Web3 · Smart Contract Audit
TON
softstack completed a smart contract audit of TON's Foundation Multisignature Wallet in February 2023, reporting 1 finding (1 informational). The full report is published in the softstack public audit archive.
Key facts
- Client
- TON
- Completed
- Type
- Smart Contract Audit
- Chains
- TON
- Commit
ae453b676fe4- Market cap
- $4.2B as of 2026-10-27
About the project
TON, or The Open Network, is a decentralised layer-1 blockchain originally developed by Telegram and now maintained by an open-source community. It uses proof-of-stake consensus, dynamic sharding and a custom virtual machine to run smart contracts and decentralised applications. The network is integrated with Telegram through mini apps, wallets, tokenised usernames and collectibles.
Scope
Source repositorygithub.com/ton-blockchain/multisig-contractComponents reviewed
1 module- See the published report for the file list
Findings
0 of 1 findings resolved before the final report.
| ID | Title | Severity | Status |
|---|---|---|---|
6.2.1 | Missing Development Environment The auditors have not recognised an developer friendly environment, including separation of contracts and wrapper or the existence of unit tests. | Informational | acknowledged |
Methodology
Review process
Scoping and threat modelling
The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.
Automated analysis
Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.
Manual code review
Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.
Adversarial testing
Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.
Reporting
Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.
Remediation verification
Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.
FAQ
The review reported 1 finding: 1 informational. 0 of 1 were resolved or mitigated before the final report.
The review covered the code in github.com/ton-blockchain/multisig-contract at commit ae453b6. The published report lists every file covered.
This report covers the code as reviewed in February 2023 at commit ae453b6. Any code changed after that point is outside the reviewed scope.
Disclaimer
This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.