Security Audit: Proof of Capital

We've completed our security assessment of the Proof of Capital protocol - a market-making smart contract that protects interests of all holders.

Full report: [link]

Misti static analyzer is officially live on Web IDE (ide.ton.org)

🎉 Misti 0.7 has just landed on NPM!

🔍 More Tact Detectors: StateMutationInGetter, UnprotectedCall and SuspiciousLoop.

⚡ Tact 1.6.1 support: Including new language syntax and features.

⚙️ Improved Tools: Added more Callgraph functionality to enhance contracts audits.

🔧 Fixes & Enhancements: Check out the full changelog.

TON Security Risks: A Static Analysis Perspective

A new blog post dives into security risks in TON, with a focus on automated security tools. It argues for using static program analysis in audits and shows examples of bugs that tools like Misti can catch.

Misti 0.8.1 has just been released.

🔧 This patch release introduces Tact 1.6.6 support and includes minor changes and fixes. Check out the full changelog.

🔧 Announcing: OCaml library for FunC parsing: nowarp/ocaml-func

For developers working with FunC, this library provides AST and parser functionality.

We live on the TON Talent Directory 🚀

🚀 Introducing Scanner: Mass Static Analysis for TON Smart Contracts

We've released a demo showcasing our static analysis tooling for TON contracts.

🔍 Features:
- ~20 curated contracts with zero vulnerabilities
- Detailed analysis results
- Great for learning Tact development best practices and exploring the tooling capabilities

🛡️ We scan everything for research but only display clean contracts without vulnerabilities publicly.

📊 Check it out: https://nowarp.io/tools/scanner/

100+ compiler bugs found across 5 smart-contract compilers — Sui Move, Cairo, Solang, Solidity, and Leo — in a fresh blog post on compiler fuzzing. Only bugs in later compilation passes are reported; no malformed-input crashes.

The post shares experience, heuristics, and an overview of approaches for setting up a low-effort fuzzing workflow to test compiler implementations. Part 1 focuses only on ICE.

What the post covers:
• Designing and configuring the fuzzing harness for grammar-aware fuzzing
• A new tree-sitter-based grammar-aware mutator that works with any tree-sitter grammar
• Adopting MetaMut-style mutations: 700–1000 language-specific mutation operations per target, from a few prompts
• Corpus collection, generation, and minimization
• Dictionary construction
• LLM-assisted triage — deduplication, minimization, reporting

Three open-source utilities published, plus the complete Sui Move fuzzing harness with 884 custom mutators.

https://nowarp.io/blog/compiler-testing-part-1

A 20-year-old JDK bug, reincarnated in Tolk

I was experimenting with approaches and techniques to find miscompilation errors. Not crashes – those are the easy ones. This time — the Ethereum ecosystem. Every codebase there has been audited to death; bug-hunting is desperate, and each find I made was complicated.

So I tried a similar approach on TON, with the latest Tolk compiler. Just for fun. It took about 30 minutes to vibecode a ~500-line script based on hands-on experience. A deterministic and boring script. Only SMT and Python. No LLM in the loop.

Results are interesting. Two hours running. A few ICEs. A couple of real arithmetic miscompiles users can hit. But the best find — the ghost of a 20-year-old JDK bug, alive in the Tolk codebase.

Just look at this example:

const RANGE_LO: int = 1000000000000000;
const RANGE_HI: int = 3000000000000000;
const MID: int = (RANGE_LO + RANGE_HI) >> 1;

// Intended identity:  MID > (MID - a)  iff  a > 0
fun isPositive(a: int): bool {
    return MID > (MID - a);
}

Math says isPositive(-1) == false. Tolk says true. The optimizer cancels MID from the rhs subtraction but forgets the lhs, so the test silently becomes MID > -a:

isPositive() PROC:<{        // a
    MID PUSHINT
    SWAP
    NEGATE                  // -a
    GREATER                 // MID > -a   (NOT  MID > MID - a)
    ...
}>

FunC compiles the same source correctly with SUB in place: check it here.

(low + high) >> 1 is exactly the midpoint idiom — Bloch's canonical "safe" replacement for JDK-6412541. Twenty years later, the same pattern lives on in a smart-contract compiler.

Maybe that's an easter egg as a tribute to a famous bug. But I would prefer boring and well-audited tech with security guarantees over marketing. The compiler isn't bad, just young. Pick the stack that keeps "dudes with Python scripts" out of your threat model.