[{"data":1,"prerenderedAt":42},["Reactive",2],{"blog-article-tonbit-completes-audit-of-thunder-finance-240705":3,"blog-related-product-updates":17},{"slug":4,"category":5,"categoryLabel":6,"subcategoryLabel":7,"authorName":8,"title":9,"excerpt":10,"contentHtml":11,"coverUrl":12,"seoTitle":9,"seoDescription":10,"seoImageUrl":12,"publishedAt":13,"readTime":14,"cover":12,"coverAlt":15,"hasCover":16},"tonbit-completes-audit-of-thunder-finance-240705","product-updates","Product Updates","Products & Services","TonBit","Tonbit Completes Audit of Thunder Finance","TonBit has successfully completed its security audit of Thunder Finance, a pioneering GameFi project, enhancing platform integrity by addressing vulnerabilities and ensuring safe user interactions. Full audit report available.","\u003Cp>\u003Cimg src=\"/media/tonbit/2024/07/f0c8d52fb1d153d428d9de58e0c9ac93.jpg\" alt=\"tonbit-completes-audit-of-thunder-finance\" title=\"Tonbit Completes Audit of Thunder Finance\">\u003C/p>\n\u003Cp>TonBit, a leader in TON blockchain security and auditing, has announced the successful completion of its audit for Thunder Finance, a trailblazing GameFi project distinguished by its innovative social experiment that assigns real monetary value to user interactions.\u003C/p>\n\u003Cp>Thunder Finance aims to be the first innovative social experiment that gives value to clicking. In Thunder Finance, clicking (boosting) serves as a game action and promotes the token, giving \"Tap to Earn\" real value as a mechanism for monetizing traffic. Its boost system allows users without a wallet to participate. Each user has a fixed number of boosts daily, with Telegram Premium users getting additional boosts. If a token is listed on DEX, the boosts will be converted into airdrop distribution.\u003C/p>\n\u003Ch2>Audit Overview\u003C/h2>\n\u003Cp>TonBit's audit focused on ensuring the integrity and security of Thunder Finance’s innovative platform. The audit identified a total of 12 vulnerabilities, categorized as follows:\u003C/p>\n\u003Cul>\n\u003Cli>Informational: 3\u003C/li>\n\u003Cli>Minor: 5\u003C/li>\n\u003Cli>Medium: 3\u003C/li>\n\u003Cli>Major: 0\u003C/li>\n\u003Cli>Critical: 1\u003C/li>\n\u003C/ul>\n\u003Cp>All identified vulnerabilities have been promptly and effectively addressed, significantly enhancing the platform's security. The complete audit report, which provides an in-depth analysis and summary of the findings, is available for public review and can be accessed here:  \u003Ca href=\"https://tonbit.xyz/reports/ThunderFinance-Final-Audit-Report.pdf\">https://tonbit.xyz/reports/ThunderFinance-Final-Audit-Report.pdf\u003C/a>\u003C/p>\n\u003Ch2>About TonBit\u003C/h2>\n\u003Cp>TonBit, a subsidiary brand of BitsLab, is a pivotal security division deeply engaged in the infrastructure and security audits of the TON ecosystem since 2021. Also supported by TonX Studio.\u003C/p>\n\u003Cp>\u003Ca href=\"https://www.tonbit.xyz/?type=getAudit\">Requests a quote\u003C/a>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://www.tonbit.xyz/\">Website\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://twitter.com/tonbit_\">Twitter\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://t.me/@BitsLabHQ\">Telegram\u003C/a>\u003C/li>\n\u003C/ul>","/media/tonbit/2024/07/f0c8d52fb1d153d428d9de58e0c9ac93.jpg","2024-07-05T04:00:00Z","2 min read","Tonbit Completes Audit of Thunder Finance cover image",true,{"items":18,"total":39,"page":40,"pageSize":41},[19,29,38],{"slug":20,"category":5,"categoryLabel":6,"subcategoryLabel":21,"authorName":8,"title":22,"excerpt":23,"contentHtml":24,"coverUrl":25,"seoTitle":22,"seoDescription":23,"seoImageUrl":25,"publishedAt":26,"readTime":27,"cover":25,"coverAlt":28,"hasCover":16},"exclusive-interview-with-tonbit-under-bitslab-continuously-safeguarding-the-ton-ecosystem-with-innovation-and-expertise","Announcements","Exclusive Interview with TonBit Under BitsLab｜ Continuously Safeguarding the TON Ecosystem with Innovation and Expertise","As the TON ecosystem expands into multiple domains and dimensions, TonBit is leveraging its professional security expertise to build a more robust line of defense for the entire ecosystem. In this interview, we will delve into TonBit’s technical accomplishments and plans in depth.","\u003Cp>The thriving development of the TON ecosystem has always been built on a solid foundation of innovation, decentralization, and community collaboration. In this digital landscape, TonBit, under BitsLab, as an officially recognized Primary Security Assurance Provider (PSAP) for TON, has steadfastly upheld its mission as a guardian of TON network security.\u003C/p>\n\u003Cp>To date, TonBit has completed security audits for over 30 key TON projects, successfully identifying and assisting in fixing multiple vulnerabilities on TON. At the same time, through initiatives such as the TON CTF competition and TON Global Hackerhouse events, TonBit continues to infuse security into the ecosystem and provide sustained momentum for innovation in TON projects.\u003C/p>\n\u003Cp>As the TON ecosystem expands into multiple domains and dimensions, TonBit is leveraging its professional security expertise to build a more robust line of defense for the entire ecosystem. In this interview, we will delve into TonBit’s technical accomplishments and plans in depth.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/05/cd39d782066a72282288ffab4f79546e.png\" alt=\"Banner\" title=\"Banner\">\u003C/p>\n\u003Cp>Q1: Could you introduce TonBit and its role in the TON ecosystem?\u003C/p>\n\u003Cp>TonBit: TonBit is the core sub-brand under BitsLab. As a trusted Primary Security Assurance Provider (SAP) and early builder in the TON ecosystem, we are committed to strengthening TON infrastructure security by delivering comprehensive security audits, vulnerability detection, and proactive penetration testing.\u003C/p>\n\u003Cp>As an officially recognized SAP by the TON Foundation, we specialize in auditing smart contracts written in Tact and FunC, ensuring that projects built on TON maintain technical robustness and long-term resilience.\u003C/p>\n\u003Cp>Q2: What services does TonBit provide for TON ecosystem projects?\u003C/p>\n\u003Cp>TonBit: We primarily offer two core services:\u003C/p>\n\u003Cp>Smart Contract Audits: In-depth code reviews for Tact/FunC contracts\nPenetration Testing: Proactive security assessments for high-impact Web3 projects\u003C/p>\n\u003Cp>To date, we have completed security audits for over 30 TON projects, including key projects such as Tonstakers, Torch Finance, Fiva Protocol, Duckchain, and Catizen.\nAdditionally, we have achieved significant results in vulnerability discovery, having identified and assisted in fixing three vulnerabilities on TON, including:\u003C/p>\n\u003Cp>One critical vulnerability\nOne medium-risk vulnerability\nOne TON RUNVM vulnerability\u003C/p>\n\u003Cp>Q3: What was the original purpose behind TonBit hosting the TON CTF competition?\u003C/p>\n\u003Cp>TonBit: The TON CTF competition was designed to foster a security-first culture within the TON ecosystem. Its goals were to attract and challenge security experts and developers, with participants tackling challenges using FunC and Tact programming languages.\u003C/p>\n\u003Cp>We believe TON CTF serves as a valuable and engaging way for TON developers to enhance their skills and explore the field of security, driving innovation, skill development, and deeper understanding of FunC and Tact within the TON ecosystem.\u003C/p>\n\u003Cp>The event drew participation from over 20 global universities and security organizations, with more than 300 teams competing, significantly raising security awareness among participants in the TON ecosystem. More than just a competition, it served as an incubation platform for the next generation of TON security guardians.\u003C/p>\n\u003Cp>Q4: How does the TON Global Hackerhouse event promote ecosystem development?\u003C/p>\n\u003Cp>TonBit: In 2025, we co-hosted TON Global Hackerhouse with TON Official, TONX, TON Society, and TON Core, bringing together global developers to build the TON ecosystem jointly. The event not only attracted top-tier projects to participate and garnered millions of dollars in exposure but also drove innovative breakthroughs in the decentralized finance field, fully demonstrating TON's real-world application potential as a scalable blockchain.\u003C/p>\n\u003Cp>As the designated security guardian of the TON ecosystem, TonBit has always maintained high vigilance against various potential threats. In this in-depth interview, the TonBit security team provided a detailed analysis of three vulnerability discoveries, ranging from a \"Critical\"-level risk capable of paralyzing the network, to a \"Medium-risk\" vulnerability affecting system performance, and even complex attack vectors at the virtual machine level. Each case demonstrates TonBit's exceptional technical capabilities and its \"prevention-before-cure\" security philosophy.\u003C/p>\n\u003Cp>Q5: Regarding the critical TON Virtual Machine vulnerability discovered by TonBit in 2024, could you elaborate on its impact?\u003C/p>\n\u003Cp>TonBit: In November 2024, the TON official team formally acknowledged the TonBit security team under BitsLab in their latest version update notes for discovering a critical vulnerability in the TON Virtual Machine. If maliciously exploited, this vulnerability could lead to virtual machine resource exhaustion, system crashes, and ultimately affect the stability of the entire TON network.\u003C/p>\n\u003Cp>The root cause of this vulnerability lay in the risky design of nested operations when the TON Virtual Machine handled contract continuations. Malicious contracts could create deeply nested continuation structures, triggering recursive evaluation processes that would exhaust the virtual machine's host stack space. This resource exhaustion attack could cause abnormal crashes of the TON Virtual Machine - simply put, without spending a single TON, it could bring down all Validators, directly impacting system availability.\u003C/p>\n\u003Cp>Through in-depth analysis, the TonBit team collaborated with Ton Core to propose an innovative solution. This solution modifies the virtual machine's internal jump mechanism by replacing recursive calls with iterative approaches, effectively preventing such attacks. The solution has been implemented in the latest version of TON, providing users with a more secure and stable operating experience.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2024/12/5eaaf7f0ec5a0f53258207557e13c31c.png\" alt=\"Figure1\" title=\"Figure1\">\u003C/p>\n\u003Cp>Q6: How did TonBit address another vulnerability in TON light nodes?\u003C/p>\n\u003Cp>TonBit: In November 2024, we also discovered a \"Continuation Parameter Abuse Vulnerability\" in TON light nodes. The core issue was that attackers could exploit deeply nested Continuation parameters to exhaust a node's computational resources. In simple terms, this vulnerability allowed seemingly legitimate requests to keep nodes busy indefinitely. Imagine a car that appears normal but has a hidden flaw causing it to consume excessive fuel constantly—that's essentially what this vulnerability did, silently consuming computing resources and affecting the network's overall throughput.\u003C/p>\n\u003Cp>Ultimately, by optimizing the parameter processing logic, we helped the TON team enhance the performance of light nodes, ensuring network efficiency and resilience against such attacks.\u003C/p>\n\u003Cp>Q7: What was the impact of the TON RUNVM vulnerability discovered in 2025?\u003C/p>\n\u003Cp>TonBit: This vulnerability involved non-atomic state migration in RUNVM instructions, where attackers could exploit the precise moment when a child virtual machine exhausted its gas to contaminate the parent VM's libraries and induce subsequent call failures. This chain of exploitation would ultimately lead to abnormal behavior in any contracts that depended on library integrity.\u003C/p>\n\u003Cp>Upon discovery, we promptly submitted the complete technical details along with comprehensive mitigation solutions to the TON Foundation, while actively assisting them through the entire remediation process. We strongly advised all developers in the ecosystem to take three crucial actions: immediately update all dependency libraries once official patches became available, implement more rigorous library integrity verification protocols, and significantly enhance gas management logic within their self-developed contracts. These collective measures have created an effective defense against potential malicious exploitation of similar vulnerabilities in the future.\u003C/p>\n\u003Cp>\u003Cimg src=\"/media/tonbit/2025/05/420686f3f880b9c20160386ee0302904.png\" alt=\"Figure2\" title=\"Figure2\">\u003C/p>\n\u003Cp>Q8: What unique advantages does TonBit have compared to other blockchain security companies?\u003C/p>\n\u003Cp>TonBit: Our core competitiveness is reflected in three key dimensions:\u003C/p>\n\u003Col>\n\u003Cli>TON-Specific Technical Expertise: We are not only proficient in Tact and FunC programming languages but also possess specialized penetration testing and vulnerability discovery capabilities.\u003C/li>\n\u003Cli>Deep Ecosystem Integration: As an officially recognized SAP (Security Assurance Provider), we are deeply committed to safeguarding the TON ecosystem, having already audited over 30 critical projects within the TON network.\u003C/li>\n\u003Cli>Community Co-Building Capabilities: Through initiatives such as CTF competitions and TON Global Hackerhouse events, we actively enhance community engagement, elevate security awareness, and foster ecosystem development.\u003C/li>\n\u003C/ol>\n\u003Cp>We go beyond mere code auditing – we are dedicated to building an impenetrable ecosystem.\u003C/p>\n\u003Cp>Q9: What are TonBit's key initiatives for 2025-2026?\u003C/p>\n\u003Cp>TonBit: We will focus on advancing three strategic priorities:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cp>Sustained TON Ecosystem Protection:\nWe will continue providing reliable security audits for TON ecosystem projects, develop automated scanning tools for Tact/FunC smart contracts, and enhance penetration testing and vulnerability discovery efforts to build a comprehensive security framework for the entire ecosystem.\u003C/p>\n\u003C/li>\n\u003Cli>\u003Cp>Industry-Academia-Research Collaboration:\nBy establishing joint laboratories with leading academic institutions, we will conduct specialized research on the security of the TON ecosystem.\u003C/p>\n\u003C/li>\n\u003Cli>\u003Cp>Developer Empowerment Program:\nWe will elevate developer security awareness through targeted training courses and hands-on exercises, because a secure TON ecosystem begins with education as its foundation.\u003C/p>\n\u003C/li>\n\u003C/ol>\n\u003Cp>Closing: TonBit remains dedicated to its role as TON’s security cornerstone. By merging cutting-edge research with community-driven initiatives, they’re shaping a future where innovation thrives on a foundation of trust. To learn more, visit TonBit’s GitHub or follow our updates on X (Twitter).\u003C/p>","/media/tonbit/2025/05/cd39d782066a72282288ffab4f79546e.png","2025-05-20T03:15:00Z","7 min read","Exclusive Interview with TonBit Under BitsLab｜ Continuously Safeguarding the TON Ecosystem with Innovation and Expertise cover image",{"slug":30,"category":5,"categoryLabel":6,"subcategoryLabel":7,"authorName":8,"title":31,"excerpt":32,"contentHtml":33,"coverUrl":34,"seoTitle":31,"seoDescription":32,"seoImageUrl":34,"publishedAt":35,"readTime":36,"cover":34,"coverAlt":37,"hasCover":16},"tonbit-completes-audit-of-trc404-240705","Tonbit Completes Audit of TRC404 Protocol","TonBit has completed its security audit of the TRC404 protocol, enhancing liquidity and divisibility within the NFT ecosystem on TON. The audit identified and addressed vulnerabilities to ensure platform security. Full audit report available.","\u003Cp>\u003Cimg src=\"/media/tonbit/2024/07/d0495e67c95573d3b80eaf93b88134f8.jpg\" alt=\"tonbit-completes-audit-of-trc404\" title=\"Tonbit Completes Audit of TRC404 Protocol\">\u003C/p>\n\u003Cp>TonBit, a leader in TON blockchain security and auditing, has completed its audit of the TRC404 protocol, an innovative project aimed at enhancing liquidity and divisibility within the NFT ecosystem in TON.\u003C/p>\n\u003Cp>The TRC404 protocol is an innovative mixed Jetton and NFT implementation featuring native liquidity and fractionalization for semi-fungible tokens. Inspired by the ERC-404 protocol, TRC404 is the first project to implement this standard on the TON blockchain. It addresses critical issues of “insufficient liquidity” and “indivisibility” commonly faced by NFTs, enabling native support for the fragmentation and reassembly of NFTs through wallet transfers of tokens, without the need for third-party platforms.\u003C/p>\n\u003Ch2>Audit Overview\u003C/h2>\n\u003Cp>TonBit’s thorough audit of the TRC404 protocol identified a total of 9 vulnerabilities, categorized as follows:\u003C/p>\n\u003Cul>\n\u003Cli>Informational: 0\u003C/li>\n\u003Cli>Minor: 2\u003C/li>\n\u003Cli>Medium: 4\u003C/li>\n\u003Cli>Major: 2\u003C/li>\n\u003Cli>Critical: 1\u003C/li>\n\u003C/ul>\n\u003Cp>The complete audit report, which provides an in-depth analysis and summary of the findings, is available for public review and can be accessed here: \u003Ca href=\"https://tonbit.xyz/reports/TRC404-Smart-Contract-Final-Audit-Report.pdf\">https://tonbit.xyz/reports/TRC404-Smart-Contract-Final-Audit-Report.pdf\u003C/a>\u003C/p>\n\u003Ch2>About TonBit\u003C/h2>\n\u003Cp>TonBit, a subsidiary brand of BitsLab, is a pivotal security division deeply engaged in the infrastructure and security audits of the TON ecosystem since 2021. Also supported by TonX Studio.\u003C/p>\n\u003Cp>\u003Ca href=\"https://www.tonbit.xyz/?type=getAudit\">Requests a quote\u003C/a>\u003C/p>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https://www.tonbit.xyz/\">Website\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://twitter.com/tonbit_\">Twitter\u003C/a>\u003C/li>\n\u003Cli>\u003Ca href=\"https://t.me/@BitsLabHQ\">Telegram\u003C/a>\u003C/li>\n\u003C/ul>","/media/tonbit/2024/07/d0495e67c95573d3b80eaf93b88134f8.jpg","2024-07-05T06:00:00Z","1 min read","Tonbit Completes Audit of TRC404 Protocol cover image",{"slug":4,"category":5,"categoryLabel":6,"subcategoryLabel":7,"authorName":8,"title":9,"excerpt":10,"contentHtml":11,"coverUrl":12,"seoTitle":9,"seoDescription":10,"seoImageUrl":12,"publishedAt":13,"readTime":14,"cover":12,"coverAlt":15,"hasCover":16},4,1,3,1791882713982]