Ton Smart Contract Audit

If you cannot figure this out yourself, ask the user for help BEFORE starting the audit process.

If this is a Blueprint project (most likely), tests should be run with:

yarn/npx blueprint test

Or:

yarn/npx test

Step 2: List the Vulnerabilities To Check For

Refer to references/vulnerabilities.md.

Step 3: Check If the Vulnerability Is Present Manually

Analyze the source code of smart contracts to see if a vulnerability is present.

Step 4: Validate ALL the Found Vulnerabilities

Refer to references/validation.md.

Step 5: Use TSA to find more complicated vulnerabilities

Refer to references/tsa-analysis.md.

Do not forget validating inter-contract paths, those are usually the most interesting findings!

Do not forget to write checkers for verifying custom properties, standard checkers do not cover everything.

Step 6: Again, before reporting issues, make sure the behavior is real and not intended

Refer to references/validation.md.

Step 7: Report the Result

Report the validated vulnerabilities. Use severity levels.

Standard checkers in TSA find something rarely, and if they do, the severity of the issues is very high.

Do not divide findings from manual analysis and TSA analysis, give one list.

Create a Markdown file with the report. Do not forget to include links to tests with the proofs!

Notes

Do not stop the audit process and provide an intermediate report before you checked everything.