ton-smart-contract-audit

name	ton-smart-contract-audit
schemaVersion	v0.1
description	Check TON project with smart contracts for vulnerabilities; perform an audit of TON smart contracts
used-by	["Agent"]

Perform an audit of TON smart contract project

Follow the recommendations in this skill precisely.

Instructions

Step 0: Make sure TSA is installed

To check, run the following command:

npx tsa-installer install

For that to work, tsa-installer must already be installed.

To install tsa-installer, run:

npm install tsa-installer

To interpret output of the first command, refer to references/tsa-configuration.md

Step 1: Learn how to run existing tests and add new ones

This will be needed in the next steps.

If you cannot figure this out yourself, ask the user for help BEFORE starting the audit process.

If this is a Blueprint project (most likely), tests should be run with:

yarn/npx blueprint test

Or:

yarn/npx test

Step 2: List the Vulnerabilities To Check For

Refer to references/vulnerabilities.md.

Step 3: Check If the Vulnerability Is Present Manually

Analyze the source code of smart contracts to see if a vulnerability is present.

Step 4: Validate ALL the Found Vulnerabilities

Refer to references/validation.md.

Step 5: Use TSA to find more complicated vulnerabilities

Refer to references/tsa-analysis.md.

Do not forget validating inter-contract paths, those are usually the most interesting findings!

Do not forget to write checkers for verifying custom properties, standard checkers do not cover everything.

Step 6: Again, before reporting issues, make sure the behavior is real and not intended

Refer to references/validation.md.

Step 7: Report the Result

Report the validated vulnerabilities. Use severity levels.

Standard checkers in TSA find something rarely, and if they do, the severity of the issues is very high.

Do not divide findings from manual analysis and TSA analysis, give one list.

Create a Markdown file with the report. Do not forget to include links to tests with the proofs!

Notes

Do not stop the audit process and provide an intermediate report before you checked everything.