TasmScan: Continuation-Aware Taint Analysis for TVM Bytecode with Savelist Abstraction
TasmScan introduces source-free taint analysis for TON smart-contract bytecode, detecting 95.3% of defects with 96.8% precision and 17x speedup.
TasmScan is the first bytecode-level static analysis framework for the TON Virtual Machine, enabling cross-continuation data flow reasoning without source code by modeling savelist semantics through forward register analysis with formal over-approximation guarantees. It lifts bytecode into a typed intermediate representation (TASIR) and performs path-sensitive taint analysis. On a 208-contract benchmark with human-confirmed ground truth it detects 95.3% of defects across five classes at 96.8% precision, and resolves 294,546 dynamic continuation targets with 100% precision across 2,921 registry contracts. It achieves a 17x median speedup over symbolic-execution baselines.
- First source-free static analysis for TVM bytecode modeling continuation savelists
- Detects 95.3% of defects with 96.8% precision on 208-contract benchmark
- Resolves 294,546 dynamic continuation targets with 100% precision
- 17x median speedup over symbolic-execution baseline with zero crashes
From the original article
1 min read at arxiv.orgThe Open Network (TON), with a peak market capitalization exceeding $20 billion and over 175 million activated on-chain addresses, relies on the TVM (TON Virtual Machine) to execute smart contracts. TVM uses first-class continuations with savelists to manage control flow and register state across continuation invocations.
By Yixuan Liu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.