[{"data":1,"prerenderedAt":43},["Reactive",2],{"blog-article-a-one-stop-look-at-the-2024-ton-ecosystem-technical-insights-and-major-security-incidents":3,"blog-related-research":17},{"slug":4,"category":5,"categoryLabel":6,"subcategoryLabel":7,"authorName":8,"title":9,"excerpt":10,"contentHtml":11,"coverUrl":12,"seoTitle":9,"seoDescription":10,"seoImageUrl":12,"publishedAt":13,"readTime":14,"cover":12,"coverAlt":15,"hasCover":16},"a-one-stop-look-at-the-2024-ton-ecosystem-technical-insights-and-major-security-incidents","research","Research","Industry Research","TonBit","A One-Stop Look at the 2024 TON Ecosystem Technical Insights and Major Security Incidents","With the rapid development of blockchain technology, various ecosystems have emerged, one after another. Among them, the TON (The Open Network) ecosystem, created by Telegram, has gradually become a focal point in the industry due to its unique architecture and powerful functionalities.","\u003Cp>With the rapid development of blockchain technology, various ecosystems have emerged, one after another. Among them, the TON (The Open Network) ecosystem, created by Telegram, has gradually become a focal point in the industry due to its unique architecture and powerful functionalities. Another key factor lies in Telegram’s massive user base—over 700 million active users—providing a broad foundation for the promotion and application of TON. \u003C/p>\n\u003Cp>In 2024, the TON ecosystem achieved significant progress in technological innovation, application expansion, and security protection. This article will present a comprehensive analysis of the fundamental architecture of the TON ecosystem, its flexible proof-of-stake mechanism, its extended use cases, and advantages, as well as the recent major security incidents and the responses taken. The aim is to offer readers a thorough view of the TON ecosystem.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/12/057eecf855dafa23aa1277bfdc28c969.jpg\" alt=\"Banner\" title=\"Banner\">\u003C/p>\n\u003Ch1>\u003Cstrong>Basic Introduction and Architecture\u003C/strong>\u003C/h1>\n\u003Cp>TON (The Open Network) is a blockchain and digital communication protocol created by Telegram that is designed to build a fast, secure, and scalable blockchain platform. It aims to provide users with decentralized applications and services by combining blockchain technology with Telegram’s communication features. TON is characterized by its high performance, robust security, and scalability. It supports developers in creating diverse, decentralized applications and offers distributed storage solutions. Compared to traditional blockchain platforms, TON boasts faster processing speeds and higher throughput and operates on a Proof-of-Stake (PoS) consensus mechanism.\u003C/p>\n\u003Cp>Flexible and Sharded PoS Architecture\u003C/p>\n\u003Cp>TON adopts a Proof of Stake (PoS) consensus mechanism and achieves high performance and multifunctionality through its Turing-complete smart contracts and asynchronous blockchain. The lightning-fast and low-cost transactions of TON are supported by the chain's flexible and shardable architecture. This architecture allows for easy scalability without sacrificing performance. Dynamic sharding involves initially developed separate shards, each with its own purpose, which can run simultaneously and prevent large-scale congestion. TON's block time is 5 seconds, and finality occurs in less than 6 seconds.\u003C/p>\n\u003Cp>The existing infrastructure consists of two main components:\u003C/p>\n\u003Cp>Masterchain: Manages all critical protocol data, including validator addresses and staked token amounts.\nWorkchains: Sub-chains connected to the Masterchain, containing all transaction information and various smart contracts. Each Workchain can operate under distinct rules.\u003C/p>\n\u003Cp>This layered architecture not only enhances the network’s efficiency but also provides a solid foundation for future expansion.\u003C/p>\n\u003Ch1>\u003Cstrong>Expanded Use Cases and Advantages\u003C/strong>\u003C/h1>\n\u003Cp>Under a robust technical framework, the TON ecosystem achieved remarkable advancements across multiple fronts in 2024. Operated by the core TON community, the TON Foundation functions as a decentralized autonomous organization (DAO) and provides comprehensive support for various projects within the ecosystem. This support includes developer assistance and liquidity incentive programs. Specifically, the TON community has excelled in the following areas:\u003C/p>\n\u003Cp>Launch of TON Connect 2.0: Provides an intuitive way to connect wallets and applications, significantly improving user experience.\nTON Verifier: A smart contract checker created by the Orbs team, enhancing contract reliability.\nBlueprint Development Tools: Helps developers write, test, and deploy smart contracts.\nSandbox Developer Toolkit: Suitable for various use cases from enterprises to governments.\nSupport for Tact, Func, and Other New Languages: Promotes a more robust programming environment.\nDeveloper Support: The TON Foundation collaborated with DoraHacks to launch a three-month online hackathon.\nInternationalization of TON Hubs: Established international centers in multiple cities worldwide.\nDeFi Liquidity Incentive Program: Provides funding for projects, promoting the sustainability of the TON DeFi sector.\u003C/p>\n\u003Cp>These initiatives drive the ecosystem's prosperity and create a more prosperous, more secure environment for developers and users.\u003C/p>\n\u003Ch1>\u003Cstrong>Security Incidents in the TON Ecosystem\u003C/strong>\u003C/h1>\n\u003Cp>Although the TON ecosystem has made numerous advances in both technology and applications, security issues remain an essential aspect that cannot be ignored.\u003C/p>\n\u003Cp>Recently, in the release notes of its latest version update, the official TON team formally thanked the TonBit security team under BitsLab for discovering a critical vulnerability in the TON virtual machine. If maliciously exploited, this vulnerability could lead to resource exhaustion of the virtual machine and system crashes, thereby affecting the stability of the entire TON network. Leveraging their profound technical expertise, the TonBit team quickly pinpointed the problem and proposed an effective solution, thereby constructing a more secure operating environment for the TON virtual machine and further enhancing the overall stability of the TON ecosystem.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/12/5eaaf7f0ec5a0f53258207557e13c31c.png\" alt=\"Figure1\" title=\"Figure1\">\u003C/p>\n\u003Cp>The root cause of this vulnerability lies in the risky nested operations design in the TON virtual machine when handling contract continuations. Malicious contracts could create deeply nested continuation structures that trigger a recursive evaluation process, thus depleting the host stack space of the virtual machine. This type of resource exhaustion attack could lead to abnormal crashes of the TON virtual machine. In simple terms, without spending even a single TON, one could cause all validators to go offline, directly affecting the availability of the system.\u003C/p>\n\u003Cp>After in-depth analysis and collaboration with Ton Core, the TonBit team proposed an innovative solution. This solution adjusts the VM’s internal jump mechanism to replace recursive calls with iterative methods, effectively preventing such attacks. The solution has been applied in the latest version of TON, providing users with a more secure and stable operating experience.\u003C/p>\n\u003Cp>In response to this major security incident, the TON team understands the importance of continuously strengthening security defenses. To ensure the long-term stability and security of the ecosystem, the team not only promptly fixed the vulnerability but also actively summarized their experiences and formulated more comprehensive security strategies. Based on this, we will explore how the TON ecosystem can further enhance security in the future, ensuring that as it rapidly evolves, it can effectively address potential security challenges.\u003C/p>\n\u003Cp>Moreover, on May 22, 2024, after a staking event to celebrate the prosperity of the TON ecosystem, a certain protocol’s staking contract was attacked by hackers due to incorrect parameter configurations, resulting in the theft of a large number of tokens from the contract. After the incident, the project team immediately suspended the staking rewards redemption function and allocated a large amount of USDT to buy back the 307,264 lost tokens.\u003C/p>\n\u003Cp>Following the attack, the project team quickly contacted TonBit for an audit. TonBit demonstrated professionalism by responding swiftly and mobilizing a team of security experts to conduct a comprehensive and meticulous security audit of the project’s core code. TonBit’s security experts discovered six low-risk issues and promptly engaged in detailed communication with the project team. Drawing on their rich experience and professional technical capabilities, TonBit provided specific solutions for the issues and assisted the team in quickly completing all the necessary fixes, ensuring the contract’s security and stability.\u003C/p>\n\u003Cp>Additionally, on May 10, 2024, the TonBit team under BitsLab discovered that, while it is possible to add comments when processing “transfers” messages in TON, the UI design of some wallets when displaying these comments poses potential misleading risks. Hackers could exploit this design flaw by manipulating transfer message comment content, thereby showing users false information during transactions. This could lead to fraudulent activities, causing users to make erroneous operations and suffer financial losses.\nTo resolve this issue, TonBit recommended that wallet applications add conspicuous annotations when displaying such information, reminding users that this content may not be reliable. Furthermore, wallet development teams should improve their UI design to ensure the transparency and reliability of displayed transaction information. At the same time, users need to increase their discernment and remain vigilant against suspicious transaction information.\u003C/p>\n\u003Cp>TonBit suggests that wallet development teams introduce a multi-layer verification mechanism when displaying transaction annotations. For example, verify the source of the annotation information to ensure its reliability. In addition, regular user education, such as issuing security reminders, can help users identify and guard against potential fraudulent activities. Combining technical measures with user education can effectively reduce such security incidents.\u003C/p>\n\u003Cp>There are also incidents similar to BookPad’s use of a backdoored contract to swindle funds and then run off with the money, which should be highlighted for effective prevention. On April 15, 2024, BookPad released a closed-source smart contract containing a backdoor and began a presale activity. After receiving sufficient funds, they exploited the contract’s backdoor to withdraw the funds and then quickly absconded.\u003C/p>\n\u003Cp>To prevent similar incidents from happening again, users should, before participating in any project’s investment activities, gather as much information as possible about the project team and choose those that are open-source and have undergone rigorous security audits.\u003C/p>\n\u003Cp>In summary, although the TON ecosystem has made significant progress in technology and applications, security issues still need to be addressed. The TonBit team under BitsLab has effectively enhanced system security and stability by promptly discovering and helping to fix critical vulnerabilities, and they have demonstrated professional auditing and problem-solving capabilities in multiple security incidents. In the future, the TON ecosystem will continue to strengthen security measures and improve security strategies to ensure that, while evolving rapidly, it can effectively respond to various potential security challenges and protect the long-term security of users and the network.\u003C/p>\n\u003Cp>Next, we will explore how the TON ecosystem, as it continues to expand and develop, can further enhance security to ensure robust system operation and user trust. To this end, the TonBit team, through a detailed analysis of the current security challenges faced by TON and advanced protection technologies that can be adopted, recommends implementing strict security audits to build an even more secure and reliable ecosystem. Through these measures, the stability of the TON network and user trust will be significantly strengthened, thereby promoting the sustainable and healthy development of the TON ecosystem.\u003C/p>\n\u003Ch1>\u003Cstrong>Security Outlook for the TON Ecosystem\u003C/strong>\u003C/h1>\n\u003Cp>As the TON ecosystem rapidly expands decentralized applications (dApps) and infrastructure, its unique architecture and functionalities present some distinctive security challenges. The following are security recommendations and best practices for developers within the TON ecosystem:\u003C/p>\n\u003Cp>Node Distribution and Protection: TON utilizes sharding and Distributed Hash Table (DHT) technology to enhance network scalability. However, uneven node distribution or insufficient protection could allow malicious nodes to dominate the network, conducting routing table pollution or network partition attacks. Developers should strengthen node verification mechanisms and enhance network defense capabilities by increasing node monitoring and implementing blacklist mechanisms.\u003C/p>\n\u003Cp>Security of Smart Contracts: TON's smart contract programming differs from other public chains, with more complex contract logic. Developers should strictly adhere to best practices for secure development, focusing on resource management and boundary checks in the code to avoid common contract vulnerabilities. Conducting code audits, regular reviews, and contract testing tools can improve code reliability.\u003C/p>\n\u003Cp>Data Integrity and Tamper Prevention: TON's distributed storage enhances data sharing and accessibility and introduces tampering risks. Developers can introduce multi-layered data encryption and authentication mechanisms and implement data consistency verification between nodes to ensure the integrity of data transmission.\u003C/p>\n\u003Cp>Implementing these measures allows the TON ecosystem to maintain high security and stability while continuously expanding, providing more reliable services for users and developers.\u003C/p>\n\u003Ch1>\u003Cstrong>Conclusion\u003C/strong>\u003C/h1>\n\u003Cp>In 2024, the TON ecosystem has made significant progress in technical architecture, application expansion, and security protection. Its flexible and shardable PoS architecture, high-performance transaction processing capabilities, and rich developer tools have laid a solid foundation for the prosperity of the ecosystem. \u003C/p>\n\u003Cp>At the same time, facing security challenges, the TON official team has closely collaborated with security experts to promptly fix critical vulnerabilities, further enhancing the system's stability and security. As the TON ecosystem continues to develop, continuously focusing on and improving security defenses will be crucial for its long-term sustainable growth. The ongoing advancements in the TON ecosystem provide new insights for developing blockchain technology and creating a safer and more efficient digital world for users and developers.\u003C/p>\n\u003Ch1>\u003Cstrong>About TonBit\u003C/strong>\u003C/h1>\n\u003Cp>TonBit, as the core sub-brand of BitsLab, is a security expert and early builder within the TON ecosystem. As a Primary Security Assurance Provider for the TON blockchain, TonBit focuses on comprehensive security audits, including audits of Tact and FunC languages, ensuring that TON-based projects possess integrity and resilience. \u003C/p>\n\u003Cp>To date, TonBit has successfully audited several well-known projects on TON, including Catizen, Algebra, and UTonic, and has discovered multiple critical vulnerabilities, showcasing our outstanding capabilities in the blockchain security field. Additionally, TonBit has successfully hosted the TON CTF competition, attracting numerous participants and garnering widespread attention, further solidifying its position as a security expert within the TON ecosystem. TonBit will continue safeguarding blockchain security in the future, driving the continuous development of technology and the ecosystem.\u003C/p>\n\u003Ch1>\u003Cstrong>About BitsLab\u003C/strong>\u003C/h1>\n\u003Cp>BitsLab is an organization dedicated to the security of the Web3 ecosystem, aiming to become a respected security institution for the industry and users. It has three sub-brands: MoveBit, ScaleBit, and TonBit. BitsLab focuses on infrastructure development and security audits for multiple ecosystems, including Sui, Aptos, TON, BNB Chain, Starknet, and Solana, and is proficient in auditing various programming languages such as Circom, Halo2, Move, and Cairo.\u003C/p>\n\u003Cp>As a leader in the blockchain security field, BitsLab provides security audit services for numerous projects, including Movement, Aptos, Tether, UniSat, and Nervos CKB. It has delivered over 400 security solutions, audited over 400,000 lines of code, protected assets worth $8 billion, and served over 2 million users. The team comprises top-tier vulnerability research experts who have discovered critical vulnerabilities in multiple renowned projects. BitsLab is committed to advancing Web3 security and fostering \nemerging ecosystems' healthy growth.\u003C/p>\n\u003Cp>Official Website： \u003Ca href=\"https://bitslab.xyz/\">https://bitslab.xyz/\u003C/a>\nBitsLab Twitter：\u003Ca href=\"https://x.com/0xbitslab\">https://x.com/0xbitslab\u003C/a>\nOfficial Telegram：\u003Ca href=\"https://t.me/BitsLabHQ\">https://t.me/BitsLabHQ\u003C/a>\u003C/p>\n\u003Cp>BitsLab’s Sub-Brand：\nTonBit: \u003Ca href=\"https://www.tonbit.xyz/\">https://www.tonbit.xyz/\u003C/a>\nMoveBit: \u003Ca href=\"https://www.movebit.xyz/\">https://www.movebit.xyz/\u003C/a>\nScaleBit: \u003Ca href=\"https://www.scalebit.xyz/\">https://www.scalebit.xyz/\u003C/a>\nAudit needs to contact Telegram：@starchou\nMedia Team: \u003Ca href=\"mailto:han@bitslab.xyz\">han@bitslab.xyz\u003C/a>\u003C/p>","/media/tonbit/2024/12/057eecf855dafa23aa1277bfdc28c969.jpg","2024-12-13T03:15:00Z","11 min read","A One-Stop Look at the 2024 TON Ecosystem Technical Insights and Major Security Incidents cover image",true,{"items":18,"total":40,"page":41,"pageSize":42},[19,30,31],{"slug":20,"category":5,"categoryLabel":6,"subcategoryLabel":21,"authorName":8,"title":22,"excerpt":23,"contentHtml":24,"coverUrl":25,"seoTitle":22,"seoDescription":26,"seoImageUrl":25,"publishedAt":27,"readTime":28,"cover":25,"coverAlt":29,"hasCover":16},"tonbit-discovers-critical-vulnerability-on-ton-virtual-machine-for-the-third-time-once-again-receiving-official-recognition-from-the-ton-team","Incident Analysis","TonBit Discovers Critical Vulnerability on TON Virtual Machine for the Third Time, Once Again Receiving Official Recognition from the TON Team","TonBit, a subsidiary of BitsLab, has once again discovered a critical vulnerability in the TON Virtual Machine for third time, and again received official acknowledgment from the TON team. The issue lies in the INMSGPARAM instruction, which fails to perform a null-pointer check when handling message parameters, potentially causing the TON VM to crash","\u003Cp>TonBit, a subsidiary of BitsLab, has once again discovered a critical vulnerability in the TON Virtual Machine for third time, and again received official acknowledgment from the TON team. The issue lies in the INMSGPARAM instruction, which fails to perform a null-pointer check when handling message parameters, potentially causing the TON VM to crash.\u003C/p>\n\u003Cp>Link to TON’s official patch and acknowledgment of TonBit:\n\u003Ca href=\"https://github.com/ton-blockchain/ton/releases/tag/v2025.06\">https://github.com/ton-blockchain/ton/releases/tag/v2025.06\u003C/a>\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/52a22b1cd9817513c329226e2675f345.png\" alt=\"Figure1\" title=\"Figure1\">\u003C/p>\n\u003Cp>Details of the Issue\u003C/p>\n\u003Cp>Recently, TonBit, a subsidiary of BitsLab, discovered a critical security vulnerability in the latest TVM source code (master branch / TON v2025.04). The issue lies in the INMSGPARAM instruction, which fails to perform a null-pointer check when handling message parameters, potentially leading to a crash of the TON Virtual Machine. This vulnerability is deeply embedded within the TVM’s internal call flow, allowing an attacker to craft specially constructed message parameters that trigger a null pointer dereference during execution, causing the VM to halt. This poses a serious threat to the availability and stability of smart contract execution. The following content retains technical details for developers to analyze and mitigate accordingly.\nWe discovered this vulnerability before the Global Version 11 went live and immediately reported it to the Ton Core team, thereby preventing any on-chain assets from being at risk. Ton Core analyzed our report, patched the issue before official release, and awarded us a bounty along with formal thanks. We sincerely appreciate Ton Core’s professionalism and integrity.\u003C/p>\n\u003Cp>Affected Code (in crypto/vm/tonops.cpp):\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/b95b1b223d8fd0ff43bb147780604a4f.png\" alt=\"Figure2\" title=\"Figure2\">\u003C/p>\n\u003Cp>Root cause:\u003C/p>\n\u003Cp>This line of code\u003C/p>\n\u003Cp>Ref t = get_param(st, inmsgparams_idx).as_tuple();\u003C/p>\n\u003Cp>does not check whether the variable t is nullptr. If register c7’s slot 0 is configured as a tuple whose 17th element is not of Tuple type, as_tuple() will return a null pointer. When that null pointer t is passed into tuple_index, it triggers a null-pointer dereference, causing the VM to crash. This critical error can be reliably reproduced in Global Version 11.\u003C/p>\n\u003Cp>PoC code:\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/775d406454f09def77d10eaa49006eb8.png\" alt=\"Figure3\" title=\"Figure3\">\u003C/p>\n\u003Cp>Reproduction Steps:\u003C/p>\n\u003Cp>To facilitate local testing (since global_version is typically configured by the chain), we modified the VM initialization in the A run_vm_code function to set forcibly global_version to 11:\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/ec693e03574c4d9bae1a776a5983c47c.png\" alt=\"Figure4\" title=\"Figure4\">\u003C/p>\n\u003Cp>Copy the PoC code into the crypto/test/vm.cpp file.\nModify the run_vm_code function as described above to set global_version to 11.\nCompile and run the test-vm executable.\u003C/p>\n\u003Cp>Crash: The virtual machine will crash due to a null-pointer dereference.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/07/f3dd5900548f49d64ed085e15afaee93.png\" alt=\"Figure5\" title=\"Figure5\">\u003C/p>\n\u003Cp>In conclusion, TonBit, a subsidiary of BitsLab, has consistently upheld the principles of “deep security and responsible disclosure,” continuously identifying and resolving critical vulnerabilities within the core code of the TON Virtual Machine. From the non-atomic migration risk in the RUNVM instruction to the null-pointer dereference issue in the INMSGPARAM Instruction, TonBit has demonstrated strong technical expertise and a prompt response, reporting issues to Ton Core at the earliest opportunity and assisting in timely fixes. These efforts have not only effectively safeguarded on-chain assets but also enhanced the stability and reliability of the TVM. Looking ahead, TonBit will continue to work closely with Ton Core and the community to build a more robust security foundation for the Web3 ecosystem.\u003C/p>\n\u003Cp>About TonBit \u003C/p>\n\u003Cp>TonBit, a core sub-brand of BitsLab, is a security expert and early contributor within the TON ecosystem. As the primary Security Assurance Provider (SAP) for the TON blockchain, TonBit specializes in comprehensive security audits, covering both Tact and FunC languages, to ensure the integrity and resilience of TON-based projects.\u003C/p>\n\u003Cp>To date, TonBit has successfully audited several well-known projects, including Catizen, Algebra, and UTonic, uncovering multiple critical vulnerabilities and demonstrating exceptional expertise in blockchain security. In addition, TonBit has hosted the TON CTF competition, which attracted widespread participation and attention, further solidifying its reputation as a leading security authority within the TON ecosystem.\u003C/p>","/media/tonbit/2025/07/e99202c71f013933c5bd854703969df3.png","TonBit, a subsidiary of BitsLab, has once again discovered a critical vulnerability in the TON Virtual Machine for third time, and again received official acknowledgment from the TON team. The issue lies in the INMSGPARAM instruction, which fails to perform a null-pointer check when handling message parameters, potenti","2025-07-16T03:15:00Z","4 min read","TonBit Discovers Critical Vulnerability on TON Virtual Machine for the Third Time, Once Again Receiving Official Recognition from the TON Team cover image",{"slug":4,"category":5,"categoryLabel":6,"subcategoryLabel":7,"authorName":8,"title":9,"excerpt":10,"contentHtml":11,"coverUrl":12,"seoTitle":9,"seoDescription":10,"seoImageUrl":12,"publishedAt":13,"readTime":14,"cover":12,"coverAlt":15,"hasCover":16},{"slug":32,"category":5,"categoryLabel":6,"subcategoryLabel":21,"authorName":8,"title":33,"excerpt":34,"contentHtml":35,"coverUrl":36,"seoTitle":33,"seoDescription":34,"seoImageUrl":36,"publishedAt":37,"readTime":38,"cover":36,"coverAlt":39,"hasCover":16},"tonbit-a-subsidiary-of-bitslab-discovers-critical-vulnerability-in-ton-vm-root-cause-and-mitigation-explained","TonBit, a Subsidiary of BitsLab, Discovers Critical Vulnerability in TON VM Root Cause and Mitigation Explained","The TON network's virtual machine (VM) recently underwent a significant security upgrade. The security team at TonBit, a subsidiary of BitsLab, successfully identified and helped resolve a critical vulnerability that could have led to resource exhaustion in the TON VM.","\u003Cp>The TON network's virtual machine (VM) recently underwent a significant security upgrade. The security team at TonBit, a subsidiary of BitsLab, successfully identified and helped resolve a critical vulnerability that could have led to resource exhaustion in the TON VM. The vulnerability exploited the recursive mechanism used by the VM when handling Continuation nesting, which could be abused by malicious smart contracts to cause system crashes and network instability.\u003C/p>\n\u003Cp>If exploited, this vulnerability could have enabled attackers to disrupt all validator nodes for the cost of less than 1 TON token, posing a direct threat to the network's availability. Leveraging its exceptional technical expertise, TonBit swiftly identified the issue and highlighted the risks associated with the recursive mechanism in TON’s virtual machine. This discovery prompted the TON team to implement an innovative solution, replacing the recursive control flow with an iterative approach. This adjustment effectively fixed the vulnerability and enhanced the security of the TON ecosystem.\u003C/p>\n\u003Cp>In its latest update announcement, the TON core team extended special thanks to TonBit for its outstanding contributions to the ecosystem's security.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/e34e366b649caaa497cd5ec57ff4a8e3.png\" alt=\"Figure1\" title=\"Figure1\">\u003C/p>\n\u003Cp>This detailed security report will delve into the root cause, technical specifics, and resolution of this vulnerability. The report provides an in-depth analysis of how the vulnerability leveraged deep nesting in Continuations to construct a recursive chain that triggered resource exhaustion attacks. It also explains how malicious smart contracts could exploit this mechanism to increase the call stack depth and exhaust the host's stack space.\u003C/p>\n\u003Cp>Additionally, we will detail how the TonBit team addressed the issue by eliminating the design flaw in the recursive chain and implementing a collaborative, iterative mechanism as a replacement. This fix not only significantly enhanced the stability of the TON network but also offered a valuable reference for improving the foundational security of the blockchain industry.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/809c74963fbae36756e352f5291028db.jpg\" alt=\"Banner\" title=\"Banner\">\u003C/p>\n\u003Ch1>\u003Cstrong>Case Study: DoS Vulnerability in TON VM and Relevant Mitigation\u003C/strong>\u003C/h1>\n\u003Ch2>Introduction\u003C/h2>\n\u003Cp>This report describes a DoS vulnerability in TON VM and the mitigation to address the issue. The vulnerability is caused by the way the VM handles continuation nesting in the contract execution. The vulnerability allows a malicious contract to create a continuation, deeply nesting in special ways and triggering deep recursion on evaluation, which exhausts the host stack space and halts the VM. The mitigation modifies the TVM’s handling of continuations and control flow. Instead of performing sequential tail calls through the continuation chain, the VM now proactively iterates over the chain. This approach ensures that only constant host stack space is used, preventing stack exhaustion.\u003C/p>\n\u003Ch2>Synopsis\u003C/h2>\n\u003Cp>The TON VM, as outlined in the official documentation, is a stack-based virtual machine that employs a Continuation-Passing Style (CPS) as its control flow mechanism for both its internal processes and smart contracts. Control flow registers are accessible to contracts, providing them with flexibility.\u003C/p>\n\u003Cp>The continuations used in TVM can be theoretically divided into three categories:\u003C/p>\n\u003Cp>• OrdCont, or vmc_std, holding TOM ASM slice to eval, is a first-class citizen in TVM; contracts can create them explicit in runtime and pass it around for implementing arbitrary control flow;\u003C/p>\n\u003Cp>• Extraordinary continuations usually hold OrdCont as components created from explicit iteration primitives and special implicit operations and handle corresponding control flow mechanisms;\u003C/p>\n\u003Cp>• The additional ArgContExt,e nvelope other continuation for saving control data.\u003C/p>\n\u003Cp>During contract execution, the VM enters the main loop where it decodes the contract slice for one word at a time and then dispatches the corresponding operation to the appropriate handler. Normal handlers execute their respective operations in place and return immediately.\u003C/p>\n\u003Cp>In contrast, iteration words create an extraordinary continuation using the supplied continuations as components and jump to the extraordinary continuation with the proper context. The extraordinary continuation itself implements the logic in its jump and jump to one component according to the condition. Take WHILE as an example, we can demonstrate this process (possible jumpout omitted) in Figure 1.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/98d49f5187315ff430426a252356d92c.png\" alt=\"Figure2\" title=\"Figure2\">\u003C/p>\n\u003Ch2>Root Cause\u003C/h2>\n\u003Cp>In vulnerable versions of the VM, these jumps result in sequential dynamic tail calls, which require the host stack to maintain a frame for each jump (Figure 2).\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/8c3ef8e0c65b8386684a676c2a1999ac.png\" alt=\"Figure3\" title=\"Figure3\">\nTake WhileCont as an example, others omitted for brevity\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/6159f40b08eaa322d42dbe0625f3faa6.png\" alt=\"Figure4\" title=\"Figure4\">\nFigure 2: Tri-jump recursion to step down into nesting\u003C/p>\n\u003Cp>Ideally, this wouldn’t pose a problem because components are usually represented as OrdCont, whose jump only saves current context and then indicates VM to execute the slice it holds prior to the remaining contract slice, with no more recursion introduced. However, the extraordinary continuations are available for its components in the cc(c0 in TVM) register(the set_c0 branches above) as an intended design in theory, so the contract can abuse this feature to execute deep recursion(described later). Compared with changing the implementation of this normal feature, it is clearer and easier to get rid of the recursion in the jump process of extraordinary continuations.\u003C/p>\n\u003Cp>By repetitively using obtained extraordinary continuation in the construction of upper-level extraordinary continuation, a deeply-nested continuation can be created via iteration. These deeply nested continuations, when evaluated, may exhaust the host stack space available, resulting in a SIGSEGV signal from the OS and the termination of the VM process.\u003C/p>\n\u003Cp>Figure 3 provided here for the PoC of nesting procedure:\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/227e5684a56c90728665efab3f450a3b.png\" alt=\"Figure5\" title=\"Figure5\">\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/e474222678425a01b651da0e4710d5d4.png\" alt=\"Figure6\" title=\"Figure6\">\nFigure 3: Nesting Procedure\u003C/p>\n\u003Cp>We see the body extended with one WhileCont{chkcond=true} in each iteration. By executing the saved cc produced in the last iteration, we get a call stack looking like this:\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/32a75cd7b9fe75ba7317dc86df994be7.png\" alt=\"Figure7\" title=\"Figure7\">\u003C/p>\n\u003Cp>We see a linear dependency of stack space on a nesting level, i.e., iteration times, indicating possible stack exhaustion.\u003C/p>\n\u003Ch2>Note on Exploit in Realworld\u003C/h2>\n\u003Cp>The gas limit in real-world chains makes the construction of malicious contracts rather difficult. Due to the linear complexity of the nesting process(TVM design effectively prevents cheaper construction by self-referential), the development of a working malicious contract is non-trivial. Quantitatively, one level of nesting results in a call sequence, consuming three host stack frames(320Byte) in debug binary and two in release binary(256Byte, the latter two calls inlined into one). For a validator node on modern POSIX OS, the default stack size is 8MiB, which is sufficient for over 30k levels of nesting in release binary. The construction of a contract that can exhaust the stack space is still possible, but it is much more difficult than the example in the previous section.\u003C/p>\n\u003Ch2>Mitigation\u003C/h2>\n\u003Cp>The patch modifies the behavior of jumps in the case of continuation nesting. We can see the change of the continuation jump’s signature.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/ba06a917b38be1e18804fc83b710db47.png\" alt=\"Figure8\" title=\"Figure8\">\nTake UntilCont as an example; others omitted for brevity.\u003C/p>\n\u003Cp>Rather than call VmState::jump on the next continuation, which means recursively performing a tri-jump at each continuation and waiting for a return value to propagate backward, the continuation jump now resolves only the next level of the continuation and then yields control back to the VM.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/1e582d8fea839fbcb558f5fe8a2b1ae3.png\" alt=\"Figure9\" title=\"Figure9\">\u003C/p>\n\u003Cp>Cooperatively, the VM iteratively resolves each continuation level until it encounters a NullRef, signaling the completion of the chain, as implemented in OrdCont or ExuQuitCont. During this iterative process, only one continuation jump is allocated on the host stack at any given time, ensuring constant stack usage.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/11/1b780893677d756682036426da0b584a.png\" alt=\"Figure10\" title=\"Figure10\">\u003C/p>\n\u003Ch2>Conclusion\u003C/h2>\n\u003Cp>For services requiring availability, the usage of recursion can be a potential attack vector. In case a user-defined logic is involved, the enforcement of recursion termination can be a challenge. This DoS vulnerability shows an extreme case under hard (other) resource limits with an unexpected normal feature abuse. Similar issues can occur in case the recursion is dependent on the user input, which is common among control flow primitives of VMs.\u003C/p>\n\u003Cp>This report analyzes the technical details, root cause, and potential exploitation methods of a critical DoS vulnerability identified in the TON Virtual Machine (VM). It also highlights the efficient solution proposed by the TonBit team, which replaced the VM's recursive jump mechanism with an iterative processing approach. This innovative fix mitigated a vulnerability that could have led to network paralysis, offering robust security assurances for the TON ecosystem.\u003C/p>\n\u003Cp>The incident underscores TonBit's deep expertise in blockchain infrastructure security and its pivotal role as the TON network's official Security Assurance Provider (SAP). As an indispensable security partner within the TON ecosystem, TonBit remains at the forefront of safeguarding blockchain network stability and user asset security. From vulnerability detection to solution design, TonBit has leveraged its technical prowess and profound understanding of blockchain technology to establish a solid foundation for the long-term growth of the TON network.\u003C/p>\n\u003Cp>Moreover, TonBit continues to focus on enhancing network security architecture, protecting user data, and improving the security of blockchain application scenarios. Moving forward, TonBit is committed to driving security innovation and advancing the development of secure technologies, ensuring ongoing support for the health and growth of the TON ecosystem and the broader blockchain industry. This successful vulnerability remediation effort has received high praise from the TON core team, further solidifying TonBit's position as a leader in blockchain security and demonstrating its steadfast commitment to advancing decentralized ecosystems.\u003C/p>\n\u003Cp>TonBit Official Website: \u003Ca href=\"https://www.tonbit.xyz/\">https://www.tonbit.xyz/\u003C/a>\nTonBit Official Twitter: \u003Ca href=\"https://x.com/tonbit_\">https://x.com/tonbit_\u003C/a>\nTonBit Official Telegram: \u003Ca href=\"https://t.me/BitsLabHQ\">https://t.me/BitsLabHQ\u003C/a>\nLinkedIn: \u003Ca href=\"https://www.linkedin.com/company/tonbit-team/\">https://www.linkedin.com/company/tonbit-team/\u003C/a>\nBlog: \u003Ca href=\"https://www.tonbit.xyz/#blogs\">https://www.tonbit.xyz/#blogs\u003C/a>\u003C/p>\n\u003Cp>For Audit Inquiries, Contact Us from Telegram: @starchou\u003C/p>","/media/tonbit/2024/11/809c74963fbae36756e352f5291028db.jpg","2024-11-25T03:15:00Z","8 min read","TonBit, a Subsidiary of BitsLab, Discovers Critical Vulnerability in TON VM Root Cause and Mitigation Explained cover image",4,1,3,1791882713949]