TON Smart Contract Security Deep Dive

TON Blockchain Overview

The Open Network (TON) is a Layer 1 blockchain originally designed by Telegram. Its unique actor model and FunC programming language present distinct security challenges compared to EVM-based chains.

FunC Security Considerations

FunC is a domain-specific language for TON smart contracts. Its low-level nature requires careful attention to security.

() recv_internal(int msg_value, cell in_msg_full, slice in_msg_body) impure {
    ;; Always check message source and value
    if (msg_value < min_value) {
        throw(error::insufficient_value);
    }
    
    ;; Parse sender address
    slice cs = in_msg_full.begin_parse();
    int flags = cs~load_uint(4);
    slice sender = cs~load_msg_addr();
    
    ;; Verify sender authorization
    throw_unless(error::unauthorized, equal_slices(sender, owner));
}

Common Vulnerabilities

• Improper message validation leading to unauthorized access
• Integer overflow in token calculations
• Missing bounce handling causing stuck funds
• Race conditions in async message processing
• Incorrect gas estimation leading to failed transactions