Skip to content

Commit 9fbfb4c

Browse files
novusnotanovusnota
committed
docs: add new page for Security audits
1 parent 25a2154 commit 9fbfb4c

File tree

17 files changed

+79
-28
lines changed

17 files changed

+79
-28
lines changed

‎.github/workflows/external-links.yml

+9-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Link check
1+
name: External link check
22

33
on:
44
workflow_dispatch: # on demand launches, if needed
@@ -22,9 +22,15 @@ jobs:
2222
--exclude '\.(?:jpg|png)$'
2323
docs/README.md './docs/**/*.mdx'
2424
output: "/dev/stdout"
25-
fail: false
25+
fail: true
2626
failIfEmpty: false
2727

28+
linkcheck-dev:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@v4
33+
2834
- name: (dev-docs) Check broken HTTP(S) links
2935
uses: lycheeverse/lychee-action@v2
3036
id: lychee_dev
@@ -34,5 +40,5 @@ jobs:
3440
--exclude-path node_modules --exclude-path docs
3541
'./**/*.md'
3642
output: "/dev/stdout"
37-
fail: false
43+
fail: true
3844
failIfEmpty: false

‎README.md

+5
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ A next-gen smart contract language for TON focused on efficiency and simplicity.
1414
- [Tact Documentation](https://docs.tact-lang.org)
1515
- [Awesome Tact](https://github.com/tact-lang/awesome-tact)
1616

17+
## Integrity
18+
19+
- [Security audit of Tact by the Trail of Bits (2025, PDF)](https://tact-lang.org/assets/pdfs/2025-01-ton-studio-tact-compiler-securityreview.pdf)
20+
- Backup link: [PDF Report](https://github.com/tact-lang/website/blob/416073ed4056034639de257cb1e2815227f497cb/pdfs/2025-01-ton-studio-tact-compiler-securityreview.pdf)
21+
1722
## Community
1823

1924
- [Tact Discussion Group](https://t.me/tactlang)

‎dev-docs/CHANGELOG.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
8888
- Forbid traits inherit implicitly from BaseTrait: PR [#1591](https://github.com/tact-lang/tact/pull/1591)
8989
- Forbid the `override` modifier for constants without the corresponding super-constant: PR [#1591](https://github.com/tact-lang/tact/pull/1591)
9090
- Remove "remainder" from error messages: PR [#1699](https://github.com/tact-lang/tact/pull/1699)
91+
- Check map types for `deepEquals` method: PR [#1718](https://github.com/tact-lang/tact/pull/1718)
9192

9293
### Docs
9394

@@ -124,7 +125,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
124125
- Removed the notion of the non-standard TL-B syntax `remainder<X>`: PR [#1599](https://github.com/tact-lang/tact/pull/1599)
125126
- Added description of `.boc`, `.ts`, `.abi`, `.pkg` files and completed Compilation page: PR [#1676](https://github.com/tact-lang/tact/pull/1676)
126127
- Marked gas-expensive functions and expressions: PR [#1703](https://github.com/tact-lang/tact/pull/1703)
127-
- Check map types for `deepEquals` method: PR [#1718](https://github.com/tact-lang/tact/pull/1718)
128+
- Added a Security audits page, with the first assessment from the Trail of Bits: PR [#1791](https://github.com/tact-lang/tact/pull/1791)
128129

129130
### Release contributors
130131

‎docs/astro.config.mjs

+1
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,7 @@ export default defineConfig({
285285
},
286286
items: [
287287
{ slug: 'ecosystem' },
288+
{ slug: 'ecosystem/security-audits' },
288289
{
289290
label: 'Tools',
290291
translations: { 'zh-CN': '工具' },

‎docs/src/content/docs/cookbook/dexes/stonfi.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ struct SwapAdditionalData {
8585
}
8686
```
8787

88-
The [STON.fi SDK](https://github.com/ston-fi/sdk) defines some [constants to deal with fees](https://github.com/ston-fi/sdk/blob/786ece758794bd5c575db8b38f5e5de19f43f0d1/packages/sdk/src/contracts/dex/v2_1/router/BaseRouterV2_1.ts). Note that these are hardcoded values, but the best practice is to [calculate fees dynamically using current config params](https://docs.ton.org/v3/guidelines/smart-contracts/fee-calculation) instead.
88+
The [STON.fi SDK](https://github.com/ston-fi/sdk) defines some [constants to deal with fees](https://github.com/ston-fi/sdk/blob/1c8c6678858956f6d9a0e70b9f80628319dbe2ce/packages/sdk/src/contracts/dex/v2_1/router/BaseRouterV2_1.ts). Note that these are hardcoded values, but the best practice is to [calculate fees dynamically using current config params](https://docs.ton.org/v3/guidelines/smart-contracts/fee-calculation) instead.
8989

9090
```tact
9191
/// Hardcoded fee value to pay for sending a message to the Jetton wallet

‎docs/src/content/docs/ecosystem/index.mdx

+12-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,18 @@ Here are its main contents:
1111

1212
<Steps>
1313

14-
1. #### Tools
14+
1. #### Security audits
15+
16+
In addition to optimizing gas usage and reducing fees, the security of the Tact ecosystem is of utmost priority. Which is why there's a dedicated page for miscellaneous security audits, assessments and reports for the Tact compiler and Tact smart contracts.
17+
18+
<CardGrid>
19+
<LinkCard
20+
title="Go to Security audits"
21+
href="/ecosystem/security-audits"
22+
/>
23+
</CardGrid>
24+
25+
2. #### Tools
1526

1627
Tools is a list of official and community-made tools made specifically for Tact, or whose that play along with the language and other tools. Each tool has a brief usage details and additional information, which sometimes is missing from the respective docs or is a convenient summary available only in the Tact documentation.
1728

‎docs/src/content/docs/ecosystem/security-audits.mdx

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
title: Security audits
3+
description: "Various security assessments, audits and reports for Tact compiler, Tact smart contracts and other things in Tact ecosystem"
4+
---
5+
6+
In addition to optimizing gas usage and reducing fees, the security of the Tact ecosystem is paramount. This includes the safety of the Tact compiler, other Tact-related tools and smart contracts written in Tact.
7+
8+
This page lists various security assessments, audits, and reports for the Tact compiler, Tact smart contracts and other things in the Tact ecosystem.
9+
10+
## Tact compiler {#compiler}
11+
12+
### 2025-01: Security Assessment by Trail of Bits {#202501-trailofbits-tact}
13+
14+
The security audit for Tact 1.5.0 has been completed by [Trail of Bits](https://www.trailofbits.com/), a leading Web3 security firm.
15+
16+
By the end, no high-severity vulnerabilities were found. That said, some bugs and points of improvement were discovered and addressed in a new [Tact 1.5.4 bugfix release][1.5.4].
17+
18+
The complete report is available on the Trail of Bits GitHub repository, as well as on the Tact website and its repo as a backup:
19+
20+
* [Original PDF, Trail of Bits repo](https://github.com/trailofbits/publications/blob/master/reviews/2025-01-ton-studio-tact-compiler-securityreview.pdf)
21+
* [Same PDF, Tact website](https://tact-lang.org/assets/pdfs/2025-01-ton-studio-tact-compiler-securityreview.pdf)
22+
* [Same PDF, a backup in the website repo](https://github.com/tact-lang/website/blob/416073ed4056034639de257cb1e2815227f497cb/pdfs/2025-01-ton-studio-tact-compiler-securityreview.pdf)
23+
24+
Upgrade to the newest Tact version: [Compiler upgrades](https://docs.tact-lang.org/book/compile/#upgrades).
25+
26+
[1.5.0]: https://www.npmjs.com/package/@tact-lang/compiler/v/1.5.0
27+
[1.5.4]: https://www.npmjs.com/package/@tact-lang/compiler/v/1.5.4

‎docs/src/content/docs/ecosystem/typescript.mdx

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
title: TypeScript libraries
33
description: "The compiler of Tact automatically generates wrapper code for use with @ton/ton and @ton/core libraries"
44
prev:
5-
link: /ecosystem
6-
label: Ecosystem overview
5+
link: /ecosystem/security-audits
6+
label: Security audits
77
---
88

99
The Tact language has built-in support for the [@ton/ton](https://github.com/ton-org/ton) and [@ton/core](https://github.com/ton-org/ton-core) TypeScript libraries. The compiler automatically generates code for these libraries, so you can use [@tact-lang/emulator](https://github.com/tact-lang/tact-emulator) or [@ton/sandbox](https://github.com/ton-org/sandbox), that work on top of them.

‎docs/src/content/docs/ref/core-debug.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ The algorithm for generating the exit code works as follows:
2121

2222
* First, the [SHA-256](https://en.wikipedia.org/wiki/SHA-2#Hash_standard) hash of `error` message [`String{:tact}`][p] is obtained.
2323
* Then, its value is read as a 32-bit [big-endian](https://en.wikipedia.org/wiki/Endianness) number modulo $63000$ plus $1000$, in that order.
24-
* Finally, it's put into the `.md` compilation report file, which resides with the other compilation artifacts in your project's `outputs/` or `build/` directories.
24+
* Finally, it's put into the [`.md` compilation report file](/book/compile#report), which resides with the other compilation artifacts in your project's `outputs/` or `build/` directories.
2525

2626
The generated exit code is guaranteed to be outside the common $0 - 255$ range reserved for TVM and Tact contract errors, which makes it possible to distinguish exit codes from `require(){:tact}` and any other [standard exit codes](/book/exit-codes).
2727

‎docs/src/content/docs/zh-cn/book/exit-codes.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -451,7 +451,7 @@ nativeSendMessage(emptyCell(), 0); // won't fail in compute phase,
451451

452452
### 35: Invalid source address in outbound message {#35}
453453

454-
如果出站消息中的源地址不等于[`addr_none`](https://docs.ton)。 rg/develop/data forms/msg-tlb#addr_none00，或是引发此消息的合约地址， 退出码 $35$ 出错：\`出站消息中无效的源地址'。
454+
如果出站消息中的源地址不等于[`addr_none`](https://docs.ton.org/develop/data-formats/msg-tlb#addr_none00)，或是引发此消息的合约地址， 退出码 $35$ 出错：\`出站消息中无效的源地址'。
455455

456456
### 36: Invalid destination address in outbound message {#36}
457457

‎docs/src/content/docs/zh-cn/book/security-best-practices.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ throw(1);
101101
2. 一旦收到所有哈希，参与者就公布其原始数字。
102102
3. 结合公开的数字（例如，将它们相加）以生成一个安全的随机值。
103103

104-
有关更多详细信息，请参阅 [TON 文档中的安全随机数生成页面](https://docs.ton.org/guidelines/smart-contracts/security/random-number-generation)。
104+
有关更多详细信息，请参阅 [TON 文档中的安全随机数生成页面](https://docs.ton.org/v3/guidelines/smart-contracts/security/random-number-generation)。
105105

106106
##### Don'ts ❌
107107

‎docs/src/content/docs/zh-cn/cookbook/dexes/dedust.mdx

+4-4
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ sidebar:
1212
- [接收消息](/zh-cn/book/receive/)
1313
- [发送消息](/zh-cn/book/send/)
1414
- [可替代代币（Jettons）](/zh-cn/cookbook/jettons/)
15-
- [DeDust Docs: Concepts](https://docs.edust.io/docs/concepts)
15+
- [DeDust Docs: Concepts](https://docs.dedust.io/docs/concepts)
1616

1717
## Swaps
1818

19-
阅读更多关于 [DeDust 文档](https://docs.edust.io/docs/swaps)中的swaps。
19+
阅读更多关于 [DeDust 文档](https://docs.dedust.io/docs/swaps)中的swaps。
2020

2121
:::caution
2222

@@ -73,7 +73,7 @@ struct SwapParams {
7373
### 将 Toncoin 兑换为任意 Jetton
7474

7575
:::note
76-
以下指南使用了 [Jetton Vault](https://docs.dedust.io/docs/concepts#vault)。 要获取您的Jetton地址，请参阅[本指南](https://docs.edust.io/docs/swaps#step-1-find-the-vault-scale)。
76+
以下指南使用了 [Jetton Vault](https://docs.dedust.io/docs/concepts#vault)。 要获取您的Jetton地址，请参阅[本指南](https://docs.dedust.io/docs/swaps#step-1-find-the-vault-scale)。
7777
:::
7878

7979
```tact
@@ -220,7 +220,7 @@ message(0xf8a7ea5) JettonTransfer {
220220

221221
为了向特定的DeDust池提供流动资金，您必须提供这两种资产。 然后，池将向存款人地址颁发特别 _LP tokens_。
222222

223-
阅读更多关于[DeDust文档](https://docs.edust.io/docs/life-production)中的流动资金配置。
223+
阅读更多关于[DeDust文档](https://docs.dedust.io/docs/life-production)中的流动资金配置。
224224

225225
```tact
226226
import "@stdlib/deploy";

‎docs/src/content/docs/zh-cn/cookbook/nfts.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ contract Example {
142142

143143
## 获取 NFT 静态信息
144144

145-
请注意，TON Blockchain 不允许合约相互调用 [getters](https://docs.tt-lang.org/book/contracts#getter-functions)。
145+
请注意，TON Blockchain 不允许合约相互调用 [getters](https://docs.tact-lang.org/book/contracts#getter-functions)。
146146
要从另一个合约接收数据，您必须交换消息。
147147

148148
```tact

‎docs/src/content/docs/zh-cn/ecosystem/misti.mdx

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,14 @@ description: 静态分析测验合约、自定义探测器和CI/CD 集成
77

88
## 什么是Misti？
99

10-
- **静态程序分析**：Misti 在不执行代码的情况下对代码进行分析，通过检查结构和语法来扫描[漏洞和安全缺陷](https://nowarp.github.io/tools/misti/docs/detectors)。 这种方法可以及早发现问题，防止问题影响生产。
10+
- **静态程序分析**：Misti 在不执行代码的情况下对代码进行分析，通过检查结构和语法来扫描[漏洞和安全缺陷](https://nowarp.io/tools/misti/docs/detectors)。 这种方法可以及早发现问题，防止问题影响生产。
1111

12-
- **自定义探测器**：创建 [自定义探测器](https://nowarp.github.io/tools/misti/docs/hacking/custom-detector)，根据您的特定需求定制 Misti。 这有助于识别通用工具可能会遗漏的漏洞，确保对代码进行彻底审查。
12+
- **自定义探测器**：创建 [自定义探测器](https://nowarp.io/tools/misti/docs/hacking/custom-detector)，根据您的特定需求定制 Misti。 这有助于识别通用工具可能会遗漏的漏洞，确保对代码进行彻底审查。
1313

14-
- **CI/CD 集成**：[集成](https://nowarp.github.io/tools/misti/docs/tutorial/ci-cd) Misti 到您的 CI/CD 管道中，以确保持续的代码质量检查，在问题进入生产之前将其捕获。
14+
- **CI/CD 集成**：[集成](https://nowarp.io/tools/misti/docs/tutorial/ci-cd) Misti 到您的 CI/CD 管道中，以确保持续的代码质量检查，在问题进入生产之前将其捕获。
1515

1616
## 资源
1717

1818
- [Github](https://github.com/nowarp/misti)
1919
- [Telegram Community](https://t.me/misti_dev)
20-
- [Misti文档](https://nowarp.github.io/docs/misti/)
20+
- [Misti文档](https://nowarp.io/tools/misti/)

‎docs/src/content/docs/zh-cn/ref/core-advanced.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -586,7 +586,7 @@ parsedVarAddr.address.loadUint(123); // 345
586586
[cell-hash]: /zh-cn/ref/core-cell#cellhash
587587
[nanotoncoin]: /zh-cn/book/integers#nanotoncoin
588588
[tvm]: https://docs.ton.org/learn/tvm-instructions/tvm-overview
589-
[basechain]: https://docs.ton.org/v3/concepts/ton-blockchain/smart-contract-addresses#address-components
589+
[basechain]: https://docs.ton.org/v3/documentation/smart-contracts/addresses#workchain-id
590590
[deduplication]: https://docs.ton.org/v3/documentation/data-formats/tlb/library-cells
591591
[storage-fee]: https://docs.ton.org/v3/documentation/smart-contracts/transaction-fees/fees-low-level#storage-fee
592592
[storage-fee-calc]: https://docs.ton.org/v3/guidelines/smart-contracts/fee-calculation#storage-fee

‎docs/src/content/docs/zh-cn/ref/core-common.mdx

+6-6
Original file line numberDiff line numberDiff line change
@@ -93,12 +93,12 @@ fun context(): Context;
9393

9494
返回 `Context{:tact}` [Struct](/zh-cn/book/structs-and-messages#structs)，包含：
9595

96-
| 字段 | 类型 | 描述 |
97-
| :-------- | :------------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
98-
| `bounced` | [`Bool{:tact}`][bool] | 传入消息的[Bounced](https://ton.org/docs/learn/overviews/addses#bounceable-vs-non-ounceable-addresses) 标志. |
99-
| `sender` | [`Address{:tact}`][p] | 发送方在 TON 区块链上的内部地址。 |
100-
| `value` | [`Int{:tact}`][int] | 信息中 [nanoToncoins](/zh-cn/book/integers#nanotoncoin) 的数量。 |
101-
| `raw` | [`Slice{:tact}`][slice] | 信息的其余部分作为 [`Slice{:tact}`][slice]。 它遵循 TON 的 [内部消息布局](https://docs.ton.org/develop/smart-contracts/messages#message-layout)，从目标 [`Address{:tact}`][p] (`dest:MsgAddressInt` 在 [TL-B 记法](https://docs.ton.org/develop/data-formats/tl-b-language)) 开始。 |
96+
| 字段 | 类型 | 描述
97+
| :-------- | :------------------------ | :---
98+
| `bounced` | [`Bool{:tact}`][bool] | 传入消息的[Bounced](https://ton.org/docs/learn/overviews/addresses#bounceable-vs-non-bounceable-addresses) 标志.
99+
| `sender` | [`Address{:tact}`][p] | 发送方在 TON 区块链上的内部地址。
100+
| `value` | [`Int{:tact}`][int] | 信息中 [nanoToncoins](/zh-cn/book/integers#nanotoncoin) 的数量。
101+
| `raw` | [`Slice{:tact}`][slice] | 信息的其余部分作为 [`Slice{:tact}`][slice]。 它遵循 TON 的 [内部消息布局](https://docs.ton.org/develop/smart-contracts/messages#message-layout)，从目标 [`Address{:tact}`][p] (`dest:MsgAddressInt` 在 [TL-B 记法](https://docs.ton.org/develop/data-formats/tl-b-language)) 开始。
102102

103103
示例用法：
104104

‎docs/src/content/docs/zh-cn/ref/evolution/overview.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -48,4 +48,4 @@ TON 增强提案的主要目标是提供一种便捷且正式的方式来提议
4848

4949
## 更新日志
5050

51-
主 Tact 代码库的所有显著变更都记录在 [CHANGELOG.md](https://github.com/tact-lang/tact/blob/main/CHANGELOG.md) 中。
51+
主 Tact 代码库的所有显著变更都记录在 [CHANGELOG.md](https://github.com/tact-lang/tact/blob/main/dev-docs/CHANGELOG.md) 中。

0 commit comments

Comments
 (0)