TONCO CLAMM DEX v1.
Audit · firm’s term: Security Assessment
Trail of Bits reviewed TONCO (TONCO CLAMM DEX v1.) on 16 Jan 2026: 13 findings, 0 critical; 10 marked fixed, 3 open.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 1 | 0 | 5 |
| Low | 2 | 0 | 2 |
Marked Informational or Undetermined by the firm. Not counted as findings.
InformationalManual balance calculation instead of raw_reserveOpen
The report gives no description here.
InformationalMultihop shortcut allows a position to be minted through the router contract’s accountOpen
The report gives no description here.
UndeterminedPotential overflow in fee growth computationOpen
The report gives no description here.
UndeterminedRounding difference between Uniswap v3 and TONCO amount delta calculationsOpen
The report gives no description here.
UndeterminedALM mint path sends ALM address instead of user address in message bodyFixed
The report gives no description here.
InformationalDepositing more than four positions causes failureFixed
The report gives no description here.
InformationalExcess TON refunded to the wrong address in swapsFixed
The report gives no description here.
InformationalFunctions missing the impure specifierFixed
The report gives no description here.
InformationalIncomplete handling of swap exceptionsFixed
The report gives no description here.
InformationalIncorrect price caching corrupts legacy tick formatFixed
The report gives no description here.
Show 5 more
InformationalLack of transparency in timelocked code updatesFixed
The report gives no description here.
InformationalReturn value of modifyPosition is ignored inside burnPositionFixed
The report gives no description here.
InformationalRouter does not check for pool existenceFixed
The report gives no description here.
UndeterminedUsers are able to route positions to the ALMFixed
The report gives no description here.
InformationalZero-liquidity positions can be minted and deposited into an accountFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of TONCO’s security record
TONCOSecurity firm
Trail of Bits29 projects reviewed · 47 reports · latest Sep 2026
See Trail of Bits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us