According to PANews, the security team TonBit, under BitsLab, has identified a new vulnerability in the TON Virtual Machine (TVM) related to the state migration issue of the RUNVM instruction. This flaw could potentially disrupt the smart contract execution environment, leading to contract anomalies. Specifically, attackers could exploit the moment when the virtual machine's gas is depleted to damage critical libraries, causing subsequent operations that rely on these libraries to fail.
TonBit has submitted the vulnerability details and a fix to the TON Foundation and assisted in the repair process. Developers are advised to update promptly once the official patch is released and to enhance checks on library integrity and gas management within contracts to prevent similar issues from being maliciously exploited.
