TonBit

A security team under BitsLab focused on TON and recognised as a primary security assurance provider for the network, auditing Tact and FunC contracts and running penetration tests. Its method targets TON's asynchronous messaging and actor model, reviewing cross-contract messages, storage access, gas handling and permission boundaries, with severity ratings, reproduction steps and fixes published in its repository. Scope covers Jetton and NFT standard implementations, wallet contracts and bridges, with cases split along TON's message flow to reproduce state races under asynchronous calls.

The team has disclosed several TON virtual machine flaws, including a critical issue that could exhaust resources and crash validators, plus parameter abuse in light nodes and non-atomic state migration in RUNVM. It has audited more than 30 TON projects, among them Tonstakers, Torch Finance, Fiva, Catizen and PixelSwap, and runs a TON CTF that has drawn over 300 teams.