[{"data":1,"prerenderedAt":45},["Reactive",2],{"tonbit-home-blogs":3},{"items":4,"total":42,"page":43,"pageSize":44},[5,20,32],{"slug":6,"category":7,"categoryLabel":8,"subcategoryLabel":9,"authorName":10,"title":11,"excerpt":12,"contentHtml":13,"coverUrl":14,"seoTitle":11,"seoDescription":15,"seoImageUrl":14,"publishedAt":16,"readTime":17,"cover":14,"coverAlt":18,"hasCover":19},"tonbit-discovers-critical-vulnerability-on-ton-virtual-machine-for-the-third-time-once-again-receiving-official-recognition-from-the-ton-team","research","Research","Incident Analysis","TonBit","TonBit Discovers Critical Vulnerability on TON Virtual Machine for the Third Time, Once Again Receiving Official Recognition from the TON Team","TonBit, a subsidiary of BitsLab, has once again discovered a critical vulnerability in the TON Virtual Machine for third time, and again received official acknowledgment from the TON team. The issue lies in the INMSGPARAM instruction, which fails to perform a null-pointer check when handling message parameters, potentially causing the TON VM to crash","\u003Cp>TonBit, a subsidiary of BitsLab, has once again discovered a critical vulnerability in the TON Virtual Machine for third time, and again received official acknowledgment from the TON team. The issue lies in the INMSGPARAM instruction, which fails to perform a null-pointer check when handling message parameters, potentially causing the TON VM to crash.\u003C/p>\n\u003Cp>Link to TON’s official patch and acknowledgment of TonBit:\n\u003Ca href=\"https://github.com/ton-blockchain/ton/releases/tag/v2025.06\">https://github.com/ton-blockchain/ton/releases/tag/v2025.06\u003C/a>\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/52a22b1cd9817513c329226e2675f345.png\" alt=\"Figure1\" title=\"Figure1\">\u003C/p>\n\u003Cp>Details of the Issue\u003C/p>\n\u003Cp>Recently, TonBit, a subsidiary of BitsLab, discovered a critical security vulnerability in the latest TVM source code (master branch / TON v2025.04). The issue lies in the INMSGPARAM instruction, which fails to perform a null-pointer check when handling message parameters, potentially leading to a crash of the TON Virtual Machine. This vulnerability is deeply embedded within the TVM’s internal call flow, allowing an attacker to craft specially constructed message parameters that trigger a null pointer dereference during execution, causing the VM to halt. This poses a serious threat to the availability and stability of smart contract execution. The following content retains technical details for developers to analyze and mitigate accordingly.\nWe discovered this vulnerability before the Global Version 11 went live and immediately reported it to the Ton Core team, thereby preventing any on-chain assets from being at risk. Ton Core analyzed our report, patched the issue before official release, and awarded us a bounty along with formal thanks. We sincerely appreciate Ton Core’s professionalism and integrity.\u003C/p>\n\u003Cp>Affected Code (in crypto/vm/tonops.cpp):\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/b95b1b223d8fd0ff43bb147780604a4f.png\" alt=\"Figure2\" title=\"Figure2\">\u003C/p>\n\u003Cp>Root cause:\u003C/p>\n\u003Cp>This line of code\u003C/p>\n\u003Cp>Ref t = get_param(st, inmsgparams_idx).as_tuple();\u003C/p>\n\u003Cp>does not check whether the variable t is nullptr. If register c7’s slot 0 is configured as a tuple whose 17th element is not of Tuple type, as_tuple() will return a null pointer. When that null pointer t is passed into tuple_index, it triggers a null-pointer dereference, causing the VM to crash. This critical error can be reliably reproduced in Global Version 11.\u003C/p>\n\u003Cp>PoC code:\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/775d406454f09def77d10eaa49006eb8.png\" alt=\"Figure3\" title=\"Figure3\">\u003C/p>\n\u003Cp>Reproduction Steps:\u003C/p>\n\u003Cp>To facilitate local testing (since global_version is typically configured by the chain), we modified the VM initialization in the A run_vm_code function to set forcibly global_version to 11:\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/ec693e03574c4d9bae1a776a5983c47c.png\" alt=\"Figure4\" title=\"Figure4\">\u003C/p>\n\u003Cp>Copy the PoC code into the crypto/test/vm.cpp file.\nModify the run_vm_code function as described above to set global_version to 11.\nCompile and run the test-vm executable.\u003C/p>\n\u003Cp>Crash: The virtual machine will crash due to a null-pointer dereference.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/f3dd5900548f49d64ed085e15afaee93.png\" alt=\"Figure5\" title=\"Figure5\">\u003C/p>\n\u003Cp>In conclusion, TonBit, a subsidiary of BitsLab, has consistently upheld the principles of “deep security and responsible disclosure,” continuously identifying and resolving critical vulnerabilities within the core code of the TON Virtual Machine. From the non-atomic migration risk in the RUNVM instruction to the null-pointer dereference issue in the INMSGPARAM Instruction, TonBit has demonstrated strong technical expertise and a prompt response, reporting issues to Ton Core at the earliest opportunity and assisting in timely fixes. These efforts have not only effectively safeguarded on-chain assets but also enhanced the stability and reliability of the TVM. Looking ahead, TonBit will continue to work closely with Ton Core and the community to build a more robust security foundation for the Web3 ecosystem.\u003C/p>\n\u003Cp>About TonBit \u003C/p>\n\u003Cp>TonBit, a core sub-brand of BitsLab, is a security expert and early contributor within the TON ecosystem. As the primary Security Assurance Provider (SAP) for the TON blockchain, TonBit specializes in comprehensive security audits, covering both Tact and FunC languages, to ensure the integrity and resilience of TON-based projects.\u003C/p>\n\u003Cp>To date, TonBit has successfully audited several well-known projects, including Catizen, Algebra, and UTonic, uncovering multiple critical vulnerabilities and demonstrating exceptional expertise in blockchain security. In addition, TonBit has hosted the TON CTF competition, which attracted widespread participation and attention, further solidifying its reputation as a leading security authority within the TON ecosystem.\u003C/p>","/media/tonbit/2025/07/e99202c71f013933c5bd854703969df3.png","TonBit, a subsidiary of BitsLab, has once again discovered a critical vulnerability in the TON Virtual Machine for third time, and again received official acknowledgment from the TON team. The issue lies in the INMSGPARAM instruction, which fails to perform a null-pointer check when handling message parameters, potenti","2025-07-16T03:15:00Z","4 min read","TonBit Discovers Critical Vulnerability on TON Virtual Machine for the Third Time, Once Again Receiving Official Recognition from the TON Team cover image",true,{"slug":21,"category":22,"categoryLabel":23,"subcategoryLabel":24,"authorName":10,"title":25,"excerpt":26,"contentHtml":27,"coverUrl":28,"seoTitle":25,"seoDescription":26,"seoImageUrl":28,"publishedAt":29,"readTime":30,"cover":28,"coverAlt":31,"hasCover":19},"exclusive-interview-with-tonbit-under-bitslab-continuously-safeguarding-the-ton-ecosystem-with-innovation-and-expertise","product-updates","Product Updates","Announcements","Exclusive Interview with TonBit Under BitsLab｜ Continuously Safeguarding the TON Ecosystem with Innovation and Expertise","As the TON ecosystem expands into multiple domains and dimensions, TonBit is leveraging its professional security expertise to build a more robust line of defense for the entire ecosystem. In this interview, we will delve into TonBit’s technical accomplishments and plans in depth.","\u003Cp>The thriving development of the TON ecosystem has always been built on a solid foundation of innovation, decentralization, and community collaboration. In this digital landscape, TonBit, under BitsLab, as an officially recognized Primary Security Assurance Provider (PSAP) for TON, has steadfastly upheld its mission as a guardian of TON network security.\u003C/p>\n\u003Cp>To date, TonBit has completed security audits for over 30 key TON projects, successfully identifying and assisting in fixing multiple vulnerabilities on TON. At the same time, through initiatives such as the TON CTF competition and TON Global Hackerhouse events, TonBit continues to infuse security into the ecosystem and provide sustained momentum for innovation in TON projects.\u003C/p>\n\u003Cp>As the TON ecosystem expands into multiple domains and dimensions, TonBit is leveraging its professional security expertise to build a more robust line of defense for the entire ecosystem. In this interview, we will delve into TonBit’s technical accomplishments and plans in depth.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/05/cd39d782066a72282288ffab4f79546e.png\" alt=\"Banner\" title=\"Banner\">\u003C/p>\n\u003Cp>Q1: Could you introduce TonBit and its role in the TON ecosystem?\u003C/p>\n\u003Cp>TonBit: TonBit is the core sub-brand under BitsLab. As a trusted Primary Security Assurance Provider (SAP) and early builder in the TON ecosystem, we are committed to strengthening TON infrastructure security by delivering comprehensive security audits, vulnerability detection, and proactive penetration testing.\u003C/p>\n\u003Cp>As an officially recognized SAP by the TON Foundation, we specialize in auditing smart contracts written in Tact and FunC, ensuring that projects built on TON maintain technical robustness and long-term resilience.\u003C/p>\n\u003Cp>Q2: What services does TonBit provide for TON ecosystem projects?\u003C/p>\n\u003Cp>TonBit: We primarily offer two core services:\u003C/p>\n\u003Cp>Smart Contract Audits: In-depth code reviews for Tact/FunC contracts\nPenetration Testing: Proactive security assessments for high-impact Web3 projects\u003C/p>\n\u003Cp>To date, we have completed security audits for over 30 TON projects, including key projects such as Tonstakers, Torch Finance, Fiva Protocol, Duckchain, and Catizen.\nAdditionally, we have achieved significant results in vulnerability discovery, having identified and assisted in fixing three vulnerabilities on TON, including:\u003C/p>\n\u003Cp>One critical vulnerability\nOne medium-risk vulnerability\nOne TON RUNVM vulnerability\u003C/p>\n\u003Cp>Q3: What was the original purpose behind TonBit hosting the TON CTF competition?\u003C/p>\n\u003Cp>TonBit: The TON CTF competition was designed to foster a security-first culture within the TON ecosystem. Its goals were to attract and challenge security experts and developers, with participants tackling challenges using FunC and Tact programming languages.\u003C/p>\n\u003Cp>We believe TON CTF serves as a valuable and engaging way for TON developers to enhance their skills and explore the field of security, driving innovation, skill development, and deeper understanding of FunC and Tact within the TON ecosystem.\u003C/p>\n\u003Cp>The event drew participation from over 20 global universities and security organizations, with more than 300 teams competing, significantly raising security awareness among participants in the TON ecosystem. More than just a competition, it served as an incubation platform for the next generation of TON security guardians.\u003C/p>\n\u003Cp>Q4: How does the TON Global Hackerhouse event promote ecosystem development?\u003C/p>\n\u003Cp>TonBit: In 2025, we co-hosted TON Global Hackerhouse with TON Official, TONX, TON Society, and TON Core, bringing together global developers to build the TON ecosystem jointly. The event not only attracted top-tier projects to participate and garnered millions of dollars in exposure but also drove innovative breakthroughs in the decentralized finance field, fully demonstrating TON's real-world application potential as a scalable blockchain.\u003C/p>\n\u003Cp>As the designated security guardian of the TON ecosystem, TonBit has always maintained high vigilance against various potential threats. In this in-depth interview, the TonBit security team provided a detailed analysis of three vulnerability discoveries, ranging from a \"Critical\"-level risk capable of paralyzing the network, to a \"Medium-risk\" vulnerability affecting system performance, and even complex attack vectors at the virtual machine level. Each case demonstrates TonBit's exceptional technical capabilities and its \"prevention-before-cure\" security philosophy.\u003C/p>\n\u003Cp>Q5: Regarding the critical TON Virtual Machine vulnerability discovered by TonBit in 2024, could you elaborate on its impact?\u003C/p>\n\u003Cp>TonBit: In November 2024, the TON official team formally acknowledged the TonBit security team under BitsLab in their latest version update notes for discovering a critical vulnerability in the TON Virtual Machine. If maliciously exploited, this vulnerability could lead to virtual machine resource exhaustion, system crashes, and ultimately affect the stability of the entire TON network.\u003C/p>\n\u003Cp>The root cause of this vulnerability lay in the risky design of nested operations when the TON Virtual Machine handled contract continuations. Malicious contracts could create deeply nested continuation structures, triggering recursive evaluation processes that would exhaust the virtual machine's host stack space. This resource exhaustion attack could cause abnormal crashes of the TON Virtual Machine - simply put, without spending a single TON, it could bring down all Validators, directly impacting system availability.\u003C/p>\n\u003Cp>Through in-depth analysis, the TonBit team collaborated with Ton Core to propose an innovative solution. This solution modifies the virtual machine's internal jump mechanism by replacing recursive calls with iterative approaches, effectively preventing such attacks. The solution has been implemented in the latest version of TON, providing users with a more secure and stable operating experience.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/12/5eaaf7f0ec5a0f53258207557e13c31c.png\" alt=\"Figure1\" title=\"Figure1\">\u003C/p>\n\u003Cp>Q6: How did TonBit address another vulnerability in TON light nodes?\u003C/p>\n\u003Cp>TonBit: In November 2024, we also discovered a \"Continuation Parameter Abuse Vulnerability\" in TON light nodes. The core issue was that attackers could exploit deeply nested Continuation parameters to exhaust a node's computational resources. In simple terms, this vulnerability allowed seemingly legitimate requests to keep nodes busy indefinitely. Imagine a car that appears normal but has a hidden flaw causing it to consume excessive fuel constantly—that's essentially what this vulnerability did, silently consuming computing resources and affecting the network's overall throughput.\u003C/p>\n\u003Cp>Ultimately, by optimizing the parameter processing logic, we helped the TON team enhance the performance of light nodes, ensuring network efficiency and resilience against such attacks.\u003C/p>\n\u003Cp>Q7: What was the impact of the TON RUNVM vulnerability discovered in 2025?\u003C/p>\n\u003Cp>TonBit: This vulnerability involved non-atomic state migration in RUNVM instructions, where attackers could exploit the precise moment when a child virtual machine exhausted its gas to contaminate the parent VM's libraries and induce subsequent call failures. This chain of exploitation would ultimately lead to abnormal behavior in any contracts that depended on library integrity.\u003C/p>\n\u003Cp>Upon discovery, we promptly submitted the complete technical details along with comprehensive mitigation solutions to the TON Foundation, while actively assisting them through the entire remediation process. We strongly advised all developers in the ecosystem to take three crucial actions: immediately update all dependency libraries once official patches became available, implement more rigorous library integrity verification protocols, and significantly enhance gas management logic within their self-developed contracts. These collective measures have created an effective defense against potential malicious exploitation of similar vulnerabilities in the future.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/05/420686f3f880b9c20160386ee0302904.png\" alt=\"Figure2\" title=\"Figure2\">\u003C/p>\n\u003Cp>Q8: What unique advantages does TonBit have compared to other blockchain security companies?\u003C/p>\n\u003Cp>TonBit: Our core competitiveness is reflected in three key dimensions:\u003C/p>\n\u003Col>\n\u003Cli>TON-Specific Technical Expertise: We are not only proficient in Tact and FunC programming languages but also possess specialized penetration testing and vulnerability discovery capabilities.\u003C/li>\n\u003Cli>Deep Ecosystem Integration: As an officially recognized SAP (Security Assurance Provider), we are deeply committed to safeguarding the TON ecosystem, having already audited over 30 critical projects within the TON network.\u003C/li>\n\u003Cli>Community Co-Building Capabilities: Through initiatives such as CTF competitions and TON Global Hackerhouse events, we actively enhance community engagement, elevate security awareness, and foster ecosystem development.\u003C/li>\n\u003C/ol>\n\u003Cp>We go beyond mere code auditing – we are dedicated to building an impenetrable ecosystem.\u003C/p>\n\u003Cp>Q9: What are TonBit's key initiatives for 2025-2026?\u003C/p>\n\u003Cp>TonBit: We will focus on advancing three strategic priorities:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cp>Sustained TON Ecosystem Protection:\nWe will continue providing reliable security audits for TON ecosystem projects, develop automated scanning tools for Tact/FunC smart contracts, and enhance penetration testing and vulnerability discovery efforts to build a comprehensive security framework for the entire ecosystem.\u003C/p>\n\u003C/li>\n\u003Cli>\u003Cp>Industry-Academia-Research Collaboration:\nBy establishing joint laboratories with leading academic institutions, we will conduct specialized research on the security of the TON ecosystem.\u003C/p>\n\u003C/li>\n\u003Cli>\u003Cp>Developer Empowerment Program:\nWe will elevate developer security awareness through targeted training courses and hands-on exercises, because a secure TON ecosystem begins with education as its foundation.\u003C/p>\n\u003C/li>\n\u003C/ol>\n\u003Cp>Closing: TonBit remains dedicated to its role as TON’s security cornerstone. By merging cutting-edge research with community-driven initiatives, they’re shaping a future where innovation thrives on a foundation of trust. To learn more, visit TonBit’s GitHub or follow our updates on X (Twitter).\u003C/p>","/media/tonbit/2025/05/cd39d782066a72282288ffab4f79546e.png","2025-05-20T03:15:00Z","7 min read","Exclusive Interview with TonBit Under BitsLab｜ Continuously Safeguarding the TON Ecosystem with Innovation and Expertise cover image",{"slug":33,"category":7,"categoryLabel":8,"subcategoryLabel":34,"authorName":10,"title":35,"excerpt":36,"contentHtml":37,"coverUrl":38,"seoTitle":35,"seoDescription":36,"seoImageUrl":38,"publishedAt":39,"readTime":40,"cover":38,"coverAlt":41,"hasCover":19},"a-one-stop-look-at-the-2024-ton-ecosystem-technical-insights-and-major-security-incidents","Industry Research","A One-Stop Look at the 2024 TON Ecosystem Technical Insights and Major Security Incidents","With the rapid development of blockchain technology, various ecosystems have emerged, one after another. Among them, the TON (The Open Network) ecosystem, created by Telegram, has gradually become a focal point in the industry due to its unique architecture and powerful functionalities.","\u003Cp>With the rapid development of blockchain technology, various ecosystems have emerged, one after another. Among them, the TON (The Open Network) ecosystem, created by Telegram, has gradually become a focal point in the industry due to its unique architecture and powerful functionalities. Another key factor lies in Telegram’s massive user base—over 700 million active users—providing a broad foundation for the promotion and application of TON. \u003C/p>\n\u003Cp>In 2024, the TON ecosystem achieved significant progress in technological innovation, application expansion, and security protection. This article will present a comprehensive analysis of the fundamental architecture of the TON ecosystem, its flexible proof-of-stake mechanism, its extended use cases, and advantages, as well as the recent major security incidents and the responses taken. The aim is to offer readers a thorough view of the TON ecosystem.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/12/057eecf855dafa23aa1277bfdc28c969.jpg\" alt=\"Banner\" title=\"Banner\">\u003C/p>\n\u003Ch1>\u003Cstrong>Basic Introduction and Architecture\u003C/strong>\u003C/h1>\n\u003Cp>TON (The Open Network) is a blockchain and digital communication protocol created by Telegram that is designed to build a fast, secure, and scalable blockchain platform. It aims to provide users with decentralized applications and services by combining blockchain technology with Telegram’s communication features. TON is characterized by its high performance, robust security, and scalability. It supports developers in creating diverse, decentralized applications and offers distributed storage solutions. Compared to traditional blockchain platforms, TON boasts faster processing speeds and higher throughput and operates on a Proof-of-Stake (PoS) consensus mechanism.\u003C/p>\n\u003Cp>Flexible and Sharded PoS Architecture\u003C/p>\n\u003Cp>TON adopts a Proof of Stake (PoS) consensus mechanism and achieves high performance and multifunctionality through its Turing-complete smart contracts and asynchronous blockchain. The lightning-fast and low-cost transactions of TON are supported by the chain's flexible and shardable architecture. This architecture allows for easy scalability without sacrificing performance. Dynamic sharding involves initially developed separate shards, each with its own purpose, which can run simultaneously and prevent large-scale congestion. TON's block time is 5 seconds, and finality occurs in less than 6 seconds.\u003C/p>\n\u003Cp>The existing infrastructure consists of two main components:\u003C/p>\n\u003Cp>Masterchain: Manages all critical protocol data, including validator addresses and staked token amounts.\nWorkchains: Sub-chains connected to the Masterchain, containing all transaction information and various smart contracts. Each Workchain can operate under distinct rules.\u003C/p>\n\u003Cp>This layered architecture not only enhances the network’s efficiency but also provides a solid foundation for future expansion.\u003C/p>\n\u003Ch1>\u003Cstrong>Expanded Use Cases and Advantages\u003C/strong>\u003C/h1>\n\u003Cp>Under a robust technical framework, the TON ecosystem achieved remarkable advancements across multiple fronts in 2024. Operated by the core TON community, the TON Foundation functions as a decentralized autonomous organization (DAO) and provides comprehensive support for various projects within the ecosystem. This support includes developer assistance and liquidity incentive programs. Specifically, the TON community has excelled in the following areas:\u003C/p>\n\u003Cp>Launch of TON Connect 2.0: Provides an intuitive way to connect wallets and applications, significantly improving user experience.\nTON Verifier: A smart contract checker created by the Orbs team, enhancing contract reliability.\nBlueprint Development Tools: Helps developers write, test, and deploy smart contracts.\nSandbox Developer Toolkit: Suitable for various use cases from enterprises to governments.\nSupport for Tact, Func, and Other New Languages: Promotes a more robust programming environment.\nDeveloper Support: The TON Foundation collaborated with DoraHacks to launch a three-month online hackathon.\nInternationalization of TON Hubs: Established international centers in multiple cities worldwide.\nDeFi Liquidity Incentive Program: Provides funding for projects, promoting the sustainability of the TON DeFi sector.\u003C/p>\n\u003Cp>These initiatives drive the ecosystem's prosperity and create a more prosperous, more secure environment for developers and users.\u003C/p>\n\u003Ch1>\u003Cstrong>Security Incidents in the TON Ecosystem\u003C/strong>\u003C/h1>\n\u003Cp>Although the TON ecosystem has made numerous advances in both technology and applications, security issues remain an essential aspect that cannot be ignored.\u003C/p>\n\u003Cp>Recently, in the release notes of its latest version update, the official TON team formally thanked the TonBit security team under BitsLab for discovering a critical vulnerability in the TON virtual machine. If maliciously exploited, this vulnerability could lead to resource exhaustion of the virtual machine and system crashes, thereby affecting the stability of the entire TON network. Leveraging their profound technical expertise, the TonBit team quickly pinpointed the problem and proposed an effective solution, thereby constructing a more secure operating environment for the TON virtual machine and further enhancing the overall stability of the TON ecosystem.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/12/5eaaf7f0ec5a0f53258207557e13c31c.png\" alt=\"Figure1\" title=\"Figure1\">\u003C/p>\n\u003Cp>The root cause of this vulnerability lies in the risky nested operations design in the TON virtual machine when handling contract continuations. Malicious contracts could create deeply nested continuation structures that trigger a recursive evaluation process, thus depleting the host stack space of the virtual machine. This type of resource exhaustion attack could lead to abnormal crashes of the TON virtual machine. In simple terms, without spending even a single TON, one could cause all validators to go offline, directly affecting the availability of the system.\u003C/p>\n\u003Cp>After in-depth analysis and collaboration with Ton Core, the TonBit team proposed an innovative solution. This solution adjusts the VM’s internal jump mechanism to replace recursive calls with iterative methods, effectively preventing such attacks. The solution has been applied in the latest version of TON, providing users with a more secure and stable operating experience.\u003C/p>\n\u003Cp>In response to this major security incident, the TON team understands the importance of continuously strengthening security defenses. To ensure the long-term stability and security of the ecosystem, the team not only promptly fixed the vulnerability but also actively summarized their experiences and formulated more comprehensive security strategies. Based on this, we will explore how the TON ecosystem can further enhance security in the future, ensuring that as it rapidly evolves, it can effectively address potential security challenges.\u003C/p>\n\u003Cp>Moreover, on May 22, 2024, after a staking event to celebrate the prosperity of the TON ecosystem, a certain protocol’s staking contract was attacked by hackers due to incorrect parameter configurations, resulting in the theft of a large number of tokens from the contract. After the incident, the project team immediately suspended the staking rewards redemption function and allocated a large amount of USDT to buy back the 307,264 lost tokens.\u003C/p>\n\u003Cp>Following the attack, the project team quickly contacted TonBit for an audit. TonBit demonstrated professionalism by responding swiftly and mobilizing a team of security experts to conduct a comprehensive and meticulous security audit of the project’s core code. TonBit’s security experts discovered six low-risk issues and promptly engaged in detailed communication with the project team. Drawing on their rich experience and professional technical capabilities, TonBit provided specific solutions for the issues and assisted the team in quickly completing all the necessary fixes, ensuring the contract’s security and stability.\u003C/p>\n\u003Cp>Additionally, on May 10, 2024, the TonBit team under BitsLab discovered that, while it is possible to add comments when processing “transfers” messages in TON, the UI design of some wallets when displaying these comments poses potential misleading risks. Hackers could exploit this design flaw by manipulating transfer message comment content, thereby showing users false information during transactions. This could lead to fraudulent activities, causing users to make erroneous operations and suffer financial losses.\nTo resolve this issue, TonBit recommended that wallet applications add conspicuous annotations when displaying such information, reminding users that this content may not be reliable. Furthermore, wallet development teams should improve their UI design to ensure the transparency and reliability of displayed transaction information. At the same time, users need to increase their discernment and remain vigilant against suspicious transaction information.\u003C/p>\n\u003Cp>TonBit suggests that wallet development teams introduce a multi-layer verification mechanism when displaying transaction annotations. For example, verify the source of the annotation information to ensure its reliability. In addition, regular user education, such as issuing security reminders, can help users identify and guard against potential fraudulent activities. Combining technical measures with user education can effectively reduce such security incidents.\u003C/p>\n\u003Cp>There are also incidents similar to BookPad’s use of a backdoored contract to swindle funds and then run off with the money, which should be highlighted for effective prevention. On April 15, 2024, BookPad released a closed-source smart contract containing a backdoor and began a presale activity. After receiving sufficient funds, they exploited the contract’s backdoor to withdraw the funds and then quickly absconded.\u003C/p>\n\u003Cp>To prevent similar incidents from happening again, users should, before participating in any project’s investment activities, gather as much information as possible about the project team and choose those that are open-source and have undergone rigorous security audits.\u003C/p>\n\u003Cp>In summary, although the TON ecosystem has made significant progress in technology and applications, security issues still need to be addressed. The TonBit team under BitsLab has effectively enhanced system security and stability by promptly discovering and helping to fix critical vulnerabilities, and they have demonstrated professional auditing and problem-solving capabilities in multiple security incidents. In the future, the TON ecosystem will continue to strengthen security measures and improve security strategies to ensure that, while evolving rapidly, it can effectively respond to various potential security challenges and protect the long-term security of users and the network.\u003C/p>\n\u003Cp>Next, we will explore how the TON ecosystem, as it continues to expand and develop, can further enhance security to ensure robust system operation and user trust. To this end, the TonBit team, through a detailed analysis of the current security challenges faced by TON and advanced protection technologies that can be adopted, recommends implementing strict security audits to build an even more secure and reliable ecosystem. Through these measures, the stability of the TON network and user trust will be significantly strengthened, thereby promoting the sustainable and healthy development of the TON ecosystem.\u003C/p>\n\u003Ch1>\u003Cstrong>Security Outlook for the TON Ecosystem\u003C/strong>\u003C/h1>\n\u003Cp>As the TON ecosystem rapidly expands decentralized applications (dApps) and infrastructure, its unique architecture and functionalities present some distinctive security challenges. The following are security recommendations and best practices for developers within the TON ecosystem:\u003C/p>\n\u003Cp>Node Distribution and Protection: TON utilizes sharding and Distributed Hash Table (DHT) technology to enhance network scalability. However, uneven node distribution or insufficient protection could allow malicious nodes to dominate the network, conducting routing table pollution or network partition attacks. Developers should strengthen node verification mechanisms and enhance network defense capabilities by increasing node monitoring and implementing blacklist mechanisms.\u003C/p>\n\u003Cp>Security of Smart Contracts: TON's smart contract programming differs from other public chains, with more complex contract logic. Developers should strictly adhere to best practices for secure development, focusing on resource management and boundary checks in the code to avoid common contract vulnerabilities. Conducting code audits, regular reviews, and contract testing tools can improve code reliability.\u003C/p>\n\u003Cp>Data Integrity and Tamper Prevention: TON's distributed storage enhances data sharing and accessibility and introduces tampering risks. Developers can introduce multi-layered data encryption and authentication mechanisms and implement data consistency verification between nodes to ensure the integrity of data transmission.\u003C/p>\n\u003Cp>Implementing these measures allows the TON ecosystem to maintain high security and stability while continuously expanding, providing more reliable services for users and developers.\u003C/p>\n\u003Ch1>\u003Cstrong>Conclusion\u003C/strong>\u003C/h1>\n\u003Cp>In 2024, the TON ecosystem has made significant progress in technical architecture, application expansion, and security protection. Its flexible and shardable PoS architecture, high-performance transaction processing capabilities, and rich developer tools have laid a solid foundation for the prosperity of the ecosystem. \u003C/p>\n\u003Cp>At the same time, facing security challenges, the TON official team has closely collaborated with security experts to promptly fix critical vulnerabilities, further enhancing the system's stability and security. As the TON ecosystem continues to develop, continuously focusing on and improving security defenses will be crucial for its long-term sustainable growth. The ongoing advancements in the TON ecosystem provide new insights for developing blockchain technology and creating a safer and more efficient digital world for users and developers.\u003C/p>\n\u003Ch1>\u003Cstrong>About TonBit\u003C/strong>\u003C/h1>\n\u003Cp>TonBit, as the core sub-brand of BitsLab, is a security expert and early builder within the TON ecosystem. As a Primary Security Assurance Provider for the TON blockchain, TonBit focuses on comprehensive security audits, including audits of Tact and FunC languages, ensuring that TON-based projects possess integrity and resilience. \u003C/p>\n\u003Cp>To date, TonBit has successfully audited several well-known projects on TON, including Catizen, Algebra, and UTonic, and has discovered multiple critical vulnerabilities, showcasing our outstanding capabilities in the blockchain security field. Additionally, TonBit has successfully hosted the TON CTF competition, attracting numerous participants and garnering widespread attention, further solidifying its position as a security expert within the TON ecosystem. TonBit will continue safeguarding blockchain security in the future, driving the continuous development of technology and the ecosystem.\u003C/p>\n\u003Ch1>\u003Cstrong>About BitsLab\u003C/strong>\u003C/h1>\n\u003Cp>BitsLab is an organization dedicated to the security of the Web3 ecosystem, aiming to become a respected security institution for the industry and users. It has three sub-brands: MoveBit, ScaleBit, and TonBit. BitsLab focuses on infrastructure development and security audits for multiple ecosystems, including Sui, Aptos, TON, BNB Chain, Starknet, and Solana, and is proficient in auditing various programming languages such as Circom, Halo2, Move, and Cairo.\u003C/p>\n\u003Cp>As a leader in the blockchain security field, BitsLab provides security audit services for numerous projects, including Movement, Aptos, Tether, UniSat, and Nervos CKB. It has delivered over 400 security solutions, audited over 400,000 lines of code, protected assets worth $8 billion, and served over 2 million users. The team comprises top-tier vulnerability research experts who have discovered critical vulnerabilities in multiple renowned projects. BitsLab is committed to advancing Web3 security and fostering \nemerging ecosystems' healthy growth.\u003C/p>\n\u003Cp>Official Website： \u003Ca href=\"https://bitslab.xyz/\">https://bitslab.xyz/\u003C/a>\nBitsLab Twitter：\u003Ca href=\"https://x.com/0xbitslab\">https://x.com/0xbitslab\u003C/a>\nOfficial Telegram：\u003Ca href=\"https://t.me/BitsLabHQ\">https://t.me/BitsLabHQ\u003C/a>\u003C/p>\n\u003Cp>BitsLab’s Sub-Brand：\nTonBit: \u003Ca href=\"https://www.tonbit.xyz/\">https://www.tonbit.xyz/\u003C/a>\nMoveBit: \u003Ca href=\"https://www.movebit.xyz/\">https://www.movebit.xyz/\u003C/a>\nScaleBit: \u003Ca href=\"https://www.scalebit.xyz/\">https://www.scalebit.xyz/\u003C/a>\nAudit needs to contact Telegram：@starchou\nMedia Team: \u003Ca href=\"mailto:han@bitslab.xyz\">han@bitslab.xyz\u003C/a>\u003C/p>","/media/tonbit/2024/12/057eecf855dafa23aa1277bfdc28c969.jpg","2024-12-13T03:15:00Z","11 min read","A One-Stop Look at the 2024 TON Ecosystem Technical Insights and Major Security Incidents cover image",8,1,3,1791882713847]