"type":47,"tag":168,"props":601,"children":603},{"style":602},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[604],{"type":52,"value":605}," \"",{"type":47,"tag":168,"props":607,"children":609},{"style":608},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[610],{"type":52,"value":611},"transfer_notification|op::transfer_notification",{"type":47,"tag":168,"props":613,"children":614},{"style":602},[615],{"type":52,"value":616},"\"",{"type":47,"tag":168,"props":618,"children":619},{"style":608},[620],{"type":52,"value":621}," contracts\u002F\n",{"type":47,"tag":62,"props":623,"children":624},{},[625],{"type":52,"value":626},"For each Jetton handler:",{"type":47,"tag":74,"props":628,"children":630},{"className":629},[535],[631,640,649,658],{"type":47,"tag":78,"props":632,"children":634},{"className":633},[540],[635,638],{"type":47,"tag":543,"props":636,"children":637},{"disabled":193,"type":545},[],{"type":52,"value":639}," Validates sender address",{"type":47,"tag":78,"props":641,"children":643},{"className":642},[540],[644,647],{"type":47,"tag":543,"props":645,"children":646},{"disabled":193,"type":545},[],{"type":52,"value":648}," Sender checked against stored Jetton wallet address",{"type":47,"tag":78,"props":650,"children":652},{"className":651},[540],[653,656],{"type":47,"tag":543,"props":654,"children":655},{"disabled":193,"type":545},[],{"type":52,"value":657}," Cannot trust forward_payload without sender validation",{"type":47,"tag":78,"props":659,"children":661},{"className":660},[540],[662,665],{"type":47,"tag":543,"props":663,"children":664},{"disabled":193,"type":545},[],{"type":52,"value":666}," Has admin function to set Jetton wallet address",{"type":47,"tag":115,"props":668,"children":670},{"id":669},"step-4-gasforward-amount-review",[671],{"type":52,"value":672},"Step 4: Gas\u002FForward Amount Review",{"type":47,"tag":157,"props":674,"children":676},{"className":575,"code":675,"language":577,"meta":162,"style":162},"# Find forward amount usage\nrg \"forward_ton_amount|forward_amount\" contracts\u002F\nrg \"load_coins\\(\\)\" contracts\u002F\n\n# Find send_raw_message calls\nrg \"send_raw_message\" contracts\u002F\n",[677],{"type":47,"tag":136,"props":678,"children":679},{"__ignoreMap":162},[680,688,712,736,743,751],{"type":47,"tag":168,"props":681,"children":682},{"class":170,"line":171},[683],{"type":47,"tag":168,"props":684,"children":685},{"style":587},[686],{"type":52,"value":687},"# Find forward amount usage\n",{"type":47,"tag":168,"props":689,"children":690},{"class":170,"line":180},[691,695,699,704,708],{"type":47,"tag":168,"props":692,"children":693},{"style":596},[694],{"type":52,"value":599},{"type":47,"tag":168,"props":696,"children":697},{"style":602},[698],{"type":52,"value":605},{"type":47,"tag":168,"props":700,"children":701},{"style":608},[702],{"type":52,"value":703},"forward_ton_amount|forward_amount",{"type":47,"tag":168,"props":705,"children":706},{"style":602},[707],{"type":52,"value":616},{"type":47,"tag":168,"props":709,"children":710},{"style":608},[711],{"type":52,"value":621},{"type":47,"tag":168,"props":713,"children":714},{"class":170,"line":189},[715,719,723,728,732],{"type":47,"tag":168,"props":716,"children":717},{"style":596},[718],{"type":52,"value":599},{"type":47,"tag":168,"props":720,"children":721},{"style":602},[722],{"type":52,"value":605},{"type":47,"tag":168,"props":724,"children":725},{"style":608},[726],{"type":52,"value":727},"load_coins\\(\\)",{"type":47,"tag":168,"props":729,"children":730},{"style":602},[731],{"type":52,"value":616},{"type":47,"tag":168,"props":733,"children":734},{"style":608},[735],{"type":52,"value":621},{"type":47,"tag":168,"props":737,"children":738},{"class":170,"line":199},[739],{"type":47,"tag":168,"props":740,"children":741},{"emptyLinePlaceholder":193},[742],{"type":52,"value":196},{"type":47,"tag":168,"props":744,"children":745},{"class":170,"line":208},[746],{"type":47,"tag":168,"props":747,"children":748},{"style":587},[749],{"type":52,"value":750},"# Find send_raw_message calls\n",{"type":47,"tag":168,"props":752,"children":753},{"class":170,"line":217},[754,758,762,767,771],{"type":47,"tag":168,"props":755,"children":756},{"style":596},[757],{"type":52,"value":599},{"type":47,"tag":168,"props":759,"children":760},{"style":602},[761],{"type":52,"value":605},{"type":47,"tag":168,"props":763,"children":764},{"style":608},[765],{"type":52,"value":766},"send_raw_message",{"type":47,"tag":168,"props":768,"children":769},{"style":602},[770],{"type":52,"value":616},{"type":47,"tag":168,"props":772,"children":773},{"style":608},[774],{"type":52,"value":621},{"type":47,"tag":62,"props":776,"children":777},{},[778],{"type":52,"value":779},"For each outgoing message:",{"type":47,"tag":74,"props":781,"children":783},{"className":782},[535],[784,793,802,811],{"type":47,"tag":78,"props":785,"children":787},{"className":786},[540],[788,791],{"type":47,"tag":543,"props":789,"children":790},{"disabled":193,"type":545},[],{"type":52,"value":792}," Forward amounts are fixed\u002Fbounded",{"type":47,"tag":78,"props":794,"children":796},{"className":795},[540],[797,800],{"type":47,"tag":543,"props":798,"children":799},{"disabled":193,"type":545},[],{"type":52,"value":801}," OR user-provided amounts validated against msg_value",{"type":47,"tag":78,"props":803,"children":805},{"className":804},[540],[806,809],{"type":47,"tag":543,"props":807,"children":808},{"disabled":193,"type":545},[],{"type":52,"value":810}," Cannot drain contract balance",{"type":47,"tag":78,"props":812,"children":814},{"className":813},[540],[815,818],{"type":47,"tag":543,"props":816,"children":817},{"disabled":193,"type":545},[],{"type":52,"value":819}," Appropriate send_raw_message flags used",{"type":47,"tag":115,"props":821,"children":823},{"id":822},"step-5-manual-review",[824],{"type":52,"value":825},"Step 5: Manual Review",{"type":47,"tag":62,"props":827,"children":828},{},[829],{"type":52,"value":830},"TON contracts require thorough manual review:",{"type":47,"tag":74,"props":832,"children":833},{},[834,861,866,871],{"type":47,"tag":78,"props":835,"children":836},{},[837,839,845,846,852,853,859],{"type":52,"value":838},"Boolean logic with ",{"type":47,"tag":136,"props":840,"children":842},{"className":841},[],[843],{"type":52,"value":844},"~",{"type":52,"value":143},{"type":47,"tag":136,"props":847,"children":849},{"className":848},[],[850],{"type":52,"value":851},"&",{"type":52,"value":143},{"type":47,"tag":136,"props":854,"children":856},{"className":855},[],[857],{"type":52,"value":858},"|",{"type":52,"value":860}," operators",{"type":47,"tag":78,"props":862,"children":863},{},[864],{"type":52,"value":865},"Message parsing and validation",{"type":47,"tag":78,"props":867,"children":868},{},[869],{"type":52,"value":870},"Gas economics and fee calculations",{"type":47,"tag":78,"props":872,"children":873},{},[874],{"type":52,"value":875},"Storage operations and data serialization",{"type":47,"tag":435,"props":877,"children":878},{},[],{"type":47,"tag":55,"props":880,"children":882},{"id":881},"_6-reporting-format",[883],{"type":52,"value":884},"6. Reporting Format",{"type":47,"tag":115,"props":886,"children":888},{"id":887},"finding-template",[889],{"type":52,"value":890},"Finding Template",{"type":47,"tag":157,"props":892,"children":896},{"className":893,"code":894,"language":895,"meta":162,"style":162},"language-markdown shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","## [CRITICAL] Fake Jetton Contract - Missing Sender Validation\n\n**Location**: `contracts\u002Fstaking.fc:85-95` (recv_internal, transfer_notification handler)\n\n**Description**:\nThe `transfer_notification` operation handler does not validate that the sender is the expected Jetton wallet contract. Any attacker can send a fake `transfer_notification` message claiming to have transferred tokens, crediting themselves without actually depositing any Jettons.\n\n**Vulnerable Code**:\n```func\n\u002F\u002F staking.fc, line 85\nif (op == op::transfer_notification) {\n    int jetton_amount = in_msg_body~load_coins();\n    slice from_user = in_msg_body~load_msg_addr();\n\n    ;; WRONG: No validation of sender_address!\n    ;; Attacker can claim any jetton_amount\n\n    credit_user(from_user, jetton_amount);\n}\n","markdown",[897],{"type":47,"tag":136,"props":898,"children":899},{"__ignoreMap":162},[900,923,930,973,980,1001,1044,1051,1071,1085,1093,1101,1109,1117,1124,1132,1140,1147,1155],{"type":47,"tag":168,"props":901,"children":902},{"class":170,"line":171},[903,908,913,918],{"type":47,"tag":168,"props":904,"children":905},{"style":602},[906],{"type":52,"value":907},"## [",{"type":47,"tag":168,"props":909,"children":910},{"style":608},[911],{"type":52,"value":912},"CRITICAL",{"type":47,"tag":168,"props":914,"children":915},{"style":602},[916],{"type":52,"value":917},"]",{"type":47,"tag":168,"props":919,"children":920},{"style":596},[921],{"type":52,"value":922}," Fake Jetton Contract - Missing Sender Validation\n",{"type":47,"tag":168,"props":924,"children":925},{"class":170,"line":180},[926],{"type":47,"tag":168,"props":927,"children":928},{"emptyLinePlaceholder":193},[929],{"type":52,"value":196},{"type":47,"tag":168,"props":931,"children":932},{"class":170,"line":189},[933,939,945,949,954,959,964,968],{"type":47,"tag":168,"props":934,"children":936},{"style":935},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[937],{"type":52,"value":938},"**",{"type":47,"tag":168,"props":940,"children":942},{"style":941},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[943],{"type":52,"value":944},"Location",{"type":47,"tag":168,"props":946,"children":947},{"style":935},[948],{"type":52,"value":938},{"type":47,"tag":168,"props":950,"children":952},{"style":951},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[953],{"type":52,"value":134},{"type":47,"tag":168,"props":955,"children":956},{"style":602},[957],{"type":52,"value":958},"`",{"type":47,"tag":168,"props":960,"children":961},{"style":608},[962],{"type":52,"value":963},"contracts\u002Fstaking.fc:85-95",{"type":47,"tag":168,"props":965,"children":966},{"style":602},[967],{"type":52,"value":958},{"type":47,"tag":168,"props":969,"children":970},{"style":951},[971],{"type":52,"value":972}," (recv_internal, transfer_notification handler)\n",{"type":47,"tag":168,"props":974,"children":975},{"class":170,"line":199},[976],{"type":47,"tag":168,"props":977,"children":978},{"emptyLinePlaceholder":193},[979],{"type":52,"value":196},{"type":47,"tag":168,"props":981,"children":982},{"class":170,"line":208},[983,987,992,996],{"type":47,"tag":168,"props":984,"children":985},{"style":935},[986],{"type":52,"value":938},{"type":47,"tag":168,"props":988,"children":989},{"style":941},[990],{"type":52,"value":991},"Description",{"type":47,"tag":168,"props":993,"children":994},{"style":935},[995],{"type":52,"value":938},{"type":47,"tag":168,"props":997,"children":998},{"style":951},[999],{"type":52,"value":1000},":\n",{"type":47,"tag":168,"props":1002,"children":1003},{"class":170,"line":217},[1004,1009,1013,1018,1022,1027,1031,1035,1039],{"type":47,"tag":168,"props":1005,"children":1006},{"style":951},[1007],{"type":52,"value":1008},"The ",{"type":47,"tag":168,"props":1010,"children":1011},{"style":602},[1012],{"type":52,"value":958},{"type":47,"tag":168,"props":1014,"children":1015},{"style":608},[1016],{"type":52,"value":1017},"transfer_notification",{"type":47,"tag":168,"props":1019,"children":1020},{"style":602},[1021],{"type":52,"value":958},{"type":47,"tag":168,"props":1023,"children":1024},{"style":951},[1025],{"type":52,"value":1026}," operation handler does not validate that the sender is the expected Jetton wallet contract. Any attacker can send a fake ",{"type":47,"tag":168,"props":1028,"children":1029},{"style":602},[1030],{"type":52,"value":958},{"type":47,"tag":168,"props":1032,"children":1033},{"style":608},[1034],{"type":52,"value":1017},{"type":47,"tag":168,"props":1036,"children":1037},{"style":602},[1038],{"type":52,"value":958},{"type":47,"tag":168,"props":1040,"children":1041},{"style":951},[1042],{"type":52,"value":1043}," message claiming to have transferred tokens, crediting themselves without actually depositing any Jettons.\n",{"type":47,"tag":168,"props":1045,"children":1046},{"class":170,"line":226},[1047],{"type":47,"tag":168,"props":1048,"children":1049},{"emptyLinePlaceholder":193},[1050],{"type":52,"value":196},{"type":47,"tag":168,"props":1052,"children":1053},{"class":170,"line":234},[1054,1058,1063,1067],{"type":47,"tag":168,"props":1055,"children":1056},{"style":935},[1057],{"type":52,"value":938},{"type":47,"tag":168,"props":1059,"children":1060},{"style":941},[1061],{"type":52,"value":1062},"Vulnerable Code",{"type":47,"tag":168,"props":1064,"children":1065},{"style":935},[1066],{"type":52,"value":938},{"type":47,"tag":168,"props":1068,"children":1069},{"style":951},[1070],{"type":52,"value":1000},{"type":47,"tag":168,"props":1072,"children":1073},{"class":170,"line":243},[1074,1079],{"type":47,"tag":168,"props":1075,"children":1076},{"style":608},[1077],{"type":52,"value":1078},"```",{"type":47,"tag":168,"props":1080,"children":1082},{"style":1081},"--shiki-light:#90A4AE90;--shiki-default:#EEFFFF90;--shiki-dark:#BABED890",[1083],{"type":52,"value":1084},"func\n",{"type":47,"tag":168,"props":1086,"children":1087},{"class":170,"line":252},[1088],{"type":47,"tag":168,"props":1089,"children":1090},{"style":1081},[1091],{"type":52,"value":1092},"\u002F\u002F staking.fc, line 85\n",{"type":47,"tag":168,"props":1094,"children":1095},{"class":170,"line":260},[1096],{"type":47,"tag":168,"props":1097,"children":1098},{"style":1081},[1099],{"type":52,"value":1100},"if (op == op::transfer_notification) {\n",{"type":47,"tag":168,"props":1102,"children":1103},{"class":170,"line":268},[1104],{"type":47,"tag":168,"props":1105,"children":1106},{"style":1081},[1107],{"type":52,"value":1108},"    int jetton_amount = in_msg_body~load_coins();\n",{"type":47,"tag":168,"props":1110,"children":1111},{"class":170,"line":277},[1112],{"type":47,"tag":168,"props":1113,"children":1114},{"style":1081},[1115],{"type":52,"value":1116},"    slice from_user = in_msg_body~load_msg_addr();\n",{"type":47,"tag":168,"props":1118,"children":1119},{"class":170,"line":286},[1120],{"type":47,"tag":168,"props":1121,"children":1122},{"emptyLinePlaceholder":193},[1123],{"type":52,"value":196},{"type":47,"tag":168,"props":1125,"children":1126},{"class":170,"line":295},[1127],{"type":47,"tag":168,"props":1128,"children":1129},{"style":1081},[1130],{"type":52,"value":1131},"    ;; WRONG: No validation of sender_address!\n",{"type":47,"tag":168,"props":1133,"children":1134},{"class":170,"line":304},[1135],{"type":47,"tag":168,"props":1136,"children":1137},{"style":1081},[1138],{"type":52,"value":1139},"    ;; Attacker can claim any jetton_amount\n",{"type":47,"tag":168,"props":1141,"children":1142},{"class":170,"line":313},[1143],{"type":47,"tag":168,"props":1144,"children":1145},{"emptyLinePlaceholder":193},[1146],{"type":52,"value":196},{"type":47,"tag":168,"props":1148,"children":1149},{"class":170,"line":322},[1150],{"type":47,"tag":168,"props":1151,"children":1152},{"style":1081},[1153],{"type":52,"value":1154},"    credit_user(from_user, jetton_amount);\n",{"type":47,"tag":168,"props":1156,"children":1158},{"class":170,"line":1157},19,[1159],{"type":47,"tag":168,"props":1160,"children":1161},{"style":1081},[1162],{"type":52,"value":223},{"type":47,"tag":62,"props":1164,"children":1165},{},[1166,1171],{"type":47,"tag":128,"props":1167,"children":1168},{},[1169],{"type":52,"value":1170},"Attack Scenario",{"type":52,"value":1172},":",{"type":47,"tag":450,"props":1174,"children":1175},{},[1176,1181,1193,1198,1203],{"type":47,"tag":78,"props":1177,"children":1178},{},[1179],{"type":52,"value":1180},"Attacker deploys malicious contract",{"type":47,"tag":78,"props":1182,"children":1183},{},[1184,1186,1191],{"type":52,"value":1185},"Malicious contract sends ",{"type":47,"tag":136,"props":1187,"children":1189},{"className":1188},[],[1190],{"type":52,"value":1017},{"type":52,"value":1192}," message to staking contract",{"type":47,"tag":78,"props":1194,"children":1195},{},[1196],{"type":52,"value":1197},"Message claims attacker transferred 1,000,000 Jettons",{"type":47,"tag":78,"props":1199,"children":1200},{},[1201],{"type":52,"value":1202},"Staking contract credits attacker without checking sender",{"type":47,"tag":78,"props":1204,"children":1205},{},[1206],{"type":52,"value":1207},"Attacker can now withdraw from contract or gain benefits without depositing",{"type":47,"tag":62,"props":1209,"children":1210},{},[1211,1216],{"type":47,"tag":128,"props":1212,"children":1213},{},[1214],{"type":52,"value":1215},"Proof of Concept",{"type":52,"value":1172},{"type":47,"tag":157,"props":1218,"children":1222},{"className":1219,"code":1220,"language":1221,"meta":162,"style":162},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F Attacker sends fake transfer_notification\nconst attackerContract = await blockchain.treasury(\"attacker\");\n\nawait stakingContract.sendInternalMessage(attackerContract.getSender(), {\n  op: OP_CODES.TRANSFER_NOTIFICATION,\n  jettonAmount: toNano(\"1000000\"), \u002F\u002F Fake amount\n  fromUser: attackerContract.address,\n});\n\n\u002F\u002F Attacker successfully credited without sending real Jettons\nconst balance = await stakingContract.getUserBalance(attackerContract.address);\nexpect(balance).toEqual(toNano(\"1000000\")); \u002F\u002F Attack succeeded\n","typescript",[1223],{"type":47,"tag":136,"props":1224,"children":1225},{"__ignoreMap":162},[1226,1234,1303,1310,1361,1393,1440,1470,1486,1493,1501,1551],{"type":47,"tag":168,"props":1227,"children":1228},{"class":170,"line":171},[1229],{"type":47,"tag":168,"props":1230,"children":1231},{"style":587},[1232],{"type":52,"value":1233},"\u002F\u002F Attacker sends fake transfer_notification\n",{"type":47,"tag":168,"props":1235,"children":1236},{"class":170,"line":180},[1237,1243,1248,1253,1259,1264,1269,1275,1280,1284,1289,1293,1298],{"type":47,"tag":168,"props":1238,"children":1240},{"style":1239},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[1241],{"type":52,"value":1242},"const",{"type":47,"tag":168,"props":1244,"children":1245},{"style":951},[1246],{"type":52,"value":1247}," attackerContract ",{"type":47,"tag":168,"props":1249,"children":1250},{"style":602},[1251],{"type":52,"value":1252},"=",{"type":47,"tag":168,"props":1254,"children":1256},{"style":1255},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[1257],{"type":52,"value":1258}," await",{"type":47,"tag":168,"props":1260,"children":1261},{"style":951},[1262],{"type":52,"value":1263}," blockchain",{"type":47,"tag":168,"props":1265,"children":1266},{"style":602},[1267],{"type":52,"value":1268},".",{"type":47,"tag":168,"props":1270,"children":1272},{"style":1271},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1273],{"type":52,"value":1274},"treasury",{"type":47,"tag":168,"props":1276,"children":1277},{"style":951},[1278],{"type":52,"value":1279},"(",{"type":47,"tag":168,"props":1281,"children":1282},{"style":602},[1283],{"type":52,"value":616},{"type":47,"tag":168,"props":1285,"children":1286},{"style":608},[1287],{"type":52,"value":1288},"attacker",{"type":47,"tag":168,"props":1290,"children":1291},{"style":602},[1292],{"type":52,"value":616},{"type":47,"tag":168,"props":1294,"children":1295},{"style":951},[1296],{"type":52,"value":1297},")",{"type":47,"tag":168,"props":1299,"children":1300},{"style":602},[1301],{"type":52,"value":1302},";\n",{"type":47,"tag":168,"props":1304,"children":1305},{"class":170,"line":189},[1306],{"type":47,"tag":168,"props":1307,"children":1308},{"emptyLinePlaceholder":193},[1309],{"type":52,"value":196},{"type":47,"tag":168,"props":1311,"children":1312},{"class":170,"line":199},[1313,1318,1323,1327,1332,1337,1341,1346,1351,1356],{"type":47,"tag":168,"props":1314,"children":1315},{"style":1255},[1316],{"type":52,"value":1317},"await",{"type":47,"tag":168,"props":1319,"children":1320},{"style":951},[1321],{"type":52,"value":1322}," stakingContract",{"type":47,"tag":168,"props":1324,"children":1325},{"style":602},[1326],{"type":52,"value":1268},{"type":47,"tag":168,"props":1328,"children":1329},{"style":1271},[1330],{"type":52,"value":1331},"sendInternalMessage",{"type":47,"tag":168,"props":1333,"children":1334},{"style":951},[1335],{"type":52,"value":1336},"(attackerContract",{"type":47,"tag":168,"props":1338,"children":1339},{"style":602},[1340],{"type":52,"value":1268},{"type":47,"tag":168,"props":1342,"children":1343},{"style":1271},[1344],{"type":52,"value":1345},"getSender",{"type":47,"tag":168,"props":1347,"children":1348},{"style":951},[1349],{"type":52,"value":1350},"()",{"type":47,"tag":168,"props":1352,"children":1353},{"style":602},[1354],{"type":52,"value":1355},",",{"type":47,"tag":168,"props":1357,"children":1358},{"style":602},[1359],{"type":52,"value":1360}," {\n",{"type":47,"tag":168,"props":1362,"children":1363},{"class":170,"line":208},[1364,1370,1374,1379,1383,1388],{"type":47,"tag":168,"props":1365,"children":1367},{"style":1366},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[1368],{"type":52,"value":1369},"  op",{"type":47,"tag":168,"props":1371,"children":1372},{"style":602},[1373],{"type":52,"value":1172},{"type":47,"tag":168,"props":1375,"children":1376},{"style":951},[1377],{"type":52,"value":1378}," OP_CODES",{"type":47,"tag":168,"props":1380,"children":1381},{"style":602},[1382],{"type":52,"value":1268},{"type":47,"tag":168,"props":1384,"children":1385},{"style":951},[1386],{"type":52,"value":1387},"TRANSFER_NOTIFICATION",{"type":47,"tag":168,"props":1389,"children":1390},{"style":602},[1391],{"type":52,"value":1392},",\n",{"type":47,"tag":168,"props":1394,"children":1395},{"class":170,"line":217},[1396,1401,1405,1410,1414,1418,1423,1427,1431,1435],{"type":47,"tag":168,"props":1397,"children":1398},{"style":1366},[1399],{"type":52,"value":1400},"  jettonAmount",{"type":47,"tag":168,"props":1402,"children":1403},{"style":602},[1404],{"type":52,"value":1172},{"type":47,"tag":168,"props":1406,"children":1407},{"style":1271},[1408],{"type":52,"value":1409}," toNano",{"type":47,"tag":168,"props":1411,"children":1412},{"style":951},[1413],{"type":52,"value":1279},{"type":47,"tag":168,"props":1415,"children":1416},{"style":602},[1417],{"type":52,"value":616},{"type":47,"tag":168,"props":1419,"children":1420},{"style":608},[1421],{"type":52,"value":1422},"1000000",{"type":47,"tag":168,"props":1424,"children":1425},{"style":602},[1426],{"type":52,"value":616},{"type":47,"tag":168,"props":1428,"children":1429},{"style":951},[1430],{"type":52,"value":1297},{"type":47,"tag":168,"props":1432,"children":1433},{"style":602},[1434],{"type":52,"value":1355},{"type":47,"tag":168,"props":1436,"children":1437},{"style":587},[1438],{"type":52,"value":1439}," \u002F\u002F Fake amount\n",{"type":47,"tag":168,"props":1441,"children":1442},{"class":170,"line":226},[1443,1448,1452,1457,1461,1466],{"type":47,"tag":168,"props":1444,"children":1445},{"style":1366},[1446],{"type":52,"value":1447},"  fromUser",{"type":47,"tag":168,"props":1449,"children":1450},{"style":602},[1451],{"type":52,"value":1172},{"type":47,"tag":168,"props":1453,"children":1454},{"style":951},[1455],{"type":52,"value":1456}," attackerContract",{"type":47,"tag":168,"props":1458,"children":1459},{"style":602},[1460],{"type":52,"value":1268},{"type":47,"tag":168,"props":1462,"children":1463},{"style":951},[1464],{"type":52,"value":1465},"address",{"type":47,"tag":168,"props":1467,"children":1468},{"style":602},[1469],{"type":52,"value":1392},{"type":47,"tag":168,"props":1471,"children":1472},{"class":170,"line":234},[1473,1478,1482],{"type":47,"tag":168,"props":1474,"children":1475},{"style":602},[1476],{"type":52,"value":1477},"}",{"type":47,"tag":168,"props":1479,"children":1480},{"style":951},[1481],{"type":52,"value":1297},{"type":47,"tag":168,"props":1483,"children":1484},{"style":602},[1485],{"type":52,"value":1302},{"type":47,"tag":168,"props":1487,"children":1488},{"class":170,"line":243},[1489],{"type":47,"tag":168,"props":1490,"children":1491},{"emptyLinePlaceholder":193},[1492],{"type":52,"value":196},{"type":47,"tag":168,"props":1494,"children":1495},{"class":170,"line":252},[1496],{"type":47,"tag":168,"props":1497,"children":1498},{"style":587},[1499],{"type":52,"value":1500},"\u002F\u002F Attacker successfully credited without sending real Jettons\n",{"type":47,"tag":168,"props":1502,"children":1503},{"class":170,"line":260},[1504,1508,1513,1517,1521,1525,1529,1534,1538,1542,1547],{"type":47,"tag":168,"props":1505,"children":1506},{"style":1239},[1507],{"type":52,"value":1242},{"type":47,"tag":168,"props":1509,"children":1510},{"style":951},[1511],{"type":52,"value":1512}," balance ",{"type":47,"tag":168,"props":1514,"children":1515},{"style":602},[1516],{"type":52,"value":1252},{"type":47,"tag":168,"props":1518,"children":1519},{"style":1255},[1520],{"type":52,"value":1258},{"type":47,"tag":168,"props":1522,"children":1523},{"style":951},[1524],{"type":52,"value":1322},{"type":47,"tag":168,"props":1526,"children":1527},{"style":602},[1528],{"type":52,"value":1268},{"type":47,"tag":168,"props":1530,"children":1531},{"style":1271},[1532],{"type":52,"value":1533},"getUserBalance",{"type":47,"tag":168,"props":1535,"children":1536},{"style":951},[1537],{"type":52,"value":1336},{"type":47,"tag":168,"props":1539,"children":1540},{"style":602},[1541],{"type":52,"value":1268},{"type":47,"tag":168,"props":1543,"children":1544},{"style":951},[1545],{"type":52,"value":1546},"address)",{"type":47,"tag":168,"props":1548,"children":1549},{"style":602},[1550],{"type":52,"value":1302},{"type":47,"tag":168,"props":1552,"children":1553},{"class":170,"line":268},[1554,1559,1564,1568,1573,1577,1582,1586,1590,1594,1598,1603,1608],{"type":47,"tag":168,"props":1555,"children":1556},{"style":1271},[1557],{"type":52,"value":1558},"expect",{"type":47,"tag":168,"props":1560,"children":1561},{"style":951},[1562],{"type":52,"value":1563},"(balance)",{"type":47,"tag":168,"props":1565,"children":1566},{"style":602},[1567],{"type":52,"value":1268},{"type":47,"tag":168,"props":1569,"children":1570},{"style":1271},[1571],{"type":52,"value":1572},"toEqual",{"type":47,"tag":168,"props":1574,"children":1575},{"style":951},[1576],{"type":52,"value":1279},{"type":47,"tag":168,"props":1578,"children":1579},{"style":1271},[1580],{"type":52,"value":1581},"toNano",{"type":47,"tag":168,"props":1583,"children":1584},{"style":951},[1585],{"type":52,"value":1279},{"type":47,"tag":168,"props":1587,"children":1588},{"style":602},[1589],{"type":52,"value":616},{"type":47,"tag":168,"props":1591,"children":1592},{"style":608},[1593],{"type":52,"value":1422},{"type":47,"tag":168,"props":1595,"children":1596},{"style":602},[1597],{"type":52,"value":616},{"type":47,"tag":168,"props":1599,"children":1600},{"style":951},[1601],{"type":52,"value":1602},"))",{"type":47,"tag":168,"props":1604,"children":1605},{"style":602},[1606],{"type":52,"value":1607},";",{"type":47,"tag":168,"props":1609,"children":1610},{"style":587},[1611],{"type":52,"value":1612}," \u002F\u002F Attack succeeded\n",{"type":47,"tag":62,"props":1614,"children":1615},{},[1616,1621],{"type":47,"tag":128,"props":1617,"children":1618},{},[1619],{"type":52,"value":1620},"Recommendation",{"type":52,"value":1622},":\nStore expected Jetton wallet address and validate sender:",{"type":47,"tag":157,"props":1624,"children":1626},{"className":159,"code":1625,"language":161,"meta":162,"style":162},"global slice jetton_wallet_address;\n\n() recv_internal(...) impure {\n    load_data();  ;; Load jetton_wallet_address from storage\n\n    slice cs = in_msg_full.begin_parse();\n    int flags = cs~load_uint(4);\n    slice sender_address = cs~load_msg_addr();\n\n    int op = in_msg_body~load_uint(32);\n\n    if (op == op::transfer_notification) {\n        ;; CRITICAL: Validate sender\n        throw_unless(error::wrong_jetton_wallet,\n            equal_slices(sender_address, jetton_wallet_address));\n\n        int jetton_amount = in_msg_body~load_coins();\n        slice from_user = in_msg_body~load_msg_addr();\n\n        ;; Safe to credit user\n        credit_user(from_user, jetton_amount);\n    }\n}\n",[1627],{"type":47,"tag":136,"props":1628,"children":1629},{"__ignoreMap":162},[1630,1638,1645,1653,1661,1668,1676,1684,1692,1699,1707,1714,1722,1730,1738,1746,1753,1761,1769,1776,1785,1794,1803],{"type":47,"tag":168,"props":1631,"children":1632},{"class":170,"line":171},[1633],{"type":47,"tag":168,"props":1634,"children":1635},{},[1636],{"type":52,"value":1637},"global slice jetton_wallet_address;\n",{"type":47,"tag":168,"props":1639,"children":1640},{"class":170,"line":180},[1641],{"type":47,"tag":168,"props":1642,"children":1643},{"emptyLinePlaceholder":193},[1644],{"type":52,"value":196},{"type":47,"tag":168,"props":1646,"children":1647},{"class":170,"line":189},[1648],{"type":47,"tag":168,"props":1649,"children":1650},{},[1651],{"type":52,"value":1652},"() recv_internal(...) impure {\n",{"type":47,"tag":168,"props":1654,"children":1655},{"class":170,"line":199},[1656],{"type":47,"tag":168,"props":1657,"children":1658},{},[1659],{"type":52,"value":1660},"    load_data();  ;; Load jetton_wallet_address from storage\n",{"type":47,"tag":168,"props":1662,"children":1663},{"class":170,"line":208},[1664],{"type":47,"tag":168,"props":1665,"children":1666},{"emptyLinePlaceholder":193},[1667],{"type":52,"value":196},{"type":47,"tag":168,"props":1669,"children":1670},{"class":170,"line":217},[1671],{"type":47,"tag":168,"props":1672,"children":1673},{},[1674],{"type":52,"value":1675},"    slice cs = in_msg_full.begin_parse();\n",{"type":47,"tag":168,"props":1677,"children":1678},{"class":170,"line":226},[1679],{"type":47,"tag":168,"props":1680,"children":1681},{},[1682],{"type":52,"value":1683},"    int flags = cs~load_uint(4);\n",{"type":47,"tag":168,"props":1685,"children":1686},{"class":170,"line":234},[1687],{"type":47,"tag":168,"props":1688,"children":1689},{},[1690],{"type":52,"value":1691},"    slice sender_address = cs~load_msg_addr();\n",{"type":47,"tag":168,"props":1693,"children":1694},{"class":170,"line":243},[1695],{"type":47,"tag":168,"props":1696,"children":1697},{"emptyLinePlaceholder":193},[1698],{"type":52,"value":196},{"type":47,"tag":168,"props":1700,"children":1701},{"class":170,"line":252},[1702],{"type":47,"tag":168,"props":1703,"children":1704},{},[1705],{"type":52,"value":1706},"    int op = in_msg_body~load_uint(32);\n",{"type":47,"tag":168,"props":1708,"children":1709},{"class":170,"line":260},[1710],{"type":47,"tag":168,"props":1711,"children":1712},{"emptyLinePlaceholder":193},[1713],{"type":52,"value":196},{"type":47,"tag":168,"props":1715,"children":1716},{"class":170,"line":268},[1717],{"type":47,"tag":168,"props":1718,"children":1719},{},[1720],{"type":52,"value":1721},"    if (op == op::transfer_notification) {\n",{"type":47,"tag":168,"props":1723,"children":1724},{"class":170,"line":277},[1725],{"type":47,"tag":168,"props":1726,"children":1727},{},[1728],{"type":52,"value":1729},"        ;; CRITICAL: Validate sender\n",{"type":47,"tag":168,"props":1731,"children":1732},{"class":170,"line":286},[1733],{"type":47,"tag":168,"props":1734,"children":1735},{},[1736],{"type":52,"value":1737},"        throw_unless(error::wrong_jetton_wallet,\n",{"type":47,"tag":168,"props":1739,"children":1740},{"class":170,"line":295},[1741],{"type":47,"tag":168,"props":1742,"children":1743},{},[1744],{"type":52,"value":1745},"            equal_slices(sender_address, jetton_wallet_address));\n",{"type":47,"tag":168,"props":1747,"children":1748},{"class":170,"line":304},[1749],{"type":47,"tag":168,"props":1750,"children":1751},{"emptyLinePlaceholder":193},[1752],{"type":52,"value":196},{"type":47,"tag":168,"props":1754,"children":1755},{"class":170,"line":313},[1756],{"type":47,"tag":168,"props":1757,"children":1758},{},[1759],{"type":52,"value":1760},"        int jetton_amount = in_msg_body~load_coins();\n",{"type":47,"tag":168,"props":1762,"children":1763},{"class":170,"line":322},[1764],{"type":47,"tag":168,"props":1765,"children":1766},{},[1767],{"type":52,"value":1768},"        slice from_user = in_msg_body~load_msg_addr();\n",{"type":47,"tag":168,"props":1770,"children":1771},{"class":170,"line":1157},[1772],{"type":47,"tag":168,"props":1773,"children":1774},{"emptyLinePlaceholder":193},[1775],{"type":52,"value":196},{"type":47,"tag":168,"props":1777,"children":1779},{"class":170,"line":1778},20,[1780],{"type":47,"tag":168,"props":1781,"children":1782},{},[1783],{"type":52,"value":1784},"        ;; Safe to credit user\n",{"type":47,"tag":168,"props":1786,"children":1788},{"class":170,"line":1787},21,[1789],{"type":47,"tag":168,"props":1790,"children":1791},{},[1792],{"type":52,"value":1793},"        credit_user(from_user, jetton_amount);\n",{"type":47,"tag":168,"props":1795,"children":1797},{"class":170,"line":1796},22,[1798],{"type":47,"tag":168,"props":1799,"children":1800},{},[1801],{"type":52,"value":1802},"    }\n",{"type":47,"tag":168,"props":1804,"children":1806},{"class":170,"line":1805},23,[1807],{"type":47,"tag":168,"props":1808,"children":1809},{},[1810],{"type":52,"value":223},{"type":47,"tag":62,"props":1812,"children":1813},{},[1814,1819],{"type":47,"tag":128,"props":1815,"children":1816},{},[1817],{"type":52,"value":1818},"References",{"type":52,"value":1172},{"type":47,"tag":74,"props":1821,"children":1822},{},[1823],{"type":47,"tag":78,"props":1824,"children":1825},{},[1826],{"type":52,"value":1827},"building-secure-contracts\u002Fnot-so-smart-contracts\u002Fton\u002Ffake_jetton_contract",{"type":47,"tag":157,"props":1829,"children":1832},{"className":1830,"code":1831,"language":52},[520],"\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Fake Jetton contract (unauthorized minting\u002Fcrediting)\n\n### High (Fix Before Launch)\n- Integer as boolean (logic errors, broken conditions)\n- Forward TON without gas check (balance drainage)\n\n---\n\n## 8. Testing Recommendations\n\n### Unit Tests\n```typescript\nimport { Blockchain } from \"@ton\u002Fsandbox\";\nimport { toNano } from \"ton-core\";\n\ndescribe(\"Security tests\", () => {\n  let blockchain: Blockchain;\n  let contract: Contract;\n\n  beforeEach(async () => {\n    blockchain = await Blockchain.create();\n    contract = blockchain.openContract(await Contract.fromInit());\n  });\n\n  it(\"should use correct boolean values\", async () => {\n    \u002F\u002F Test that TRUE = -1, FALSE = 0\n    const result = await contract.getFlag();\n    expect(result).toEqual(-1n); \u002F\u002F True\n    expect(result).not.toEqual(1n); \u002F\u002F Not 1!\n  });\n\n  it(\"should reject fake jetton transfer\", async () => {\n    const attacker = await blockchain.treasury(\"attacker\");\n\n    const result = await contract.send(\n      attacker.getSender(),\n      { value: toNano(\"0.05\") },\n      {\n        $$type: \"TransferNotification\",\n        query_id: 0n,\n        amount: toNano(\"1000\"),\n        from: attacker.address,\n      }\n    );\n\n    expect(result.transactions).toHaveTransaction({\n      success: false, \u002F\u002F Should reject\n    });\n  });\n\n  it(\"should validate gas for forward amount\", async () => {\n    const result = await contract.send(\n      user.getSender(),\n      { value: toNano(\"0.01\") }, \u002F\u002F Insufficient gas\n      {\n        $$type: \"Transfer\",\n        to: recipient.address,\n        forward_ton_amount: toNano(\"1\"), \u002F\u002F Trying to forward 1 TON\n      }\n    );\n\n    expect(result.transactions).toHaveTransaction({\n      success: false,\n    });\n  });\n});\n",[1833],{"type":47,"tag":136,"props":1834,"children":1835},{"__ignoreMap":162},[1836],{"type":52,"value":1831},{"type":47,"tag":115,"props":1838,"children":1840},{"id":1839},"integration-tests",[1841],{"type":52,"value":1842},"Integration Tests",{"type":47,"tag":157,"props":1844,"children":1846},{"className":1219,"code":1845,"language":1221,"meta":162,"style":162},"\u002F\u002F Test with real Jetton wallet\nit(\"should accept transfer from real jetton wallet\", async () => {\n  \u002F\u002F Deploy actual Jetton minter and wallet\n  const jettonMinter = await blockchain.openContract(JettonMinter.create());\n  const userJettonWallet = await jettonMinter.getWalletAddress(user.address);\n\n  \u002F\u002F Set jetton wallet in contract\n  await contract.setJettonWallet(userJettonWallet);\n\n  \u002F\u002F Real transfer from Jetton wallet\n  const result = await userJettonWallet.sendTransfer(\n    user.getSender(),\n    contract.address,\n    toNano(\"100\"),\n    {}\n  );\n\n  expect(result.transactions).toHaveTransaction({\n    to: contract.address,\n    success: true,\n  });\n});\n",[1847],{"type":47,"tag":136,"props":1848,"children":1849},{"__ignoreMap":162},[1850,1858,1906,1914,1976,2034,2041,2049,2088,2095,2103,2141,2165,2185,2218,2226,2238,2245,2293,2321,2343,2359],{"type":47,"tag":168,"props":1851,"children":1852},{"class":170,"line":171},[1853],{"type":47,"tag":168,"props":1854,"children":1855},{"style":587},[1856],{"type":52,"value":1857},"\u002F\u002F Test with real Jetton wallet\n",{"type":47,"tag":168,"props":1859,"children":1860},{"class":170,"line":180},[1861,1866,1870,1874,1879,1883,1887,1892,1897,1902],{"type":47,"tag":168,"props":1862,"children":1863},{"style":1271},[1864],{"type":52,"value":1865},"it",{"type":47,"tag":168,"props":1867,"children":1868},{"style":951},[1869],{"type":52,"value":1279},{"type":47,"tag":168,"props":1871,"children":1872},{"style":602},[1873],{"type":52,"value":616},{"type":47,"tag":168,"props":1875,"children":1876},{"style":608},[1877],{"type":52,"value":1878},"should accept transfer from real jetton wallet",{"type":47,"tag":168,"props":1880,"children":1881},{"style":602},[1882],{"type":52,"value":616},{"type":47,"tag":168,"props":1884,"children":1885},{"style":602},[1886],{"type":52,"value":1355},{"type":47,"tag":168,"props":1888,"children":1889},{"style":1239},[1890],{"type":52,"value":1891}," async",{"type":47,"tag":168,"props":1893,"children":1894},{"style":602},[1895],{"type":52,"value":1896}," ()",{"type":47,"tag":168,"props":1898,"children":1899},{"style":1239},[1900],{"type":52,"value":1901}," =>",{"type":47,"tag":168,"props":1903,"children":1904},{"style":602},[1905],{"type":52,"value":1360},{"type":47,"tag":168,"props":1907,"children":1908},{"class":170,"line":189},[1909],{"type":47,"tag":168,"props":1910,"children":1911},{"style":587},[1912],{"type":52,"value":1913},"  \u002F\u002F Deploy actual Jetton minter and wallet\n",{"type":47,"tag":168,"props":1915,"children":1916},{"class":170,"line":199},[1917,1922,1927,1932,1936,1940,1944,1949,1953,1958,1962,1967,1972],{"type":47,"tag":168,"props":1918,"children":1919},{"style":1239},[1920],{"type":52,"value":1921},"  const",{"type":47,"tag":168,"props":1923,"children":1924},{"style":951},[1925],{"type":52,"value":1926}," jettonMinter",{"type":47,"tag":168,"props":1928,"children":1929},{"style":602},[1930],{"type":52,"value":1931}," =",{"type":47,"tag":168,"props":1933,"children":1934},{"style":1255},[1935],{"type":52,"value":1258},{"type":47,"tag":168,"props":1937,"children":1938},{"style":951},[1939],{"type":52,"value":1263},{"type":47,"tag":168,"props":1941,"children":1942},{"style":602},[1943],{"type":52,"value":1268},{"type":47,"tag":168,"props":1945,"children":1946},{"style":1271},[1947],{"type":52,"value":1948},"openContract",{"type":47,"tag":168,"props":1950,"children":1951},{"style":1366},[1952],{"type":52,"value":1279},{"type":47,"tag":168,"props":1954,"children":1955},{"style":951},[1956],{"type":52,"value":1957},"JettonMinter",{"type":47,"tag":168,"props":1959,"children":1960},{"style":602},[1961],{"type":52,"value":1268},{"type":47,"tag":168,"props":1963,"children":1964},{"style":1271},[1965],{"type":52,"value":1966},"create",{"type":47,"tag":168,"props":1968,"children":1969},{"style":1366},[1970],{"type":52,"value":1971},"())",{"type":47,"tag":168,"props":1973,"children":1974},{"style":602},[1975],{"type":52,"value":1302},{"type":47,"tag":168,"props":1977,"children":1978},{"class":170,"line":208},[1979,1983,1988,1992,1996,2000,2004,2009,2013,2018,2022,2026,2030],{"type":47,"tag":168,"props":1980,"children":1981},{"style":1239},[1982],{"type":52,"value":1921},{"type":47,"tag":168,"props":1984,"children":1985},{"style":951},[1986],{"type":52,"value":1987}," userJettonWallet",{"type":47,"tag":168,"props":1989,"children":1990},{"style":602},[1991],{"type":52,"value":1931},{"type":47,"tag":168,"props":1993,"children":1994},{"style":1255},[1995],{"type":52,"value":1258},{"type":47,"tag":168,"props":1997,"children":1998},{"style":951},[1999],{"type":52,"value":1926},{"type":47,"tag":168,"props":2001,"children":2002},{"style":602},[2003],{"type":52,"value":1268},{"type":47,"tag":168,"props":2005,"children":2006},{"style":1271},[2007],{"type":52,"value":2008},"getWalletAddress",{"type":47,"tag":168,"props":2010,"children":2011},{"style":1366},[2012],{"type":52,"value":1279},{"type":47,"tag":168,"props":2014,"children":2015},{"style":951},[2016],{"type":52,"value":2017},"user",{"type":47,"tag":168,"props":2019,"children":2020},{"style":602},[2021],{"type":52,"value":1268},{"type":47,"tag":168,"props":2023,"children":2024},{"style":951},[2025],{"type":52,"value":1465},{"type":47,"tag":168,"props":2027,"children":2028},{"style":1366},[2029],{"type":52,"value":1297},{"type":47,"tag":168,"props":2031,"children":2032},{"style":602},[2033],{"type":52,"value":1302},{"type":47,"tag":168,"props":2035,"children":2036},{"class":170,"line":217},[2037],{"type":47,"tag":168,"props":2038,"children":2039},{"emptyLinePlaceholder":193},[2040],{"type":52,"value":196},{"type":47,"tag":168,"props":2042,"children":2043},{"class":170,"line":226},[2044],{"type":47,"tag":168,"props":2045,"children":2046},{"style":587},[2047],{"type":52,"value":2048},"  \u002F\u002F Set jetton wallet in contract\n",{"type":47,"tag":168,"props":2050,"children":2051},{"class":170,"line":234},[2052,2057,2062,2066,2071,2075,2080,2084],{"type":47,"tag":168,"props":2053,"children":2054},{"style":1255},[2055],{"type":52,"value":2056},"  await",{"type":47,"tag":168,"props":2058,"children":2059},{"style":951},[2060],{"type":52,"value":2061}," contract",{"type":47,"tag":168,"props":2063,"children":2064},{"style":602},[2065],{"type":52,"value":1268},{"type":47,"tag":168,"props":2067,"children":2068},{"style":1271},[2069],{"type":52,"value":2070},"setJettonWallet",{"type":47,"tag":168,"props":2072,"children":2073},{"style":1366},[2074],{"type":52,"value":1279},{"type":47,"tag":168,"props":2076,"children":2077},{"style":951},[2078],{"type":52,"value":2079},"userJettonWallet",{"type":47,"tag":168,"props":2081,"children":2082},{"style":1366},[2083],{"type":52,"value":1297},{"type":47,"tag":168,"props":2085,"children":2086},{"style":602},[2087],{"type":52,"value":1302},{"type":47,"tag":168,"props":2089,"children":2090},{"class":170,"line":243},[2091],{"type":47,"tag":168,"props":2092,"children":2093},{"emptyLinePlaceholder":193},[2094],{"type":52,"value":196},{"type":47,"tag":168,"props":2096,"children":2097},{"class":170,"line":252},[2098],{"type":47,"tag":168,"props":2099,"children":2100},{"style":587},[2101],{"type":52,"value":2102},"  \u002F\u002F Real transfer from Jetton wallet\n",{"type":47,"tag":168,"props":2104,"children":2105},{"class":170,"line":260},[2106,2110,2115,2119,2123,2127,2131,2136],{"type":47,"tag":168,"props":2107,"children":2108},{"style":1239},[2109],{"type":52,"value":1921},{"type":47,"tag":168,"props":2111,"children":2112},{"style":951},[2113],{"type":52,"value":2114}," result",{"type":47,"tag":168,"props":2116,"children":2117},{"style":602},[2118],{"type":52,"value":1931},{"type":47,"tag":168,"props":2120,"children":2121},{"style":1255},[2122],{"type":52,"value":1258},{"type":47,"tag":168,"props":2124,"children":2125},{"style":951},[2126],{"type":52,"value":1987},{"type":47,"tag":168,"props":2128,"children":2129},{"style":602},[2130],{"type":52,"value":1268},{"type":47,"tag":168,"props":2132,"children":2133},{"style":1271},[2134],{"type":52,"value":2135},"sendTransfer",{"type":47,"tag":168,"props":2137,"children":2138},{"style":1366},[2139],{"type":52,"value":2140},"(\n",{"type":47,"tag":168,"props":2142,"children":2143},{"class":170,"line":268},[2144,2149,2153,2157,2161],{"type":47,"tag":168,"props":2145,"children":2146},{"style":951},[2147],{"type":52,"value":2148},"    user",{"type":47,"tag":168,"props":2150,"children":2151},{"style":602},[2152],{"type":52,"value":1268},{"type":47,"tag":168,"props":2154,"children":2155},{"style":1271},[2156],{"type":52,"value":1345},{"type":47,"tag":168,"props":2158,"children":2159},{"style":1366},[2160],{"type":52,"value":1350},{"type":47,"tag":168,"props":2162,"children":2163},{"style":602},[2164],{"type":52,"value":1392},{"type":47,"tag":168,"props":2166,"children":2167},{"class":170,"line":277},[2168,2173,2177,2181],{"type":47,"tag":168,"props":2169,"children":2170},{"style":951},[2171],{"type":52,"value":2172},"    contract",{"type":47,"tag":168,"props":2174,"children":2175},{"style":602},[2176],{"type":52,"value":1268},{"type":47,"tag":168,"props":2178,"children":2179},{"style":951},[2180],{"type":52,"value":1465},{"type":47,"tag":168,"props":2182,"children":2183},{"style":602},[2184],{"type":52,"value":1392},{"type":47,"tag":168,"props":2186,"children":2187},{"class":170,"line":286},[2188,2193,2197,2201,2206,2210,2214],{"type":47,"tag":168,"props":2189,"children":2190},{"style":1271},[2191],{"type":52,"value":2192},"    toNano",{"type":47,"tag":168,"props":2194,"children":2195},{"style":1366},[2196],{"type":52,"value":1279},{"type":47,"tag":168,"props":2198,"children":2199},{"style":602},[2200],{"type":52,"value":616},{"type":47,"tag":168,"props":2202,"children":2203},{"style":608},[2204],{"type":52,"value":2205},"100",{"type":47,"tag":168,"props":2207,"children":2208},{"style":602},[2209],{"type":52,"value":616},{"type":47,"tag":168,"props":2211,"children":2212},{"style":1366},[2213],{"type":52,"value":1297},{"type":47,"tag":168,"props":2215,"children":2216},{"style":602},[2217],{"type":52,"value":1392},{"type":47,"tag":168,"props":2219,"children":2220},{"class":170,"line":295},[2221],{"type":47,"tag":168,"props":2222,"children":2223},{"style":602},[2224],{"type":52,"value":2225},"    {}\n",{"type":47,"tag":168,"props":2227,"children":2228},{"class":170,"line":304},[2229,2234],{"type":47,"tag":168,"props":2230,"children":2231},{"style":1366},[2232],{"type":52,"value":2233},"  )",{"type":47,"tag":168,"props":2235,"children":2236},{"style":602},[2237],{"type":52,"value":1302},{"type":47,"tag":168,"props":2239,"children":2240},{"class":170,"line":313},[2241],{"type":47,"tag":168,"props":2242,"children":2243},{"emptyLinePlaceholder":193},[2244],{"type":52,"value":196},{"type":47,"tag":168,"props":2246,"children":2247},{"class":170,"line":322},[2248,2253,2257,2262,2266,2271,2275,2279,2284,2288],{"type":47,"tag":168,"props":2249,"children":2250},{"style":1271},[2251],{"type":52,"value":2252},"  expect",{"type":47,"tag":168,"props":2254,"children":2255},{"style":1366},[2256],{"type":52,"value":1279},{"type":47,"tag":168,"props":2258,"children":2259},{"style":951},[2260],{"type":52,"value":2261},"result",{"type":47,"tag":168,"props":2263,"children":2264},{"style":602},[2265],{"type":52,"value":1268},{"type":47,"tag":168,"props":2267,"children":2268},{"style":951},[2269],{"type":52,"value":2270},"transactions",{"type":47,"tag":168,"props":2272,"children":2273},{"style":1366},[2274],{"type":52,"value":1297},{"type":47,"tag":168,"props":2276,"children":2277},{"style":602},[2278],{"type":52,"value":1268},{"type":47,"tag":168,"props":2280,"children":2281},{"style":1271},[2282],{"type":52,"value":2283},"toHaveTransaction",{"type":47,"tag":168,"props":2285,"children":2286},{"style":1366},[2287],{"type":52,"value":1279},{"type":47,"tag":168,"props":2289,"children":2290},{"style":602},[2291],{"type":52,"value":2292},"{\n",{"type":47,"tag":168,"props":2294,"children":2295},{"class":170,"line":1157},[2296,2301,2305,2309,2313,2317],{"type":47,"tag":168,"props":2297,"children":2298},{"style":1366},[2299],{"type":52,"value":2300},"    to",{"type":47,"tag":168,"props":2302,"children":2303},{"style":602},[2304],{"type":52,"value":1172},{"type":47,"tag":168,"props":2306,"children":2307},{"style":951},[2308],{"type":52,"value":2061},{"type":47,"tag":168,"props":2310,"children":2311},{"style":602},[2312],{"type":52,"value":1268},{"type":47,"tag":168,"props":2314,"children":2315},{"style":951},[2316],{"type":52,"value":1465},{"type":47,"tag":168,"props":2318,"children":2319},{"style":602},[2320],{"type":52,"value":1392},{"type":47,"tag":168,"props":2322,"children":2323},{"class":170,"line":1778},[2324,2329,2333,2339],{"type":47,"tag":168,"props":2325,"children":2326},{"style":1366},[2327],{"type":52,"value":2328},"    success",{"type":47,"tag":168,"props":2330,"children":2331},{"style":602},[2332],{"type":52,"value":1172},{"type":47,"tag":168,"props":2334,"children":2336},{"style":2335},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[2337],{"type":52,"value":2338}," true",{"type":47,"tag":168,"props":2340,"children":2341},{"style":602},[2342],{"type":52,"value":1392},{"type":47,"tag":168,"props":2344,"children":2345},{"class":170,"line":1787},[2346,2351,2355],{"type":47,"tag":168,"props":2347,"children":2348},{"style":602},[2349],{"type":52,"value":2350},"  }",{"type":47,"tag":168,"props":2352,"children":2353},{"style":1366},[2354],{"type":52,"value":1297},{"type":47,"tag":168,"props":2356,"children":2357},{"style":602},[2358],{"type":52,"value":1302},{"type":47,"tag":168,"props":2360,"children":2361},{"class":170,"line":1796},[2362,2366,2370],{"type":47,"tag":168,"props":2363,"children":2364},{"style":602},[2365],{"type":52,"value":1477},{"type":47,"tag":168,"props":2367,"children":2368},{"style":951},[2369],{"type":52,"value":1297},{"type":47,"tag":168,"props":2371,"children":2372},{"style":602},[2373],{"type":52,"value":1302},{"type":47,"tag":435,"props":2375,"children":2376},{},[],{"type":47,"tag":55,"props":2378,"children":2380},{"id":2379},"_9-additional-resources",[2381],{"type":52,"value":2382},"9. Additional Resources",{"type":47,"tag":74,"props":2384,"children":2385},{},[2386,2401,2418,2433,2447],{"type":47,"tag":78,"props":2387,"children":2388},{},[2389,2394,2395],{"type":47,"tag":128,"props":2390,"children":2391},{},[2392],{"type":52,"value":2393},"Building Secure Contracts",{"type":52,"value":134},{"type":47,"tag":136,"props":2396,"children":2398},{"className":2397},[],[2399],{"type":52,"value":2400},"building-secure-contracts\u002Fnot-so-smart-contracts\u002Fton\u002F",{"type":47,"tag":78,"props":2402,"children":2403},{},[2404,2409,2410],{"type":47,"tag":128,"props":2405,"children":2406},{},[2407],{"type":52,"value":2408},"TON Documentation",{"type":52,"value":134},{"type":47,"tag":2411,"props":2412,"children":2416},"a",{"href":2413,"rel":2414},"https:\u002F\u002Fdocs.ton.org\u002F",[2415],"nofollow",[2417],{"type":52,"value":2413},{"type":47,"tag":78,"props":2419,"children":2420},{},[2421,2426,2427],{"type":47,"tag":128,"props":2422,"children":2423},{},[2424],{"type":52,"value":2425},"FunC Documentation",{"type":52,"value":134},{"type":47,"tag":2411,"props":2428,"children":2431},{"href":2429,"rel":2430},"https:\u002F\u002Fdocs.ton.org\u002Fdevelop\u002Ffunc\u002Foverview",[2415],[2432],{"type":52,"value":2429},{"type":47,"tag":78,"props":2434,"children":2435},{},[2436,2440,2441],{"type":47,"tag":128,"props":2437,"children":2438},{},[2439],{"type":52,"value":406},{"type":52,"value":134},{"type":47,"tag":2411,"props":2442,"children":2445},{"href":2443,"rel":2444},"https:\u002F\u002Fgithub.com\u002Fton-org\u002Fblueprint",[2415],[2446],{"type":52,"value":2443},{"type":47,"tag":78,"props":2448,"children":2449},{},[2450,2455,2456],{"type":47,"tag":128,"props":2451,"children":2452},{},[2453],{"type":52,"value":2454},"Jetton Standard",{"type":52,"value":134},{"type":47,"tag":2411,"props":2457,"children":2460},{"href":2458,"rel":2459},"https:\u002F\u002Fgithub.com\u002Fton-blockchain\u002FTEPs\u002Fblob\u002Fmaster\u002Ftext\u002F0074-jettons-standard.md",[2415],[2461],{"type":52,"value":2458},{"type":47,"tag":435,"props":2463,"children":2464},{},[],{"type":47,"tag":55,"props":2466,"children":2468},{"id":2467},"_10-quick-reference-checklist",[2469],{"type":52,"value":2470},"10. Quick Reference Checklist",{"type":47,"tag":62,"props":2472,"children":2473},{},[2474],{"type":52,"value":2475},"Before completing TON contract audit:",{"type":47,"tag":62,"props":2477,"children":2478},{},[2479,2484],{"type":47,"tag":128,"props":2480,"children":2481},{},[2482],{"type":52,"value":2483},"Boolean Logic (HIGH)",{"type":52,"value":1172},{"type":47,"tag":74,"props":2486,"children":2488},{"className":2487},[535],[2489,2498,2507,2516,2544],{"type":47,"tag":78,"props":2490,"children":2492},{"className":2491},[540],[2493,2496],{"type":47,"tag":543,"props":2494,"children":2495},{"disabled":193,"type":545},[],{"type":52,"value":2497}," All boolean values use -1 (true) and 0 (false)",{"type":47,"tag":78,"props":2499,"children":2501},{"className":2500},[540],[2502,2505],{"type":47,"tag":543,"props":2503,"children":2504},{"disabled":193,"type":545},[],{"type":52,"value":2506}," NO positive integers (1, 2, etc.) used as booleans",{"type":47,"tag":78,"props":2508,"children":2510},{"className":2509},[540],[2511,2514],{"type":47,"tag":543,"props":2512,"children":2513},{"disabled":193,"type":545},[],{"type":52,"value":2515}," Functions returning booleans return -1 for true",{"type":47,"tag":78,"props":2517,"children":2519},{"className":2518},[540],[2520,2523,2525,2530,2531,2536,2537,2542],{"type":47,"tag":543,"props":2521,"children":2522},{"disabled":193,"type":545},[],{"type":52,"value":2524}," Boolean logic with ",{"type":47,"tag":136,"props":2526,"children":2528},{"className":2527},[],[2529],{"type":52,"value":844},{"type":52,"value":143},{"type":47,"tag":136,"props":2532,"children":2534},{"className":2533},[],[2535],{"type":52,"value":851},{"type":52,"value":143},{"type":47,"tag":136,"props":2538,"children":2540},{"className":2539},[],[2541],{"type":52,"value":858},{"type":52,"value":2543}," uses correct values",{"type":47,"tag":78,"props":2545,"children":2547},{"className":2546},[540],[2548,2551],{"type":47,"tag":543,"props":2549,"children":2550},{"disabled":193,"type":545},[],{"type":52,"value":2552}," Tests verify boolean operations work correctly",{"type":47,"tag":62,"props":2554,"children":2555},{},[2556,2561],{"type":47,"tag":128,"props":2557,"children":2558},{},[2559],{"type":52,"value":2560},"Jetton Security (CRITICAL)",{"type":52,"value":1172},{"type":47,"tag":74,"props":2563,"children":2565},{"className":2564},[535],[2566,2582,2590,2599,2608,2616],{"type":47,"tag":78,"props":2567,"children":2569},{"className":2568},[540],[2570,2573,2575,2580],{"type":47,"tag":543,"props":2571,"children":2572},{"disabled":193,"type":545},[],{"type":52,"value":2574}," ",{"type":47,"tag":136,"props":2576,"children":2578},{"className":2577},[],[2579],{"type":52,"value":1017},{"type":52,"value":2581}," handler validates sender address",{"type":47,"tag":78,"props":2583,"children":2585},{"className":2584},[540],[2586,2589],{"type":47,"tag":543,"props":2587,"children":2588},{"disabled":193,"type":545},[],{"type":52,"value":648},{"type":47,"tag":78,"props":2591,"children":2593},{"className":2592},[540],[2594,2597],{"type":47,"tag":543,"props":2595,"children":2596},{"disabled":193,"type":545},[],{"type":52,"value":2598}," Jetton wallet address stored during initialization",{"type":47,"tag":78,"props":2600,"children":2602},{"className":2601},[540],[2603,2606],{"type":47,"tag":543,"props":2604,"children":2605},{"disabled":193,"type":545},[],{"type":52,"value":2607}," Admin function to set\u002Fupdate Jetton wallet",{"type":47,"tag":78,"props":2609,"children":2611},{"className":2610},[540],[2612,2615],{"type":47,"tag":543,"props":2613,"children":2614},{"disabled":193,"type":545},[],{"type":52,"value":657},{"type":47,"tag":78,"props":2617,"children":2619},{"className":2618},[540],[2620,2623],{"type":47,"tag":543,"props":2621,"children":2622},{"disabled":193,"type":545},[],{"type":52,"value":2624}," Tests with fake Jetton contracts verify rejection",{"type":47,"tag":62,"props":2626,"children":2627},{},[2628,2633],{"type":47,"tag":128,"props":2629,"children":2630},{},[2631],{"type":52,"value":2632},"Gas & Forward Amounts (HIGH)",{"type":52,"value":1172},{"type":47,"tag":74,"props":2635,"children":2637},{"className":2636},[535],[2638,2647,2662,2671,2687],{"type":47,"tag":78,"props":2639,"children":2641},{"className":2640},[540],[2642,2645],{"type":47,"tag":543,"props":2643,"children":2644},{"disabled":193,"type":545},[],{"type":52,"value":2646}," Forward TON amounts are fixed\u002Fbounded",{"type":47,"tag":78,"props":2648,"children":2650},{"className":2649},[540],[2651,2654,2656],{"type":47,"tag":543,"props":2652,"children":2653},{"disabled":193,"type":545},[],{"type":52,"value":2655}," OR user-provided amounts validated: ",{"type":47,"tag":136,"props":2657,"children":2659},{"className":2658},[],[2660],{"type":52,"value":2661},"msg_value >= tx_fee + forward_amount",{"type":47,"tag":78,"props":2663,"children":2665},{"className":2664},[540],[2666,2669],{"type":47,"tag":543,"props":2667,"children":2668},{"disabled":193,"type":545},[],{"type":52,"value":2670}," Contract balance protected from drainage",{"type":47,"tag":78,"props":2672,"children":2674},{"className":2673},[540],[2675,2678,2680,2685],{"type":47,"tag":543,"props":2676,"children":2677},{"disabled":193,"type":545},[],{"type":52,"value":2679}," Appropriate ",{"type":47,"tag":136,"props":2681,"children":2683},{"className":2682},[],[2684],{"type":52,"value":766},{"type":52,"value":2686}," flags used",{"type":47,"tag":78,"props":2688,"children":2690},{"className":2689},[540],[2691,2694],{"type":47,"tag":543,"props":2692,"children":2693},{"disabled":193,"type":545},[],{"type":52,"value":2695}," Tests verify cannot drain contract with excessive forward amounts",{"type":47,"tag":62,"props":2697,"children":2698},{},[2699,2704],{"type":47,"tag":128,"props":2700,"children":2701},{},[2702],{"type":52,"value":2703},"Testing",{"type":52,"value":1172},{"type":47,"tag":74,"props":2706,"children":2708},{"className":2707},[535],[2709,2718,2727,2736],{"type":47,"tag":78,"props":2710,"children":2712},{"className":2711},[540],[2713,2716],{"type":47,"tag":543,"props":2714,"children":2715},{"disabled":193,"type":545},[],{"type":52,"value":2717}," Unit tests for all three vulnerability types",{"type":47,"tag":78,"props":2719,"children":2721},{"className":2720},[540],[2722,2725],{"type":47,"tag":543,"props":2723,"children":2724},{"disabled":193,"type":545},[],{"type":52,"value":2726}," Integration tests with real Jetton contracts",{"type":47,"tag":78,"props":2728,"children":2730},{"className":2729},[540],[2731,2734],{"type":47,"tag":543,"props":2732,"children":2733},{"disabled":193,"type":545},[],{"type":52,"value":2735}," Gas cost analysis for all operations",{"type":47,"tag":78,"props":2737,"children":2739},{"className":2738},[540],[2740,2743],{"type":47,"tag":543,"props":2741,"children":2742},{"disabled":193,"type":545},[],{"type":52,"value":2744}," Testnet deployment before mainnet",{"type":47,"tag":2746,"props":2747,"children":2748},"style",{},[2749],{"type":52,"value":2750},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2752,"total":2843},[2753,2769,2779,2797,2808,2821,2833],{"slug":2754,"name":2754,"fn":2755,"description":2756,"org":2757,"tags":2758,"stars":29,"repoUrl":30,"updatedAt":2768},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2759,2762,2765,2766],{"name":2760,"slug":2761,"type":16},"C#","c",{"name":2763,"slug":2764,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":2703,"slug":2767,"type":16},"testing","2026-07-17T06:05:14.925095",{"slug":2770,"name":2770,"fn":2771,"description":2772,"org":2773,"tags":2774,"stars":29,"repoUrl":30,"updatedAt":2778},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2775,2776,2777],{"name":2760,"slug":2761,"type":16},{"name":14,"slug":15,"type":16},{"name":2703,"slug":2767,"type":16},"2026-07-17T06:05:12.433192",{"slug":2780,"name":2780,"fn":2781,"description":2782,"org":2783,"tags":2784,"stars":29,"repoUrl":30,"updatedAt":2796},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2785,2788,2791,2792,2795],{"name":2786,"slug":2787,"type":16},"Agents","agents",{"name":2789,"slug":2790,"type":16},"CI\u002FCD","ci-cd",{"name":27,"slug":28,"type":16},{"name":2793,"slug":2794,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":2798,"name":2798,"fn":2799,"description":2800,"org":2801,"tags":2802,"stars":29,"repoUrl":30,"updatedAt":2807},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2803,2804,2805,2806],{"name":21,"slug":22,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},{"name":24,"slug":25,"type":16},"2026-07-18T05:47:43.989063",{"slug":2809,"name":2809,"fn":2810,"description":2811,"org":2812,"tags":2813,"stars":29,"repoUrl":30,"updatedAt":2820},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2814,2817],{"name":2815,"slug":2816,"type":16},"Engineering","engineering",{"name":2818,"slug":2819,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":2822,"name":2822,"fn":2823,"description":2824,"org":2825,"tags":2826,"stars":29,"repoUrl":30,"updatedAt":2832},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2827,2830,2831],{"name":2828,"slug":2829,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":2703,"slug":2767,"type":16},"2026-07-17T06:05:14.575191",{"slug":2834,"name":2834,"fn":2835,"description":2836,"org":2837,"tags":2838,"stars":29,"repoUrl":30,"updatedAt":2842},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2839,2840,2841],{"name":21,"slug":22,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",77,{"items":2845,"total":2949},[2846,2853,2859,2867,2874,2879,2885,2891,2904,2915,2927,2938],{"slug":2754,"name":2754,"fn":2755,"description":2756,"org":2847,"tags":2848,"stars":29,"repoUrl":30,"updatedAt":2768},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2849,2850,2851,2852],{"name":2760,"slug":2761,"type":16},{"name":2763,"slug":2764,"type":16},{"name":14,"slug":15,"type":16},{"name":2703,"slug":2767,"type":16},{"slug":2770,"name":2770,"fn":2771,"description":2772,"org":2854,"tags":2855,"stars":29,"repoUrl":30,"updatedAt":2778},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2856,2857,2858],{"name":2760,"slug":2761,"type":16},{"name":14,"slug":15,"type":16},{"name":2703,"slug":2767,"type":16},{"slug":2780,"name":2780,"fn":2781,"description":2782,"org":2860,"tags":2861,"stars":29,"repoUrl":30,"updatedAt":2796},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2862,2863,2864,2865,2866],{"name":2786,"slug":2787,"type":16},{"name":2789,"slug":2790,"type":16},{"name":27,"slug":28,"type":16},{"name":2793,"slug":2794,"type":16},{"name":14,"slug":15,"type":16},{"slug":2798,"name":2798,"fn":2799,"description":2800,"org":2868,"tags":2869,"stars":29,"repoUrl":30,"updatedAt":2807},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2870,2871,2872,2873],{"name":21,"slug":22,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},{"name":24,"slug":25,"type":16},{"slug":2809,"name":2809,"fn":2810,"description":2811,"org":2875,"tags":2876,"stars":29,"repoUrl":30,"updatedAt":2820},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2877,2878],{"name":2815,"slug":2816,"type":16},{"name":2818,"slug":2819,"type":16},{"slug":2822,"name":2822,"fn":2823,"description":2824,"org":2880,"tags":2881,"stars":29,"repoUrl":30,"updatedAt":2832},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2882,2883,2884],{"name":2828,"slug":2829,"type":16},{"name":14,"slug":15,"type":16},{"name":2703,"slug":2767,"type":16},{"slug":2834,"name":2834,"fn":2835,"description":2836,"org":2886,"tags":2887,"stars":29,"repoUrl":30,"updatedAt":2842},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2888,2889,2890],{"name":21,"slug":22,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},{"slug":2892,"name":2892,"fn":2893,"description":2894,"org":2895,"tags":2896,"stars":29,"repoUrl":30,"updatedAt":2903},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2897,2900,2901,2902],{"name":2898,"slug":2899,"type":16},"Architecture","architecture",{"name":21,"slug":22,"type":16},{"name":27,"slug":28,"type":16},{"name":2815,"slug":2816,"type":16},"2026-07-18T05:47:40.122449",{"slug":2905,"name":2905,"fn":2906,"description":2907,"org":2908,"tags":2909,"stars":29,"repoUrl":30,"updatedAt":2914},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2910,2911,2912,2913],{"name":21,"slug":22,"type":16},{"name":27,"slug":28,"type":16},{"name":2815,"slug":2816,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":2916,"name":2916,"fn":2917,"description":2918,"org":2919,"tags":2920,"stars":29,"repoUrl":30,"updatedAt":2926},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2921,2922,2925],{"name":21,"slug":22,"type":16},{"name":2923,"slug":2924,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":2928,"name":2928,"fn":2929,"description":2930,"org":2931,"tags":2932,"stars":29,"repoUrl":30,"updatedAt":2937},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2933,2934,2935,2936],{"name":21,"slug":22,"type":16},{"name":2760,"slug":2761,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":2939,"name":2939,"fn":2940,"description":2941,"org":2942,"tags":2943,"stars":29,"repoUrl":30,"updatedAt":2948},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2944,2945,2946,2947],{"name":21,"slug":22,"type":16},{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},{"name":24,"slug":25,"type":16},"2026-07-18T05:47:42.84568",111]