[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DSS67TCVQPDEWT1FRD39PS":3,"skill-same:01M6DSS67TCVQPDEWT1FRD39PS":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":30,"linkOnly":31,"markdownContent":32,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M6DSS67TCVQPDEWT1FRD39PS","ton-vulnerability-scanner",null,"Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fton-vulnerability-scanner\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29],"vulnerability","vulnerability scanner","scanner","ton vulnerability scanner","vulnerabilities","network","open","gas","use","contracts","as","critical","2026-11-10 10:12:30",false,"---\nname: ton-vulnerability-scanner\ndescription: Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.\n---\n\n# TON Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan TON blockchain smart contracts written in FunC for platform-specific security vulnerabilities related to boolean logic, Jetton token handling, and gas management. This skill encodes 3 critical vulnerability patterns unique to TON's architecture.\n\n## 2. When to Use This Skill\n\n- Auditing TON smart contracts (FunC language)\n- Reviewing Jetton token implementations\n- Validating token transfer notification handlers\n- Pre-launch security assessment of TON dApps\n- Reviewing gas forwarding logic\n- Assessing boolean condition handling\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **FunC files**: `.fc`, `.func`\n\n### Language\u002FFramework Markers\n```func\n;; FunC contract indicators\n#include \"imports\u002Fstdlib.fc\";\n\n() recv_internal(int my_balance, int msg_value, cell in_msg_full, slice in_msg_body) impure {\n    ;; Contract logic\n}\n\n() recv_external(slice in_msg) impure {\n    ;; External message handler\n}\n\n;; Common patterns\nsend_raw_message()\nload_uint(), load_msg_addr(), load_coins()\nbegin_cell(), end_cell(), store_*()\ntransfer_notification operation\nop::transfer, op::transfer_notification\n.store_uint().store_slice().store_coins()\n```\n\n### Project Structure\n- `contracts\u002F*.fc` - FunC contract source\n- `wrappers\u002F*.ts` - TypeScript wrappers\n- `tests\u002F*.spec.ts` - Contract tests\n- `ton.config.ts` or `wasm.config.ts` - TON project config\n\n### Tool Support\n- **TON Blueprint**: Development framework for TON\n- **toncli**: CLI tool for TON contracts\n- **ton-compiler**: FunC compiler\n- Manual review primarily (limited automated tools)\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for FunC\u002FTact contracts\n2. **Analyze each contract** for the 3 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check replay protection** and sender validation\n\n---\n\n## 5. Example Output\n\nWhen vulnerabilities are found, you'll get a report like this:\n\n```\n=== TON VULNERABILITY SCAN RESULTS ===\n\nProject: my-ton-contract\nFiles Scanned: 3 (.fc, .tact)\nVulnerabilities Found: 2\n\n---\n\n[CRITICAL] Missing Replay Protection\nFile: contracts\u002Fwallet.fc:45\nPattern: No sequence number or nonce validation\n\n\n---\n\n## 5. Vulnerability Patterns (3 Patterns)\n\nI check for 3 critical vulnerability patterns unique to TON. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Missing Sender Check** ⚠️ CRITICAL - No sender validation on privileged operations\n2. **Integer Overflow** ⚠️ CRITICAL - Unchecked arithmetic in FunC\n3. **Improper Gas Handling** ⚠️ HIGH - Insufficient gas reservations\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify FunC language (`.fc` or `.func` files)\n2. Check for TON Blueprint or toncli project structure\n3. Locate contract source files\n4. Identify Jetton-related contracts\n\n### Step 2: Boolean Logic Review\n```bash\n# Find boolean-like variables\nrg \"int.*is_|int.*has_|int.*flag|int.*enabled\" contracts\u002F\n\n# Check for positive integers used as booleans\nrg \"= 1;|return 1;\" contracts\u002F | grep -E \"is_|has_|flag|enabled|valid\"\n\n# Look for NOT operations on boolean-like values\nrg \"~.*\\(|~ \" contracts\u002F\n```\n\nFor each boolean:\n- [ ] Uses -1 for true, 0 for false\n- [ ] NOT using 1 or other positive integers\n- [ ] Logic operations work correctly\n\n### Step 3: Jetton Handler Analysis\n```bash\n# Find transfer_notification handlers\nrg \"transfer_notification|op::transfer_notification\" contracts\u002F\n```\n\nFor each Jetton handler:\n- [ ] Validates sender address\n- [ ] Sender checked against stored Jetton wallet address\n- [ ] Cannot trust forward_payload without sender validation\n- [ ] Has admin function to set Jetton wallet address\n\n### Step 4: Gas\u002FForward Amount Review\n```bash\n# Find forward amount usage\nrg \"forward_ton_amount|forward_amount\" contracts\u002F\nrg \"load_coins\\(\\)\" contracts\u002F\n\n# Find send_raw_message calls\nrg \"send_raw_message\" contracts\u002F\n```\n\nFor each outgoing message:\n- [ ] Forward amounts are fixed\u002Fbounded\n- [ ] OR user-provided amounts validated against msg_value\n- [ ] Cannot drain contract balance\n- [ ] Appropriate send_raw_message flags used\n\n### Step 5: Manual Review\nTON contracts require thorough manual review:\n- Boolean logic with `~`, `&`, `|` operators\n- Message parsing and validation\n- Gas economics and fee calculations\n- Storage operations and data serialization\n\n---\n\n## 6. Reporting Format\n\n### Finding Template\n```markdown\n## [CRITICAL] Fake Jetton Contract - Missing Sender Validation\n\n**Location**: `contracts\u002Fstaking.fc:85-95` (recv_internal, transfer_notification handler)\n\n**Description**:\nThe `transfer_notification` operation handler does not validate that the sender is the expected Jetton wallet contract. Any attacker can send a fake `transfer_notification` message claiming to have transferred tokens, crediting themselves without actually depositing any Jettons.\n\n**Vulnerable Code**:\n```func\n\u002F\u002F staking.fc, line 85\nif (op == op::transfer_notification) {\n    int jetton_amount = in_msg_body~load_coins();\n    slice from_user = in_msg_body~load_msg_addr();\n\n    ;; WRONG: No validation of sender_address!\n    ;; Attacker can claim any jetton_amount\n\n    credit_user(from_user, jetton_amount);\n}\n```\n\n**Attack Scenario**:\n1. Attacker deploys malicious contract\n2. Malicious contract sends `transfer_notification` message to staking contract\n3. Message claims attacker transferred 1,000,000 Jettons\n4. Staking contract credits attacker without checking sender\n5. Attacker can now withdraw from contract or gain benefits without depositing\n\n**Proof of Concept**:\n```typescript\n\u002F\u002F Attacker sends fake transfer_notification\nconst attackerContract = await blockchain.treasury(\"attacker\");\n\nawait stakingContract.sendInternalMessage(attackerContract.getSender(), {\n  op: OP_CODES.TRANSFER_NOTIFICATION,\n  jettonAmount: toNano(\"1000000\"), \u002F\u002F Fake amount\n  fromUser: attackerContract.address,\n});\n\n\u002F\u002F Attacker successfully credited without sending real Jettons\nconst balance = await stakingContract.getUserBalance(attackerContract.address);\nexpect(balance).toEqual(toNano(\"1000000\")); \u002F\u002F Attack succeeded\n```\n\n**Recommendation**:\nStore expected Jetton wallet address and validate sender:\n```func\nglobal slice jetton_wallet_address;\n\n() recv_internal(...) impure {\n    load_data();  ;; Load jetton_wallet_address from storage\n\n    slice cs = in_msg_full.begin_parse();\n    int flags = cs~load_uint(4);\n    slice sender_address = cs~load_msg_addr();\n\n    int op = in_msg_body~load_uint(32);\n\n    if (op == op::transfer_notification) {\n        ;; CRITICAL: Validate sender\n        throw_unless(error::wrong_jetton_wallet,\n            equal_slices(sender_address, jetton_wallet_address));\n\n        int jetton_amount = in_msg_body~load_coins();\n        slice from_user = in_msg_body~load_msg_addr();\n\n        ;; Safe to credit user\n        credit_user(from_user, jetton_amount);\n    }\n}\n```\n\n**References**:\n- building-secure-contracts\u002Fnot-so-smart-contracts\u002Fton\u002Ffake_jetton_contract\n```\n\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Fake Jetton contract (unauthorized minting\u002Fcrediting)\n\n### High (Fix Before Launch)\n- Integer as boolean (logic errors, broken conditions)\n- Forward TON without gas check (balance drainage)\n\n---\n\n## 8. Testing Recommendations\n\n### Unit Tests\n```typescript\nimport { Blockchain } from \"@ton\u002Fsandbox\";\nimport { toNano } from \"ton-core\";\n\ndescribe(\"Security tests\", () => {\n  let blockchain: Blockchain;\n  let contract: Contract;\n\n  beforeEach(async () => {\n    blockchain = await Blockchain.create();\n    contract = blockchain.openContract(await Contract.fromInit());\n  });\n\n  it(\"should use correct boolean values\", async () => {\n    \u002F\u002F Test that TRUE = -1, FALSE = 0\n    const result = await contract.getFlag();\n    expect(result).toEqual(-1n); \u002F\u002F True\n    expect(result).not.toEqual(1n); \u002F\u002F Not 1!\n  });\n\n  it(\"should reject fake jetton transfer\", async () => {\n    const attacker = await blockchain.treasury(\"attacker\");\n\n    const result = await contract.send(\n      attacker.getSender(),\n      { value: toNano(\"0.05\") },\n      {\n        $$type: \"TransferNotification\",\n        query_id: 0n,\n        amount: toNano(\"1000\"),\n        from: attacker.address,\n      }\n    );\n\n    expect(result.transactions).toHaveTransaction({\n      success: false, \u002F\u002F Should reject\n    });\n  });\n\n  it(\"should validate gas for forward amount\", async () => {\n    const result = await contract.send(\n      user.getSender(),\n      { value: toNano(\"0.01\") }, \u002F\u002F Insufficient gas\n      {\n        $$type: \"Transfer\",\n        to: recipient.address,\n        forward_ton_amount: toNano(\"1\"), \u002F\u002F Trying to forward 1 TON\n      }\n    );\n\n    expect(result.transactions).toHaveTransaction({\n      success: false,\n    });\n  });\n});\n```\n\n### Integration Tests\n```typescript\n\u002F\u002F Test with real Jetton wallet\nit(\"should accept transfer from real jetton wallet\", async () => {\n  \u002F\u002F Deploy actual Jetton minter and wallet\n  const jettonMinter = await blockchain.openContract(JettonMinter.create());\n  const userJettonWallet = await jettonMinter.getWalletAddress(user.address);\n\n  \u002F\u002F Set jetton wallet in contract\n  await contract.setJettonWallet(userJettonWallet);\n\n  \u002F\u002F Real transfer from Jetton wallet\n  const result = await userJettonWallet.sendTransfer(\n    user.getSender(),\n    contract.address,\n    toNano(\"100\"),\n    {}\n  );\n\n  expect(result.transactions).toHaveTransaction({\n    to: contract.address,\n    success: true,\n  });\n});\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fton\u002F`\n- **TON Documentation**: https:\u002F\u002Fdocs.ton.org\u002F\n- **FunC Documentation**: https:\u002F\u002Fdocs.ton.org\u002Fdevelop\u002Ffunc\u002Foverview\n- **TON Blueprint**: https:\u002F\u002Fgithub.com\u002Fton-org\u002Fblueprint\n- **Jetton Standard**: https:\u002F\u002Fgithub.com\u002Fton-blockchain\u002FTEPs\u002Fblob\u002Fmaster\u002Ftext\u002F0074-jettons-standard.md\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing TON contract audit:\n\n**Boolean Logic (HIGH)**:\n- [ ] All boolean values use -1 (true) and 0 (false)\n- [ ] NO positive integers (1, 2, etc.) used as booleans\n- [ ] Functions returning booleans return -1 for true\n- [ ] Boolean logic with `~`, `&`, `|` uses correct values\n- [ ] Tests verify boolean operations work correctly\n\n**Jetton Security (CRITICAL)**:\n- [ ] `transfer_notification` handler validates sender address\n- [ ] Sender checked against stored Jetton wallet address\n- [ ] Jetton wallet address stored during initialization\n- [ ] Admin function to set\u002Fupdate Jetton wallet\n- [ ] Cannot trust forward_payload without sender validation\n- [ ] Tests with fake Jetton contracts verify rejection\n\n**Gas & Forward Amounts (HIGH)**:\n- [ ] Forward TON amounts are fixed\u002Fbounded\n- [ ] OR user-provided amounts validated: `msg_value >= tx_fee + forward_amount`\n- [ ] Contract balance protected from drainage\n- [ ] Appropriate `send_raw_message` flags used\n- [ ] Tests verify cannot drain contract with excessive forward amounts\n\n**Testing**:\n- [ ] Unit tests for all three vulnerability types\n- [ ] Integration tests with real Jetton contracts\n- [ ] Gas cost analysis for all operations\n- [ ] Testnet deployment before mainnet\n","# TON Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan TON blockchain smart contracts written in FunC for platform-specific security vulnerabilities related to boolean logic, Jetton token handling, and gas management. This skill encodes 3 critical vulnerability patterns unique to TON's architecture.\n\n## 2. When to Use This Skill\n\n- Auditing TON smart contracts (FunC language)\n- Reviewing Jetton token implementations\n- Validating token transfer notification handlers\n- Pre-launch security assessment of TON dApps\n- Reviewing gas forwarding logic\n- Assessing boolean condition handling\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **FunC files**: `.fc`, `.func`\n\n### Language\u002FFramework Markers\n```func\n;; FunC contract indicators\n#include \"imports\u002Fstdlib.fc\";\n\n() recv_internal(int my_balance, int msg_value, cell in_msg_full, slice in_msg_body) impure {\n    ;; Contract logic\n}\n\n() recv_external(slice in_msg) impure {\n    ;; External message handler\n}\n\n;; Common patterns\nsend_raw_message()\nload_uint(), load_msg_addr(), load_coins()\nbegin_cell(), end_cell(), store_*()\ntransfer_notification operation\nop::transfer, op::transfer_notification\n.store_uint().store_slice().store_coins()\n```\n\n### Project Structure\n- `contracts\u002F*.fc` - FunC contract source\n- `wrappers\u002F*.ts` - TypeScript wrappers\n- `tests\u002F*.spec.ts` - Contract tests\n- `ton.config.ts` or `wasm.config.ts` - TON project config\n\n### Tool Support\n- **TON Blueprint**: Development framework for TON\n- **toncli**: CLI tool for TON contracts\n- **ton-compiler**: FunC compiler\n- Manual review primarily (limited automated tools)\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for FunC\u002FTact contracts\n2. **Analyze each contract** for the 3 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check replay protection** and sender validation\n\n---\n\n## 5. Example Output\n\nWhen vulnerabilities are found, you'll get a report like this:\n\n```\n=== TON VULNERABILITY SCAN RESULTS ===\n\nProject: my-ton-contract\nFiles Scanned: 3 (.fc, .tact)\nVulnerabilities Found: 2\n\n---\n\n[CRITICAL] Missing Replay Protection\nFile: contracts\u002Fwallet.fc:45\nPattern: No sequence number or nonce validation\n\n\n---\n\n## 5. Vulnerability Patterns (3 Patterns)\n\nI check for 3 critical vulnerability patterns unique to TON. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Missing Sender Check** ⚠️ CRITICAL - No sender validation on privileged operations\n2. **Integer Overflow** ⚠️ CRITICAL - Unchecked arithmetic in FunC\n3. **Improper Gas Handling** ⚠️ HIGH - Insufficient gas reservations\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify FunC language (`.fc` or `.func` files)\n2. Check for TON Blueprint or toncli project structure\n3. Locate contract source files\n4. Identify Jetton-related contracts\n\n### Step 2: Boolean Logic Review\n```bash\n# Find boolean-like variables\nrg \"int.*is_|int.*has_|int.*flag|int.*enabled\" contracts\u002F\n\n# Check for positive integers used as booleans\nrg \"= 1;|return 1;\" contracts\u002F | grep -E \"is_|has_|flag|enabled|valid\"\n\n# Look for NOT operations on boolean-like values\nrg \"~.*\\(|~ \" contracts\u002F\n```\n\nFor each boolean:\n- [ ] Uses -1 for true, 0 for false\n- [ ] NOT using 1 or other positive integers\n- [ ] Logic operations work correctly\n\n### Step 3: Jetton Handler Analysis\n```bash\n# Find transfer_notification handlers\nrg \"transfer_notification|op::transfer_notification\" contracts\u002F\n```\n\nFor each Jetton handler:\n- [ ] Validates sender address\n- [ ] Sender checked against stored Jetton wallet address\n- [ ] Cannot trust forward_payload without sender validation\n- [ ] Has admin function to set Jetton wallet address\n\n### Step 4: Gas\u002FForward Amount Review\n```bash\n# Find forward amount usage\nrg \"forward_ton_amount|forward_amount\" contracts\u002F\nrg \"load_coins\\(\\)\" contracts\u002F\n\n# Find send_raw_message calls\nrg \"send_raw_message\" contracts\u002F\n```\n\nFor each outgoing message:\n- [ ] Forward amounts are fixed\u002Fbounded\n- [ ] OR user-provided amounts validated against msg_value\n- [ ] Cannot drain contract balance\n- [ ] Appropriate send_raw_message flags used\n\n### Step 5: Manual Review\nTON contracts require thorough manual review:\n- Boolean logic with `~`, `&`, `|` operators\n- Message parsing and validation\n- Gas economics and fee calculations\n- Storage operations and data serialization\n\n---\n\n## 6. Reporting Format\n\n### Finding Template\n```markdown\n## [CRITICAL] Fake Jetton Contract - Missing Sender Validation\n\n**Location**: `contracts\u002Fstaking.fc:85-95` (recv_internal, transfer_notification handler)\n\n**Description**:\nThe `transfer_notification` operation handler does not validate that the sender is the expected Jetton wallet contract. Any attacker can send a fake `transfer_notification` message claiming to have transferred tokens, crediting themselves without actually depositing any Jettons.\n\n**Vulnerable Code**:\n```func\n\u002F\u002F staking.fc, line 85\nif (op == op::transfer_notification) {\n    int jetton_amount = in_msg_body~load_coins();\n    slice from_user = in_msg_body~load_msg_addr();\n\n    ;; WRONG: No validation of sender_address!\n    ;; Attacker can claim any jetton_amount\n\n    credit_user(from_user, jetton_amount);\n}\n```\n\n**Attack Scenario**:\n1. Attacker deploys malicious contract\n2. Malicious contract sends `transfer_notification` message to staking contract\n3. Message claims attacker transferred 1,000,000 Jettons\n4. Staking contract credits attacker without checking sender\n5. Attacker can now withdraw from contract or gain benefits without depositing\n\n**Proof of Concept**:\n```typescript\n\u002F\u002F Attacker sends fake transfer_notification\nconst attackerContract = await blockchain.treasury(\"attacker\");\n\nawait stakingContract.sendInternalMessage(attackerContract.getSender(), {\n  op: OP_CODES.TRANSFER_NOTIFICATION,\n  jettonAmount: toNano(\"1000000\"), \u002F\u002F Fake amount\n  fromUser: attackerContract.address,\n});\n\n\u002F\u002F Attacker successfully credited without sending real Jettons\nconst balance = await stakingContract.getUserBalance(attackerContract.address);\nexpect(balance).toEqual(toNano(\"1000000\")); \u002F\u002F Attack succeeded\n```\n\n**Recommendation**:\nStore expected Jetton wallet address and validate sender:\n```func\nglobal slice jetton_wallet_address;\n\n() recv_internal(...) impure {\n    load_data();  ;; Load jetton_wallet_address from storage\n\n    slice cs = in_msg_full.begin_parse();\n    int flags = cs~load_uint(4);\n    slice sender_address = cs~load_msg_addr();\n\n    int op = in_msg_body~load_uint(32);\n\n    if (op == op::transfer_notification) {\n        ;; CRITICAL: Validate sender\n        throw_unless(error::wrong_jetton_wallet,\n            equal_slices(sender_address, jetton_wallet_address));\n\n        int jetton_amount = in_msg_body~load_coins();\n        slice from_user = in_msg_body~load_msg_addr();\n\n        ;; Safe to credit user\n        credit_user(from_user, jetton_amount);\n    }\n}\n```\n\n**References**:\n- building-secure-contracts\u002Fnot-so-smart-contracts\u002Fton\u002Ffake_jetton_contract\n```\n\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Fake Jetton contract (unauthorized minting\u002Fcrediting)\n\n### High (Fix Before Launch)\n- Integer as boolean (logic errors, broken conditions)\n- Forward TON without gas check (balance drainage)\n\n---\n\n## 8. Testing Recommendations\n\n### Unit Tests\n```typescript\nimport { Blockchain } from \"@ton\u002Fsandbox\";\nimport { toNano } from \"ton-core\";\n\ndescribe(\"Security tests\", () => {\n  let blockchain: Blockchain;\n  let contract: Contract;\n\n  beforeEach(async () => {\n    blockchain = await Blockchain.create();\n    contract = blockchain.openContract(await Contract.fromInit());\n  });\n\n  it(\"should use correct boolean values\", async () => {\n    \u002F\u002F Test that TRUE = -1, FALSE = 0\n    const result = await contract.getFlag();\n    expect(result).toEqual(-1n); \u002F\u002F True\n    expect(result).not.toEqual(1n); \u002F\u002F Not 1!\n  });\n\n  it(\"should reject fake jetton transfer\", async () => {\n    const attacker = await blockchain.treasury(\"attacker\");\n\n    const result = await contract.send(\n      attacker.getSender(),\n      { value: toNano(\"0.05\") },\n      {\n        $$type: \"TransferNotification\",\n        query_id: 0n,\n        amount: toNano(\"1000\"),\n        from: attacker.address,\n      }\n    );\n\n    expect(result.transactions).toHaveTransaction({\n      success: false, \u002F\u002F Should reject\n    });\n  });\n\n  it(\"should validate gas for forward amount\", async () => {\n    const result = await contract.send(\n      user.getSender(),\n      { value: toNano(\"0.01\") }, \u002F\u002F Insufficient gas\n      {\n        $$type: \"Transfer\",\n        to: recipient.address,\n        forward_ton_amount: toNano(\"1\"), \u002F\u002F Trying to forward 1 TON\n      }\n    );\n\n    expect(result.transactions).toHaveTransaction({\n      success: false,\n    });\n  });\n});\n```\n\n### Integration Tests\n```typescript\n\u002F\u002F Test with real Jetton wallet\nit(\"should accept transfer from real jetton wallet\", async () => {\n  \u002F\u002F Deploy actual Jetton minter and wallet\n  const jettonMinter = await blockchain.openContract(JettonMinter.create());\n  const userJettonWallet = await jettonMinter.getWalletAddress(user.address);\n\n  \u002F\u002F Set jetton wallet in contract\n  await contract.setJettonWallet(userJettonWallet);\n\n  \u002F\u002F Real transfer from Jetton wallet\n  const result = await userJettonWallet.sendTransfer(\n    user.getSender(),\n    contract.address,\n    toNano(\"100\"),\n    {}\n  );\n\n  expect(result.transactions).toHaveTransaction({\n    to: contract.address,\n    success: true,\n  });\n});\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fton\u002F`\n- **TON Documentation**: https:\u002F\u002Fdocs.ton.org\u002F\n- **FunC Documentation**: https:\u002F\u002Fdocs.ton.org\u002Fdevelop\u002Ffunc\u002Foverview\n- **TON Blueprint**: https:\u002F\u002Fgithub.com\u002Fton-org\u002Fblueprint\n- **Jetton Standard**: https:\u002F\u002Fgithub.com\u002Fton-blockchain\u002FTEPs\u002Fblob\u002Fmaster\u002Ftext\u002F0074-jettons-standard.md\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing TON contract audit:\n\n**Boolean Logic (HIGH)**:\n- [ ] All boolean values use -1 (true) and 0 (false)\n- [ ] NO positive integers (1, 2, etc.) used as booleans\n- [ ] Functions returning booleans return -1 for true\n- [ ] Boolean logic with `~`, `&`, `|` uses correct values\n- [ ] Tests verify boolean operations work correctly\n\n**Jetton Security (CRITICAL)**:\n- [ ] `transfer_notification` handler validates sender address\n- [ ] Sender checked against stored Jetton wallet address\n- [ ] Jetton wallet address stored during initialization\n- [ ] Admin function to set\u002Fupdate Jetton wallet\n- [ ] Cannot trust forward_payload without sender validation\n- [ ] Tests with fake Jetton contracts verify rejection\n\n**Gas & Forward Amounts (HIGH)**:\n- [ ] Forward TON amounts are fixed\u002Fbounded\n- [ ] OR user-provided amounts validated: `msg_value >= tx_fee + forward_amount`\n- [ ] Contract balance protected from drainage\n- [ ] Appropriate `send_raw_message` flags used\n- [ ] Tests verify cannot drain contract with excessive forward amounts\n\n**Testing**:\n- [ ] Unit tests for all three vulnerability types\n- [ ] Integration tests with real Jetton contracts\n- [ ] Gas cost analysis for all operations\n- [ ] Testnet deployment before mainnet\n",{"name":5,"description":7},"master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fsecurity\u002Fton-vulnerability-scanner",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill ton-vulnerability-scanner",{"tool":48,"command":49},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill ton-vulnerability-scanner",{"tool":51,"command":52},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill ton-vulnerability-scanner","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fton-vulnerability-scanner\u002FSKILL.md",true,[56],{"path":57,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":60,"sourceHtmlUrl":61},"resources\u002FVULNERABILITY_PATTERNS.md","REFERENCE","参考文档",18564,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fton-vulnerability-scanner\u002Fresources\u002FVULNERABILITY_PATTERNS.md",[63,88,103,118,131,144],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":82,"publishedAt":30},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[69,74,77],{"categoryNo":70,"categoryName":71,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":75,"categoryName":76,"taxonomyType":72,"taxonomyTypeDesc":73},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[83,84,26,85,86,87],"writing skills","writing","editing","work","deployment",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":96,"publishedAt":30},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[94,95],{"categoryNo":75,"categoryName":76,"taxonomyType":72,"taxonomyTypeDesc":73},{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},[97,98,84,99,100,26,101,102],"plans","writing plans","requirements","task","code","spec",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":111,"publishedAt":30},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[109,110],{"categoryNo":75,"categoryName":76,"taxonomyType":72,"taxonomyTypeDesc":73},{"categoryNo":78,"categoryName":79,"taxonomyType":80,"taxonomyTypeDesc":81},[112,113,114,115,116,117,84],"docs:write concisely","write","docs","read","Rules","documentation",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":30},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[120,125,126,127,128,129,130],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":30},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[138,139,140,141,101,142,143],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":30},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[151,139,152,86,26,153,154,155],"verification before completion","commands","evidence","claim","complete"]