ton-blockchain/bug-bounty

TON security bug bounty description

bug-bounty's Issues

Problem adding funds to wallet

There is a problem when you try to ads funds to wallet using credit or debit cards.

If you try to use a Germany bank card to add funds, there appear a message saying " spanish cards are not accepted"

But the card is from Germany...

In funC, 1 != 1

Background

We have submitted the issue to ton monorepo issue and ton research as well.

Introduction

While writing and testing the Merkle Distributor airdrop contract, @ipromise2324 and I discovered a vulnerability in the funC smart contract. This vulnerability is related to left-shift operations and boolean comparisons. In theory, assume variable k=0 when we compute x = (1 << k) and then compare x == 1, we expect the result to be true (-1). However, we received false (0), which deviates from the expected outcome.

Impact

Bitwise operations are commonly used in smart contracts to reduce gas fees and are often employed in validity checks. For instance, in an airdrop contract, a user should not be able to claim the airdrop more than once, so we mark the user as true to indicate they have already claimed. If developers are unaware of this vulnerability, malicious users could potentially claim the airdrop repeatedly until the rewards are depleted. Similarly, if this error is present in access control mechanisms, it could enable hackers to execute contract logic under different identities, leading to significant financial losses.

Problem

When we call the is_claimed function with the index parameter set to 0, the claim_bit_index is calculated as 0 % 256, which results in claim_bit_index = 0. Consequently, int mask = 1 << 0, meaning mask = 1.

As we start using the mask variable for some comparisons, we notice an interesting situation. The mask currently equals 1, but when we compare it with mask == 1, the result dumped is 0, which is not what we expected. It should be -1, because mask = 1 and 1 == 1. Then, when we compare mask != 1, the dumped result turns out to be -1, which is also contrary to common logic.

Temporary Solution

We found that appending a division by 1 after the left-shift operation resolves the issue and yields the expected result.

Enviroments

We are using @ton/blueprint": "^0.21.0

Hardware & OS

MacOS (Macbook M2 air) built-in SSD.
MacOS (Macbook M1 pro) built-in SSD.

The wallet was stolen ton

Hello, the problem is as follows : my phone number is [phone], my nickname is Ambassadors_Telegram , has been blocked by your service!!!! This phone number has been mine for over 5 years! It's registered to me! I am the owner of this asset!  Telegram messenger stored a huge number of photos, videos, PDF files, documents, presentations, my groups and channels with a huge amount of content and information, and also had my wallet and TON wallet with a positive balance! How can I store a TON in telegram if you blocked and stole my money, I want to note that I do not understand on what basis my phone numbers were blocked. I estimate the cost of the damage at $ 1,000,000,000 based on the value and importance of everything that was stored there . I have repeatedly tried to write letters to you through all available communication channels that you provide on the official website ton.org/ru and through the telegram channel, today the time is 3 months as I try to contact the support service, to understand the reason for blocking my account, both the Russian and Dubai numbers [phone]. Nickname is your privacy .  where all my correspondence with the whole world was stored and how I can restore all my existing files.  I have repeatedly written that I have a clear and reasonable plan on How to make an increase of 1 billion users in less than 2 years of Telegram, I asked that this letter be considered and handed over to Pavel Durov, to which I received no response, today I clearly state that if throughout the entire time and for all no one will hear me through possible communication channels and no one will answer me, I will be forced to go to the magistrate's court, I will be forced to involve the media, I will be forced to tell the whole world that Telegram can disconnect you from your account at any time, steal all your data that is of great value and value, and all the money which you store on your telegram wallet will be stolen without refund, that it is dangerous to use this service , such an attitude towards users is unacceptable! what has happened now requires a lot of publicity, it is tedious to make this situation as public as possible!!! Consider this theft , This is a crime against me and telegram users !!!! I estimate this damage at $1,000,000,000 .

Access

Problem at ads campaings

Easy access and privacy violation

Admins can access user wallet and make transfers out,many errors with this

Bug in the premium ads user panel

Whem you create a ad and you want to access to the ads panel from a smartphone there is a bug if you try to push the options button

See photo , after push the campaing options button the options list do not appear (only froms smartphones)

decimals hide

When you mint token with 2 decimals it will be 1.00, if you later decided to get more digits, then tokens q may looks like:
decimals 3: 0.101
decimals 5: 0.00101
It will change past transactions, change number of digits in portfolio in other side 10.00, 1000.00, etc.!
image
image
and pools stay same

I think this bug may be used to hide past over transactions or delete them at all from visible code

There is a wrong headline(CN)

website: https://ton.org/zh/gamefi

Moral problem at premium ads

TON Testnet became mainnet

Exploring fragment.com. I decided to check out addresses that were placing huge bets on usernames. Looking at the history of transactions, I saw that all these incredible sums of money were received during the testnet. It turns out that the addresses that received funds in the testnet can now use them in the mainnet, I think this is ridiculous. How could Telegram make such a mistake? Telegram should reset these wallets. It can ruin TON market.

https://tonapi.io/account/Ef_p-2q8gqO0fORaf60CAvW0gFo9EM0Fq7tD94G-6U8V5Hf_
https://tonapi.io/transaction/afedab3bd94ae9d553719fde6239b687eb0c8cc0c4e0d7dc890f0afb9c0ae982
https://tonapi.io/account/Ef8zMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzMzM0vF
hash afedab3bd94ae9d553719fde6239b687eb0c8cc0c4e0d7dc890f0afb9c0ae982
https://imgur.com/a/gY1O9Rl
https://explorer.toncoin.org/transaction?account=-1:67358ebd4b7fe178105252da474612338e3a98d0286e81ea9b59c406b468fe81&lt=8272373000001&hash=afedab3bd94ae9d553719fde6239b687eb0c8cc0c4e0d7dc890f0afb9c0ae982

https://tonapi.io/account/Ef8acpBAmfTonu2kfXjx7qP7cEPqbLPm5W8niVXaQOjV0yBJ
https://tonapi.io/account/Ef95yO_AT7oi4M2Py55spUTC9_g161nl7FerluhWZfkNv3bM
https://tonapi.io/account/Ef-zqJWZh3JddLCyNQHuAmsNL1Ra9DmAusPHDJxGolDSfFwE
https://tonapi.io/account/Ef-exuKIGuFDFVB0ldQzCJxVV6U-YT4B3nrg1VE8Mj1yOEp0

-NaN TON (stacking from tonkeeper)

0. Address for test: EQADXaOqEmIzxvJBN9oQeaNYEA9Q5EBIYxQUYF7uM6InWJCr
1. Copy the address of the nominator from the website via Android from page
   https://tonwhales.com/staking/pool/EQCY4M6TZYnOMnGBQlqi_nyeaIB1LeBFfGgP4uXQ1VWhales
2. Send TON for staking (the case when the transaction will be processed longer)
3. -NaN TON + automatically changed transaction history in tonkeeper

Android 12
Samsung A71
Tonkeeper 2.6.1
Google Chrome Mobile

Safety of TON Wallet

I think the wallet not enough safety. Password is not enough should be have google authenticator and verification from email when withdraw.

Issue at the P2P market

If you try to add funds to wallet using the P2P market snd you select bank Transfer or sepa instant there must be a extra field with the seller name because the buyers need this information to make the bank Transfer.

From the point of view of a buyer if you select bank Transfer or sepa instant and you create a order and the seller approve the order, after that you get the bank account details of the seller , but you not get the bank account benefitiary name to attach at the bank Transfer and It is needed , you only get the bank account , and you need to get the bank benefitiary name to use when you make the bank Transfer to seller (there must be a extra field to buyers with this information)

Yy

G