TONCO CLAMM DEX v1.
Audit · firm’s term: Security Assessment
Trail of Bits reviewed TONCO (TONCO CLAMM DEX v1.) on 16 Jan 2026: 13 findings, 0 critical; 10 marked fixed, 3 open.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 1 | 0 | 5 |
| Low | 2 | 0 | 2 |
HighFee calculation mismatch in PositionNFT burn operation causes incorrect fee growth tracking for token1Fixed
The report gives no description here.
HighProxy TON balance of the router can be stolenFixed
The report gives no description here.
HighThe router’s TON balance can be drained via negative amount calculationFixed
The report gives no description here.
MediumMalformed multihop cell can lead to jetton lossFixed
The report gives no description here.
MediumOccupied ticks guard blocks addition of liquidity to existing ticks and allows MAX_USER_TICKS overflowFixed
The report gives no description here.
MediumOverflow in getMaxLiquidityForAmount0Precise can result in fund lossFixed
The report gives no description here.
Mediumowner_address can be spoofed to bypass the pool lock in the swapOperation functionFixed
The report gives no description here.
Mediumprice_sqrt can be manipulated by swapping through an empty poolFixed
The report gives no description here.
LowRouter will keep the jettons if the transfer notification contains an unsupported operationFixed
The report gives no description here.
Lowtimelock_delay cannot be updatedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of TONCO’s security record
TONCOSecurity firm
Trail of Bits29 projects reviewed · 47 reports · latest Sep 2026
See Trail of Bits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us