ton-vulnerability-scanner
Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.
npx skills add trailofbits/skills --skill ton-vulnerability-scanner --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# TON Vulnerability Scanner ## 1. Purpose Systematically scan TON blockchain smart contracts written in FunC for platform-specific security vulnerabilities related to boolean logic, Jetton token handling, and gas management. This skill encodes 3 critical vulnerability patterns unique to TON's architecture. ## 2. When to Use This Skill - Auditing TON smart contracts (FunC language) - Reviewing Jetton token implementations - Validating token transfer notification handlers - Pre-launch security assessment of TON dApps - Reviewing gas forwarding logic - Assessing boolean condition handling ## 3. Platform Detection ### File Extensions & Indicators - **FunC files**: `.fc`, `.func` ### Language/Framework Markers ```func ;; FunC contract indicators #include "imports/stdlib.fc"; () recv_internal(int my_balance, int msg_value, cell in_msg_full, slice in_msg_body) impure { ;; Contract logic } () recv_external(slice in_msg) impure { ;; External message handler } ;; Common patterns send_raw_message() load_uint(), load_msg_addr(), load_coins() begin_cell(), end_cell(), store_*() transfer_notification operation op::transfer, op::transfer_notification .store_uint().store_slice().store_coins() ```
- 1. Purpose
- 2. When to Use This Skill
- 3. Platform Detection
- File Extensions & Indicators
- Language/Framework Markers
- Project Structure
- Tool Support
- 4. How This Skill Works
- 5. Example Output
- [CRITICAL] Fake Jetton Contract - Missing Sender Validation
- 9. Additional Resources
- 10. Quick Reference Checklist
What does the ton-vulnerability-scanner skill do?
Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.
How do I install it?
Run `npx skills add trailofbits/skills --skill ton-vulnerability-scanner --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From trailofbits/skills, a repository with 6,426 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.