The Open Network (TON) blockchain employs an asynchronous execution model that introduces unique security challenges for smart contracts. A primary concern is race conditions arising from unpredictable message processing order. While previous work established vulnerability patterns through static analysis of audit reports, dynamic detection of temporal dependencies through systematic testing remains an open problem. This study proposes a dynamic evaluation methodology based on controlled message orchestration to systematically expose vulnerabilities in asynchronous smart contracts. By synthesizing precise message queue manipulation with differential state analysis and probabilistic permutation testing, we establish a framework (namely, BugMagnifier) for identifying execution flaws that static methods miss. Experimental evaluation demonstrates BugMagnifier's effectiveness through extensive parametric studies on purpose-built vulnerable contracts and five real-world vulnerability cases reproduced from recent security audits. Results reveal message ratio-dependent detection complexity that aligns with theoretical predictions. This quantitative model enables predictive vulnerability assessment while shifting discovery from manual expert analysis to automated evidence generation. By providing reproducible test scenarios for temporal vulnerabilities, BugMagnifier addresses a critical gap in the TON security tooling, offering practical support for safer smart contract development in asynchronous blockchain environments.
翻译:开放网络(TON)区块链采用异步执行模型,为智能合约引入了独特的安全挑战。主要问题在于因消息处理顺序不可预测而产生的竞争条件。尽管先前的研究通过审计报告的静态分析确定了漏洞模式,但通过系统性测试动态检测时间依赖性仍是一个待解决的问题。本研究提出一种基于受控消息编排的动态评估方法,以系统性地暴露异步智能合约中的漏洞。通过将精确的消息队列操作与差异状态分析及概率排列测试相结合,我们建立了一个框架(名为BugMagnifier),用于识别静态方法遗漏的执行缺陷。实验评估通过在特制易受攻击合约上进行广泛的参数研究,以及从近期安全审计中复现的五个真实世界漏洞案例,证明了BugMagnifier的有效性。结果显示,消息比例相关的检测复杂度与理论预测相符。该定量模型支持预测性漏洞评估,同时将漏洞发现从人工专家分析转变为自动化证据生成。通过为时间性漏洞提供可复现的测试场景,BugMagnifier填补了TON安全工具链的关键空白,为异步区块链环境中的更安全智能合约开发提供了实用支持。