How to verify contracts in TON
@ton_fingerprintsHello World!
Representing a distributed register of operations with user accounts, blockchain has a unique combination of the useful properties of fault tolerance, the irremovability of the entered information, the practical impossibility of censoring access, and the transparency of operations. Prior to the publication of Nakamoto, distributed databases with increased guarantees of fault tolerance and authenticity of operations through the use of Public Key Infranstructure were used in the world and earlier, but they all rely on the presence of some single trust point — for example, an administrator, which has control over the system and stored data. In the blockchain, on the contrary, there is no trusted side - users trust the exclusively described protocol.
The family of protocols similar to The Open Network has received the aggregate name of blockchain protocols because of their use of the technology of linking information blocks through inserting the hash of the previous block into the next. Soon it became clear that the technology could be used not only as a means of exchanging value through the translation of tokens, coins, NFT, but also as a distributed computing platform for creating reliable fault-tolerant, non-censored services.
In 2019, took place computing platform release based on blockchain called Telegram Open Network. The platform allows users to download a program that describes the desired business process into a distributed system. The program in this context is called a smart contract, and user operations — are called transactions.
The indispensability of smart contract after being published in the blockchain allows participants in the « business process to believe » in its « honesty » - all possible actions, as well as already completed transactions are visible to anyone, therefore, there is no room for various kinds of manipulations with data or business logic. Unfortunately, the same quality also poses a threat: if the error ( random or specially introduced at the development stage ) has crept into the logic of a smart contract, it cannot be fixed after recording the contract in blockchain, and an attacker can take advantage of vulnerability at any time to benefit.
Verified source code is an important aspect of smart contracts, as it provides transparency and allows users to evaluate the integrity and security of the contract. Trust is a key factor when working with blockchains and cryptocurrencies, and the verifiable source code is an important building block to achieve this trust.
Smart contracts, as a rule, deal with financial balances and transactions, directly or indirectly. Therefore, interacting with a contract without its source code is dangerous. This is because without checking the source code, we essentially trust the application or developer to do what they claim.
For example, a smart contract can allow the owner to completely replace his code or leave the backdoor, allowing him to transfer funds.
Each protocol verification process requires verification of sources in accordance with the byte code in the blockchain. By providing verified source code, parties that interact with the contract can view it in a readable form, which increases overall transparency and security.
Despite the fact that the formal verification method of program models — is a well-known way of checking the temporal properties of response systems, this tool, as far as is known, represents the first attempt to apply this method to the verification of the functional properties of smart contracts. The results of the layout convince us that the approach is promising and deserves further detailed study.
What is TON Verifier?
TON Verifier allows smart contract developers to download the source code for these contracts along with signed evidence that it compiles into the same byte code as the specified address in TON.
To check the contract, the developer enters the contract address into Ton Verifier, downloads the source FunC files and indicates the settings of the ( file order, compiler version, etc. ) compiler. Then the application sends the source code to the server part of the compiler, which checks that the source code is compiled into the desired ( cm cell. Section 3.1.4 in the technical document TVM ), meaning that it is guaranteed to correspond to the same byte code as the address of the contract in question.
In case of coincidence, the server part will provide the application signed by BoC, intended for sending by the user as a transaction to the register of inspectors and the register of sources.
If the compilation does not complete successfully or another hash appears, the server part will refuse to sign and instead try to help the user by proposing possible measures to achieve the correct hash.
How to verify the TON contract?
For example, take AMM token contract CON, using a financial model to create liquidity pairs and allowing traders to exchange tokens from a liquidity supplier and conduct operations to receive commissions.
After assembly and the default of the contract, on the network, Bytecode and Raw data are available. Contract not verified
Tonscan offers to publish the source code of the contract if this data is not available online. We believe!
1. Open https://tonverifier.live
2. Authorize the wallet.
3. Address AMM Contract EQCzk6BQEFhwnujLYQluQVAxuyJeq5XXIFOz2h0vBQ-_hceO
4. Add FunC Files involved in the Smart Contract Compilation
5. Specify the name folders, Gains Compile
6. Hish matched. The views Ready to public
7. Publish the code, for this you need to complete a transaction. Commission 0.5 TON. Click Publish
8. Confirm the transaction in the wallet. Ready! Click View verified contract
10. Within 1-5 minutes, the contract will be verified at Tonscan
The contract code is available here: https://tonscan.org/address/EQCzk6BQEFhwnujLYQluQVAxuyJeq5XXyFOz2h0vBQ-_hceO#source
Decentralized solution
Verification of source code is not a new concept in blockchain. Etherscan provides this service for the Ethereum network, but an interesting question arises - who actually owns this data? What happens if Etherscan fails, decides to charge for this fee, or stops offering this service? Since the proven sources of Etherscan are completely centralized, the Ethereum ecosystem relies on these sources, but in no way owns them.
It is for this reason that in September 2022, Talkol suggested TEP-91, which determines how the source register will work with several verifiers. Thus, users do not need to trust the server part controlled by one side. Anyone can configure their own verifier, register it in the register of verifiers and assign him their own server.
The source files are also stored in IPFS ( and, as far as is known, will be transferred to TON Storage when it becomes available ), which means that anyone can download the contract code and create a copy. TON Verifier also provides a tool for convenient source loading for any verified contract.
Verified source code is not safe
There is an expectation that smart contract developers will publish the source code using TON Verifier. This would reduce the likelihood of malicious code being compiled in the same byte code, but contains misleading comments and variables that do not affect the resulting byte code.
For this reason, it is important to be vigilant and carefully read the code. Therefore, it is important to remember that the fact that the source code is compiled with the same cache of the code cell as the contract under consideration is checked, in contrast to the comments and names of the variables.
In the event that the source code is supposed to contain vulnerabilities, it can be marked as unreliable (now, through the group https://t.me/tonverifier) so that users can find out about potential risks.
TON Verifier Integration into the TON Ecosystem
Since the checks are performed on-chain and the source code is stored in IPFS, Orbs infrastructure is not involved in integration. Integration simply must rely on this evidence made by Orbs and therefore display the source code for any verified contract.
On-chain transactions are checked by miners and recorded in blockchain. As soon as transactions are added to the registry, the network is updated and all data is distributed between the nodes.
For this purpose, team Orbs encourages TON developers to integrate this solution into their projects and offers server part and UI SDK, including a sample of data from TON, IPFS and a ( highlighting ) code for FunC.
For help with using Verifier, join: https://t.me/tonverifier or chat holders of the TON Fingerprints collection https://t.me/dao_verify_bot or TON CON NFT https://t.me/con_nft_bot
Repository GitHub