一句话：总结 TON 智能合约八类缺陷，提出静态分析框架 TONScanner，检出 14,995 个缺陷，准确率 97.49%。
TON 为支持 Telegram 海量用户而设计，其主流智能合约语言 FunC 语法独特，但针对 TON 合约实际缺陷的研究仍处早期。本文从 TON 官方博客与审计报告中总结八类智能合约缺陷，给出详细定义与代码示例；并提出静态分析框架 TONScanner，复用 FunC 编译器前端将源码转为 DAG 形式的中间表示，进而构建控制流图并转为 SSA，同时集成数据依赖、调用图、污点分析和 Cell 构造等为 TON 数据结构定制的分析组件以识别八类缺陷。作者在 1,640 个合约上评估，共检出 14,995 个缺陷；随机抽样人工标注显示整体准确率达 97.49%，表明 TON 合约普遍存在缺陷且该工具有效。
The Open Network (TON), designed to support Telegram's extensive user base of hundreds of millions, has garnered considerable attention since its launch in 2022. FunC is the most popular programming language for writing smart contracts on TON. It is distinguished by a unique syntax compared to other smart contract languages. Despite growing interest, research on the practical defects of TON smart contracts is still in its early stages. In this paper, we summarize eight smart contract defects identified from TON's official blogs and audit reports, each with detailed definitions and code examples. Furthermore, we propose a static analysis framework called TONScanner to facilitate the detection of these defects. Specifically, TONScanner reuses FunC compiler's frontend code to transform the FunC source code into FunC intermediate representation (IR) in the form of a directed acyclic graph (DAG). Based on this IR, TONScanner constructs a control flow graph (CFG), then transforms it into a static single assignment (SSA) form to simplify further analysis. TONScanner also integrates Data Dependency, Call Graph, Taint Analysis, and Cell Construct, which are specifically tailored for TON blockchain's unique data structures. These components finally facilitate the identification of the eight defects. We evaluate the effectiveness of TONScanner by applying it to 1,640 smart contracts and find a total of 14,995 defects. Through random sampling and manual labeling, we find that TONScanner achieves an overall precision of 97.49%. The results reveal that current TON contracts contain numerous defects, indicating that developers are prone to making errors. TONScanner has proven its ability to accurately identify these defects, thereby aiding in their correction.
DOI 原文 ·
@inproceedings{paperbot8846,
title = {Enhancing the Open Network: Definition and Automated Detection of Smart Contract Defects},
author = {Hao Song and Teng Li and Jiachi Chen and Ting Chen and Beibei Li and Zhangyan Lin and Yi Lu and Pan Li and Xihan Zhou},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00119}
}