• TonBit has discovered and patched a critical flaw in TON VM’s RUNVM instruction that could allow attackers to corrupt smart contract libraries during gas exhaustion.
  • Developers are urged to update libraries and reinforce gas-management logic, as TonBit continues to lead proactive security efforts across the TON ecosystem.

TonBit, a subsidiary of blockchain security firm BitsLab, has once again flagged a critical vulnerability within the TON Virtual Machine (TVM), reinforcing its reputation as the primary security assurance provider for the TON blockchain.

The newly discovered flaw, officially acknowledged by the TON Foundation, affects the RUNVM instruction, which is responsible for executing sub-virtual machines (sub-VMs) during smart contract operations.

According to TonBit’s disclosure, an attacker could exploit a non-atomic state transition during gas exhaustion to corrupt the parent VM’s libraries, potentially triggering abnormal behavior in contracts that depend on those libraries.

“This issue could lead to cascading call failures and compromise contract integrity,” TonBit stated in a technical post detailing the discovery.

TonBit says the vulnerability has now been fully patched, thanks to immediate coordination with the TON Foundation. The security firm submitted both technical documentation and a mitigation plan, helping to implement a fix before the issue could be exploited in the wild.

Developers working on TON-based projects are advised to update all dependency libraries and apply additional library-integrity checks and gas-management mechanisms to avoid similar exploits in the future.

This is not the first time TonBit has sounded the alarm. The firm has consistently delivered proactive threat intelligence to the TON ecosystem and has audited projects like Catizen, Algebra, TonUp, Thunder Finance, and many others.

“We continue to operate under a ‘security-first’ ethos,” said a spokesperson for BitsLab.
“By sharing our findings transparently, we aim to build a more resilient Web3 ecosystem.”

TonBit is one of three major security-focused brands operated by BitsLab, which also runs MoveBit and ScaleBit. The group works across leading blockchain ecosystems, including Aptos, Sui, BNB Chain, Starknet, and Solana, delivering audits in programming languages ranging from Move and Cairo to Circom and Halo2.

Collectively, BitsLab has audited over 400,000 lines of code, protected $8 billion in assets, and served over 2 million users. With more than 400 security solutions delivered, the firm continues to raise the bar for ethical blockchain research and responsible disclosure.

In an industry where a single overlooked vulnerability can result in devastating exploits, TonBit’s diligence has once again helped avert a potential crisis—reminding developers and projects across Web3 that security isn’t optional—it’s foundational.

Edited by Harshajit Sarmah