Tact Kitchen – Telegram
Tact Kitchen
590 subscribers
36 photos
4 videos
60 links
🧑‍🍳 Peek behind the scenes and into the steaming pot of hot updates to Tact compiler, tooling, documentation and ecosystem

⚡️ You know what's cooking — Tact!
⌨️ Sources: github.com/tact-lang
👉 t.me/boost/tact_kitchen

Brought to you by the Tact team
Download Telegram
❤️ A warm welcome to listeners of good podcasts @tonpizdev
♨️ @tact_kitchen
8
⚡️ Heads-up: there are more than 2100 Tact source files on GitHub, not counting forks and the tact-lang organization!

It would be nice to get Tact code highlighted there, don't you think? That's why we've made a PR to Linguist, a language detection and highlighting library from Github.

Here's how you can help:
1. Go to the PR
2. Leave your 👍 without writing any comments, to keep PR clean
3. Keep writing nice open source contracts in Tact 🙌
4. Wait for the best 🤞

This is not a drill. I repeat: this is not a drill.
This is the beginning of the story.

UPD:

🍲 our story, actually
♨️ @tact_kitchen
12
⚡️ Added a page on security best practices to the documentation

There are several anti-patterns and potential attack vectors that Tact smart contract developers should be aware of. These can affect the security, efficiency, and correctness of the contracts.

With the help of community contributors, we've discussed the do's and don'ts specific to writing and maintaining secure Tact smart contracts, and written a cohesive page for you!

🧑‍🍳🎉 Community contributors: PixelPlex and Aliaksandr Bahdanau
🐙 Implementation: #1070
✈️ Delivered: docs.tact-lang.org/book/security-best-practices

🍲 where did the bad actor go? they ran somewhere
♨️ @tact_kitchen
15
⚡️ Added DeDust and STON.fi cookbooks to the documentation

Ever wondered how to build your own Decentralized EXchange? Neither have I!

However, documentation on how to interact with existing DEXes from Tact was highly requested — and, with the help of community contributors, we wrote it. Read how to swap Toncoins for Jettons, Jettons for Jettons, and provide liquidity to pools of DeDust and STON.fi, all with ⚡️ Tact.

🧑‍🍳🎉 Community contributors: PixelPlex and Aliaksandr Bahdanau
🐙 Implementations: #954, #956
✈️ Delivered: DeDust, STON.fi

🍲 decentralized surprise liquidity provision
♨️ @tact_kitchen
13
⚡️ Completely overhauled exit codes page in the documentation

Sometimes pages in the Tact documentation are more detailed than you'll find elsewhere. The exit codes page is a case in point.

Not only do you get a comprehensive denoscription of what exit codes are, how they are defined, and which ones are reserved, but you also get a handy table of them with short denoscriptions and quick navigation to each exit code in the table of contents. Since each of the exit codes has its own headings, linking to a specific exit code is easier than ever!

In addition, all denoscriptions of compute phase exit codes show examples of how you might encounter them. And sometimes even help you to anticipate and avoid them.

By the way, for exit code 50 (not listed anywhere else), we've also described the current limits on config param 43 related to account state, max number of bits and cells in messages, and much more.

🧑‍🍳 Contributor: Novus Nota
🐙 Implementation: #978
✈️ Delivered: docs.tact-lang.org/book/exit-codes

🍲 code: dismissed
♨️ @tact_kitchen
18
Tact Kitchen
❤️ Thanks, folks! We really appreciate that! 🍲 melting hearts ♨️ @tact_kitchen
⚡️ GitHub supports Tact!

Now that you've clicked, let me clarify — thanks to our efforts, your support and all of you writing lots of smart contracts, Tact now has syntax highlighting all across GitHub!

— Files with a .tact extension? Boom, colored.
— Blocks of code in markdown that specify tact as their language? Got you covered.

❤️ Thanks everyone for your support and love! Without you, there would be nothing. Literally.

✈️ We're continuing to ship awesome stuff for you — expect many shiny things this December.

🍲 growth is inevitable
♨️ @tact_kitchen
21
Forwarded from TON Dev News
📣 Hey, folks! The Tact dev team kindly asks you to share some feedback regarding your experienced with smart-contract programming in Tact.

Our mission is to develop a high quality programming language that can be used for every single project on TON and make code easy to write, understand and audit.

The survey covers 4 topics and will only take about 5-8 minutes of your time.

Thank you for your contribution!

👉https://paperform.co/edit/h02jnxtq
9
Forwarded from TON Dev News
📖 Secure Smart Contract Programming in Tact: Avoiding Pitfalls in the TON Ecosystem

As The Open Network evolves, its innovative features and the Tact programming language unlock new possibilities for developers. However, common mistakes can lead to vulnerabilities.

CertiK’s latest blog post highlights critical issues like data serialization, concurrency, and gas management, offering actionable insights to optimize security in Tact smart contracts. Whether you’re new to TON or a seasoned developer, these best practices are essential for building robust and secure applications.

🔗 https://www.certik.com/resources/blog/secure-smart-contract-programming-in-tact-popular-mistakes-in-the-ton
Please open Telegram to view this post
VIEW IN TELEGRAM
9
🎉 Misti 0.6 has just landed on NPM!

🔍 More Tact Detectors: CellBounds which covers both CellOverflow and CellUnderflow, ExitCodeUsage, EtaLikeSimplifications and ShortCircuitCondition.

⚙️ More Tools: Added Callgraph that tracks function effects and is useful for auditing contracts.

🌐 Better Integrability: Misti can run in browser environments.

🔧 Fixes & Enhancements: Check out the full changelog.

♨️ @tact_kitchen
12
⚡️ Added an assembly functions page to the documentation

👉 Covering all your needs and going beyond:
▪️ Eh, what are TVM instructions anyways?
▪️ Sure, they're used in asm functions of Tact, but what's the syntax and stuff?
▪️ Stack registers, what's that?
▪️ Fine, but what if I want to re-arrange parameters or return values?
▪️ Limitations? Caveats?
▪️ How would I debug all that?
▪️ Can I apply some attributes?
▪️ Got any examples?

🧑‍🍳 Contributor: Novus Nota
🐙 Implementation: #1061
✈️ Delivered: docs.tact-lang.org/book/assembly-functions

🍲 there are 11 types of programmers: ROT, -ROT and BRAINROT
♨️ @tact_kitchen
9
🎄 Merry Christmas, Folks!

As we wrap up 2024, it's time to celebrate all that we've accomplished together.

🚀 Adoption, Features and Tooling

Your biggest achievement this year was getting GitHub to support Tact on the entire website! We say you, because it wouldn't have been possible without you writing contracts, finding and reporting bugs & suggestions, and supporting Tact elsewhere ❤️

Regarding features and compiler updates, there were so many, that Tact has practically been reborn into a fresh, secure, easy and accessible language language for complex smart contracts, quick onboarding and fast prototyping.

In terms of tools, an awesome static analyzer Misti raised from 0 to hero: with over 25 issue detectors, CI/CD and Blueprint integrations. Additionally, the tree-sitter-tact and many editor packages and highlighting plugins were frequently updated to keep up with compiler updates.

📚 Documentation

Working on the clearest and most comprehensive documentation, we often had to dig deep into TON sources and discover what was really going on under the hood. And it was and is very worth it: the exit codes and assembly functions pages are the most vivid proofs.

We try to cater to both the experienced professionals and beginners on TON Blockchain, which is why you can expect more in-depth research of TVM, more production-ready examples of common contracts in Tact, and an even more streamlined onboarding experience ✈️

🐞 Bugfixes

The release 1.4.1 in particular squashed so many bugs, that the security audit of 1.5.0 went silky smooth — no critical vulnerabilities found, as announced on TON Gateway.

As for the next release, we're fixing the internal representation of Address type, reworking the type system to support more TVM types with the most safety and convenience, and making rapid strides to reduce the gas consumption 🛠

🎁 A Small Holiday Request

Finally, we have a small holiday wish: If you’ve enjoyed our progress this year, consider gifting us a GitHub star. It’s a simple gesture, but one that means the world to us. Your support helps Tact grow and reach even greater heights.

🎅 Happy holidays from the Tact team!
❤️ Take care, get some well-deserved rest and prepare for 2025 — we've got big plans for the next year

🍲 sparkling future ahead
♨️ @tact_kitchen
12
Tact Kitchen
🎄 Merry Christmas, Folks!
🎄 And a Happy New Year!

🍲 🪄🎁💝🎊🎉🎉🎉
♨️ @tact_kitchen
14
⚡️ Added AI prompts for Cursor and Windsurf to tact-template

Did you know, that there's a tact-template that comes pre-configured to kickstart your new Tact projects?

It is much slimmer than the Blueprint-based projects, and focused only on Tact: it includes the compiler, Sandbox-based Jest tests, and basic noscripts and utils to get you started in no time!

🪄 And now, with the help of a community contributor, it also has neat system prompts designed specifically for AI-focused editors like Cursor and Windsurf. Utilize them to gain an edge over competition and aid yourself with prototyping smart contracts.

⚠️ That said, be mindful of the use of AI and make sure to thoroughly test and debug your smart contracts. Funds won't protect themselves 😅

🧑‍🍳🎉 Community contributor: Skuli Dropek
🐙 Implementation: #42
✈️ Delivered: tact-template

🍲 the 's' in ai stands for security
♨️ @tact_kitchen
17
⚡️ Added a Compilation page to the docs

Did you know how to use Tact compiler on the CLI and its configuration settings?
Have you ever wanted to easily upgrade the compiler or pin a specific version?
Or have you ever wondered about the build/ or output/ folders and build artifacts produced within them?
Well, look no further — the Compilation page describes it all and more!

See what's in store:
▪️ Compiler upgrades
▪️ Compilation report
▪️ BoC-encoded contracts code
▪️ Contract's package .pkg and ABI .abi
▪️ Bindings and wrappers for simpler deployments, debugging and interactions with deployed contracts

The wrappers are currently only generated for TypeScript, but this may change in the future — stay tuned 😉

🧑‍🍳 Contributor: Novus Nota
🐙 Implementation: #1309 and #1676
✈️ Delivered: docs.tact-lang.org/book/compile

The image for this post is taken from:
https://xkcd.com/1755/

🍲 don't console my bugs
♨️ @tact_kitchen
8
🚀 Tact v1.5 Audited by Trail of Bits

The security audit for Tact v1.5 has been completed by Trail of Bits, a leading Web3 security firm.

No high-severity vulnerabilities were found.

🔧 Some bugs and points of improvement were discovered and addressed in a new Tact v1.5.4 bugfix release.

Thanks to Trail of Bits for their thorough review!

The report can be accessed at the Trail of Bits GitHub repo: https://github.com/trailofbits/publications/blob/master/reviews/2025-01-ton-studio-tact-compiler-securityreview.pdf

⚡️ In the meantime we continue to improve Tact with new language features, gas optimizations (a lot of those lately!), and enhancements to the compiler’s reliability. This ensures a secure and efficient development experience on TON Blockchain.

👉 Upgrade to Tact 1.5.4, if not already: https://docs.tact-lang.org/book/compile/#upgrades

🍲 cooking with great care for performance and users
♨️ @tact_kitchen
17
🎉 Tact v1.6.0 is released!

🏆 This is the biggest update of Tact since its creation, bigger than all previous milestones combined. There were so many improvements that we've even won over FunC in terms of gas usage on many standard contracts, such as Jettons.
🤔 Don't believe me?
🥳 Let's unpack Tact v1.6.0 together and see these improvements for ourselves!

We'll start with the number one achievement of this release:

⛽️ Gas optimization victory over FunC

Gas has long been a major pain point for Tact. Prior to v1.6.0, Tact's gas usage on many common contracts, such as Jettons, was far from ideal, requiring about 2.5 times gas of the FunC reference implementation.

But with Tact 1.6.0, those old gas-expensive days are long gone.

🤯 For example, a Tact rewrite of the reference FunC Jetton code consumes less gas for transfer, burn and discovery messages!
😎 So, expect to receive easy-to-use idiomatic Tact implementations of common contracts in the near future

Some of the things we did to achieve this:
▪️ Removed "system" cell — for most cases, parent contract code is no longer stored in the system cell with all the child contract codes
▪️ Removed redundant address checks
▪️ Deprecated Deployable trait in favor of receive(){}
▪️ Introduced contract parameters as an alternative to init() function

And optimized compiler internals, many old and new functions in the stdlib:

🧰 Some of the standard library additions and changes

• Added specialized deploy and message functions for efficient on-chain deployments and non-deployment messages respectively
• Many math functions, such as divc, mulShiftRightCeil, and others
• More advanced functions, such as setGasLimit, setSeed, myCode, and others
• Handy throwIf and throwUnless functions, which deprecated their "native" prefixed counterparts
• Optimized emptyCell and emptySlice functions
Int.toString function now consumes up to 64% less gas
Int.toFloatString function now consumes up to 62% less gas

Added many functions for Cell, Slice and Builder types:
Variable integer serialization types and the corresponding .load and .store functions of Slice and Builder types
• Functions Slice.hashData and String.hashData for efficient hashes of data only
• Functions for working with addresses: Slice.asAddress, Slice.asAddressUnsafe, contractHash, and a new BasechainAddress type with its helper functions
• ...and more!

🧳 More auxiliary things

• Basic let-destructuring of structs and Messages
• Compile-time method ID expressions for getters and Message opcodes
• The codeOf expression to get the code of child contracts
• More map improvements and new methods, like replace and replaceGet
• New augmented assignment operators &&=, ||=, >>= and <<=
• Better error reporting for many cases
• Generation of constants in TypeScript wrappers
• The -w, --watch CLI flags for watching for changes and automatic recompilations
• CLI for the Tact's TVM disassembler — unboc
• Fixes of the compilation report
• Fixes of the compiler's third-party API
• Fixes of the internal infrastructure and code generation
• Lots of other smaller bug fixes and enhancements
• ...and documentation for all of that and beyond!

Besides, check out the updated Awesome Tact list and add your awesome projects, especially those using Tact in production!

⚠️ Breaking changes

There are only two, and they're both pretty minor:

• Tact 1.6.0 replaces Context.bounced field with Context.bounceable — whether the received message can bounce back or not. Previously, bounced field was useless since any bounced messages would be handled in a separate bounced() receiver.

• The enabledMasterchain option was removed from tact.config.json. Going forward, support of masterchain addresses is always enabled in Tact contracts.

♥️ Special thanks goes to all the contributors and community members — without you there would be nothing. Let's keep building the future of smart contracts with ⚡️ Tact!
📜 See full release notes for Tact v1.6.0
📥 And upgrade Tact in your projects

🍲 we're beating the gas allegations with this one 🗣🗣🗣
♨️ @tact_kitchen
22
🎉 Tact v1.6.1 is released!

👀 "Long" time no see — many tools have been updated to support the latest Tact versions, and we've prepared some quality-of-life additions and minor fixes.

A big release cannot exist without a follow-up patch. This patch is mainly focused on polishing things in the internal infrastructure, standard library, and public APIs.

🛠 Bug fixes

▪️ The multiple wildcard function parameters are now supported.

That is, the following works in v1.6.1:

trait WildThing {
// Using wildcards for parameter names
virtual fun assure(_: Int, _: Int): Bool {
return true;
}
}

contract YouMakeMyHeartSing with WildThing {
// And then overriding them with concrete names
override fun assure(a: Int, b: Int): Bool {
return a + b == b + a;
}
}


▪️ Made calls to the .toCell() function on struct as a contract field handled correctly.

struct MyStruct { x: Int; y: Int; z: Int }

contract MyContract(myField: MyStruct) {
receive() {
// This works fine now:
self.reply(self.myField.toCell());
}
}


🧰 Standard library additions and changes

• Added the StateInit.hasSameBasechainAddress() function, which is a gas-efficient way to check whether the given initial state corresponds to a specified address.

• Added the cashback() function to efficiently forward excess funds from an incoming message to the target address.

• All entities in Core libraries received documentation comments. Next time, we'll add missing doc comments for the standard libraries, i.e., everything imported using the import "@stdlib/..." syntax.

🧳 Some other changes:

• We've inlined the contract load functions, so the gas consumption of the benchmarked Jetton implementation in Tact is even smaller than that of its reference implementation in FunC.

• The TypeScript wrappers now produce bi-directional mappings of exit codes from their numbers to string denoscriptions and vice versa. Plus, the message opcodes are exported too.

• The .code infix is no longer added to the file names of the generated FunC, Fift, and disassembled Fift outputs. It was annoying to see it everywhere, so now it's only present on the compiled .boc files.

📜 See the full release notes for Tact v1.6.1
📥 And upgrade Tact in your projects

Besides, the tact.vim plugin for Vim 8+ and tact-sublime package for Sublime Text 3+ have been updated to support Tact v1.6.0 (and v1.6.1 too).

The Misti static analyzer has been updated to v0.7.0 and now supports Tact v1.6.0 and v1.6.1. See its full release notes.

Speaking of plugins and tools, we have another announcement to make — we're starting an alpha test of the tact-language-server: an official language server for Tact that can be used standalone or within a dedicated extension for VSCode and VSCode-based editors, such as VSCodium, Cursor, Windsurf, and others.

Join the alpha squad and gain early access to great tooling: tact-language-server. If things are good, please give it a star and write a positive review. If they're not — open an issue, and we'll take a look!

🍲 cue the Tact type beat (sped up)
♨️ @tact_kitchen from the @ton_studio
15
Forwarded from nowarp | TON Security
🎉 Misti 0.7 has just landed on NPM!

🔍 More Tact Detectors: StateMutationInGetter, UnprotectedCall and SuspiciousLoop.

Tact 1.6.1 support: Including new language syntax and features.

⚙️ Improved Tools: Added more Callgraph functionality to enhance contracts audits.

🔧 Fixes & Enhancements: Check out the full changelog.
9
🎉 Tact v1.6.2 is released!

Release a day keeps the sanitarians away.

Seriously though, before we commit to the next big release, refining rough edges and adding useful things to the standard library is always nice without making you wait for them for long. To discover such points of improvement, we actively collect feedback that we see in Tact chats and that we receive from the teams that actively use Tact in production.

We're not yet done with all the suggestions, so apart from this release, there are plans to make at least one more patch release with possible bug fixes and additions to the standard library.

❤️ All constructive feedback is welcome — let's enjoy writing ⚡️ Tact together!

On that note, let's quickly unpack the v1.6.2:

🛠 Bug fixes

• An empty init() function is no longer implicitly added when empty contract parameters are declared. This is done to save gas and storage, and it is backward compatible with the lazy initialization that Tact offered as the sole data initialization mechanism before v1.6.0.

• Compiler no longer screams at you if the message struct becomes small enough to fit into the 224 bits and does not require an explicit bounced<M> constructor. That was a noisy warning, and it's much better without it.

• Contract constructors are now public in TypeScript wrappers.

• Now, if getters do not have explicit method ID overrides in Tact code, they are called by their name and not their numeric IDs in the generated TypeScript wrappers. This change restores the pre-1.6.0 behavior that was important for compatibility with some third-party tools that do not support calling getters by their method IDs.

• Compiler upgrades via npm i now work as they should. Note that upgrades through the npm update --save command continue working, too.

🧰 Standard library additions and changes

• Doc comments, doc comments everywhere! They're especially fun to use with the language server, see more info on that below.

• Added Slice.skipRef, Slice.skipMaybeRef, Slice.skipBool, Slice.skipCoins, Slice.skipVarUint16, Slice.skipVarInt16, Slice.skipVarUint32, Slice.skipVarInt32, Slice.skipAddress functions.

📜 See the full release notes for Tact v1.6.2
📥 And upgrade Tact in your projects

The alpha testing for the new TON Studio's official Tact language server continues. Have you tried it? It also has a neat VSCode extension and an extension for VSCode-based editors!

Here's a quick rundown of their features:
• Semantic syntax highlighting
• Code completion with auto import, postfix completion, snippets, and import completion
• Go to definition, implementation, type definition
• Find all references, workspace symbol search, symbol renaming
• Types and documentation on hover
• Inlay hints for types, parameter names, and more
• On-the-fly inspections with quick fixes
• Signature help inside calls, and actions for initOf and struct initialization
• Lenses with implementation/reference counts
• Gas estimates for assembly functions
• Commands for building and testing projects based on Blueprint and tact-template
• Integration with Tact compiler and Misti static analyzer

Sounds exciting? Install it and tell us what needs improvement — the language server is quite new, but it matures very fast!

🍲 please try to enjoy each release equally
♨️ @tact_kitchen from the @ton_studio
18
🎉 Tact v1.6.3 and v1.6.4 are released!

We're back with some quality-of-life improvements! I cannot promise there won't be another patch release before the next big one — that's because we're working on something really enticing in the background and would like you to continue receiving updates in the meantime.

Now, this isn't a dual release per se. It's just that the post for v1.6.3 got lost in the river of time... Kidding! The two patches are simply very connected since we wanted to ensure that v1.6.4 acknowledges the possible gaps in v1.6.3.

Let's unfold the v1.6.3 and v1.6.4 at once:

🛠 Bug fixes

• In the compilation report, TL-B for Address? is not Maybe Address, but plain Address. This is a temporary measure until the Address type is reworked to allow not just the addr_std scheme, but also the addr_none, addr_var and addr_extern.

• Parameter reordering optimization is now only applied to single-parameter asm extension functions, to avoid confusion when performing multiple mutation operations on arguments.

• The postinstall noscript has been removed from Tact's package.json so that Node.js package managers won't unexpectedly trip on it when you try to upgrade or reinstall the compiler in your projects.

✍️ Documentation updates

• Deprecated Deployable and FactoryDeployable traits in favor of null message body receive(), with or without a call to the new cashback() function at your discretion.

⛽️ Added gas best practices page, go check it out to reduce gas usage of your contracts: Gas best practices.

🎁 Enhanced the TypeScript wrappers produced by Tact compiler, and documented how to use the new exit code and opcode records: Interacting with TypeScript wrappers.

• Added missing reference docs and fixed many denoscriptions and links throughout the standard library.

• Made a significant change to the Reference section: removed the core-common and core-advanced pages, and distributed their contents across other libraries, such as: core-crypto, core-contextstate, core-send, core-gas, and core-addresses.

🧳 Miscellaneous improvements

• Added forceBasechain() and forceWorkchain() functions.

• Added the internalExternalReceiversOutsideMethodsMap config option as part of optimization options to prevent the contracts from being incorrectly recognized by some explorers and user wallets.

• Further decreased gas usage of contracts with some special cases of binary and fallback Slice receivers. This is relevant mainly for Jettons, but other contracts could benefit from this, too.

• The old parser is finally removed. As a user of the compiler, you shouldn't notice a thing, but if something misparses or behaves weirdly in terms of syntax — please notify us in the chat or by opening an issue and providing a minimal reproducible example.

📜 See the full release notes for Tact v1.6.3 and Tact v1.6.4
📥 And upgrade Tact in your projects

🍲 spinning cat be like: u-ii-tact-i, ou-iii-tact-i
♨️ @tact_kitchen from the @ton_studio
7