Enhancing The Open Network: Definition and Automated Detection of Smart Contract Defects

2025-01-11

AI Summary

FunC smart contracts on the TON blockchain harbor unaddressed reliability and security vulnerabilities unrecognized by existing analysis tools. Method: This paper systematically identifies eight canonical defect classes and proposes TONScanner, the first static analysis framework tailored for the TON ecosystem. TONScanner leverages the FunC compiler frontend to construct a DAG-based intermediate representation, integrating control-flow graphs (CFG), static single-assignment (SSA) form, data-dependence analysis, call graphs, taint analysis, and native TON Cell structure modeling for multi-dimensional, high-precision vulnerability detection. Contribution/Results: As the first static analyzer supporting both the FunC language and TON’s low-level Cell model, TONScanner detects 14,995 defects across 1,640 real-world contracts, achieving a 97.49% precision rate under manual validation. The results expose widespread development pitfalls in the TON ecosystem, providing both theoretical foundations and practical tooling for enhancing smart contract security.

Technology Category

• Reasoning under Uncertainty: Uncertainty Representations
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Search and Optimization: Evaluation and Analysis

Application Category

• Security and Privacy: Cryptocurrency and smart contracts
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity

Abstract

The Open Network (TON), designed to support Telegram's extensive user base of hundreds of millions, has garnered considerable attention since its launch in 2022. FunC is the most popular programming language for writing smart contracts on TON. It is distinguished by a unique syntax compared to other smart contract languages. Despite growing interest, research on the practical defects of TON smart contracts is still in its early stages. In this paper, we summarize eight smart contract defects identified from TON's official blogs and audit reports, each with detailed definitions and code examples. Furthermore, we propose a static analysis framework called TONScanner to facilitate the detection of these defects. Specifically, TONScanner reuses FunC compiler's frontend code to transform the FunC source code into FunC intermediate representation (IR) in the form of a directed acyclic graph (DAG). Based on this IR, TONScanner constructs a control flow graph (CFG), then transforms it into a static single assignment (SSA) form to simplify further analysis. TONScanner also integrates Data Dependency, Call Graph, Taint Analysis, and Cell Construct, which are specifically tailored for TON blockchain's unique data structures. These components finally facilitate the identification of the eight defects. We evaluate the effectiveness of TONScanner by applying it to 1,640 smart contracts and find a total of 14,995 defects. Through random sampling and manual labeling, we find that TONScanner achieves an overall precision of 97.49%. The results reveal that current TON contracts contain numerous defects, indicating that developers are prone to making errors. TONScanner has proven its ability to accurately identify these defects, thereby aiding in their correction.

Problem

• Smart Contracts
• TON Network
• Security Issues

Innovation

• TONScanner
• Smart Contract Analysis
• Blockchain Security