For developers

Security and operability

The contracts have undergone 31 rounds of agentic testing, plus symbolic execution with the TON Dev endorsed audit suite. An independent third-party audit is still pending.

The contracts have undergone 31 rounds of agentic testing — OpenClaw orchestration and skills utilizing the latest Claude and ChatGPT models — to ensure maximum operability, integration feasibility and security. The contracts have also undergone the TON Dev endorsed audit suite.

Even though the contracts have undergone a plethora of extensive testing from premier AI tools, an independent audit is still pending. It is commissioned before mainnet, not after — nothing on this page substitutes for it; it narrows the surface an external auditor has to cover. The report, the firm and the remediation log are published here when it completes.

31rounds of agentic testing

2,000+tests, 180+ suites

0drain paths found

Pendingindependent third-party audit

Every finding was reproduced against the compiled contracts in a sandbox, not inferred from reading source. The fix for each one ships with a test that fails on the unpatched build and passes on the patched one — that before-and-after is the evidence, not the prose.

The test suites

Suite	What it covers
`SecurityAudit RedTeam Hardening`	Adversarial paths, signature expiry, guard bypasses
`CommitReveal`	Front-run resistance, commitment binding and single use
`AuctionDeep SinglesAuction EscrowSafety`	Bidding, anti-snipe, settlement, escrow invariants
`AsyncRaces`	Out-of-order and replayed messages, stale-sync defence
`ResolverSync DnsResolution DnsProbe`	TEP-81 resolution, wipe-on-transfer, root-agnostic answers
`Normalization Confusables SkinTonePolicy`	Namespace rules, in TVM and off-chain
`V7Namespace`	Exhaustive sweeps over the whole accepted emoji set
`V7TierBinding`	Emoji segmentation, TVM against the reference implementation
`V7Attestation`	Cross-deployment replay, policy binding
`V7SignerRotation`	Staged rotation, proof of possession, getter honesty
`V7Metadata`	End-to-end NFT metadata URI, through the real registrar
`V7AntiSpoof`	Impersonation detection and the send-time gate
`LapsedLifecycle Migration BusinessFlows`	Expiry, grace, imports, revenue paths

Several are exhaustive rather than sampled. The emoji segmenter is proven against the entire accepted namespace — 3,520 accepted units and 14,080 generated multi-unit names, zero disagreement. The byte-budget rule is proven for every accepted emoji rather than a hand-picked four. Later rounds pin the pricing tables, the auction floor and the renewal constants against literals, so a change to either a contract or its wrapper goes red in CI.

Symbolic execution — the TON Dev endorsed audit suite

The contracts were analysed with the TON Symbolic Analyzer (TSA), the engine behind the TON audit skill endorsed by the ecosystem's core developers. TSA works on compiled BoC, so it applies here even though the sources are Tolk rather than FunC.

The headline result is drain-check — "can anyone withdraw TONs" — which is the check that matters for this protocol, because the registrar custodies auction bids.

Run	States dropped	Result
Production bytecode	3	0 findings
Audit build (over-approximated)	0	0 findings
Positive control	0	1 finding

The control line is the whole point A zero from a harness that cannot produce a one is worth nothing. So the same run was repeated with the predicate loosened from "did more value come back than went in" to "did any value come back", and it fired immediately. That makes the strict zero a real negative: with 500 GRAM of live escrow in storage and a 961 GRAM balance, no message sequence returns more value to its sender than the sender supplied.

What the tooling could not reach, and what we did about it

TSA v0.5.3 does not implement the TVM SHA256U instruction. The registrar proves the raw name bytes against the name hash at the top of all four issuance handlers, which compiles to exactly that instruction — so the analyser abandoned every issuance path before reaching the pricing, referral, escrow and mint logic behind it.

We found this by census rather than by assumption: across 189 results on a live registrar, every exit code whose only throw sites are downstream of that line was absent, while codes reachable elsewhere were present. That is the signature of a hard truncation, not a sampling gap.

Two fixes:

An audit-only build with the hash binding removed. Removing it gives an attacker strictly more power — any bytes for any name hash — so "no drain here" implies "no drain in the shipped contract". It is compiled from a temporary copy and never deployed.
Realistic storage. The analyser was previously fed the pristine deploy state — empty registry, no auctions, no resolvers — where most branches are unreachable by construction. It now runs against a state driven through the real contract in a sandbox: registrations, an NFT collection, a resolver, and a live singles lot holding 500 GRAM of custodied escrow.

Both caveats are written into the runner scripts so a future run cannot repeat the mistake.

Findings worth reading in full

TSA independently found something prior rounds of agent review had missed: a message body consisting only of references — no data bits — passed an isEmpty() guard that tests for both no bits and no refs, then underflowed in the opcode decoder. Small, and exactly the kind of thing a human reviewer's eye slides over and a symbolic engine does not.

The most consequential finding came from the other direction. emojiCount — the field that decides the price, the renewal annuity, the singles lock and the permanent-upgrade right — had no on-chain relation to the name at all. A signer induced to attest "2 emoji" for a one-emoji name handed over the entire singles class at the tier-2 shelf price, and the lock never fired. It is now segmented in TVM and checked for exact equality.

A later round found that nothing pinned the auction reserve at all: the boundary tests derived the floor from the wrapper, so they proved only that the contract agreed with the wrapper. The reserve, the first-year table, the renewal table and the permanence default are now pinned against literals — the failure mode of a quietly edited price is closed at the CI gate.

Honest limits

The full register lists every open item with a severity and a rationale. The headline ones:

Attestation validity has no on-chain upper bound. The signer must issue short-lived signatures; the contract does not currently force it.
Only the registrar has been symbolically analysed with realistic storage. The other contracts ran unconstrained, which by our own rule is a smoke test rather than an audit.
Live monitoring is an operations task, not a contract property. stateBudget(), freeBalance() and traction() are implemented and readable by anyone; the dashboards and alarms that watch them are launch-operations work.
A paid third-party audit before mainnet, not after. Nothing on this page substitutes for it — it narrows the surface an external auditor has to cover.

Third-party audit report The independent audit is commissioned before mainnet. The report, the firm and the remediation log are published here when it completes.

Reproducing any of it

The full findings register, the benchmark against the TON Foundation, SlowMist and CertiK audit taxonomies, and the anti-phishing metric derivations all ship in the repository alongside the runner scripts. Every number on this page has a script that regenerates it.