FunC Checklist

Release: Version 1.0

#	Item	Description
1	Proper Usage of Function Specifiers	It is important to use impure, inline/inline_ref, and method_id properly. For example, if impure is not specified and the result of the function call is not used, then the FunC compiler may and will delete this function call.
2	No Unbounded Data Structures	Smart contract storage is limited to 65536 unique cells, so the maximum number of entries in the dictionary is 32768 or slightly more if there are repeated cells. It is recommended to use the contracts sharding pattern.
3	No Name Collisions	Use a linter as variable and function names can include almost any valid character.
4	Locked Pragma Version	The code should be deployed with the same version as it was tested with.
5	Consistent Storage Layout Usage	Ensure data in the contract is stored and accessed in a consistent order.
6	Nested Storage Layout Usage	Organize storage into logical blocks of related data, unpacking only what is needed for a specific function.
7	No Bounced Messages Query Execution	The query contained in the body of a bounced message should never be executed.
8	Bounced Messages Catching	Ensure the contract gracefully manages failures and properly handles bounced messages to maintain functionality and reliability.
9	Man-in-the-Middle Vulnerabilities	Always re-validate critical properties in the message cascade as it can span multiple blocks.
10	Proper Usage of Messages Modes	Properly utilize the available modes and flags for sending messages to ensure the correct and predictable behavior of your smart contracts.
11	Replay-Safe Code	Implement the seqno pattern to prevent replay attacks by ensuring each transaction is unique and cannot be executed multiple times.
12	Workchain Addresses Validations	Verify the address workchain to prevent improper usage and mitigate replay attacks across different workchains.
13	Secure Random Number Generation	Ensure secure random number generation in FunC by leveraging cryptographic primitives or blockchain-native randomness sources to prevent predictability and manipulation.
14	Sufficient Gas Calculations	Avoid Partial Transactions Execution. Check the amount of TONs attached to the message to ensure they are enough to cover all types of fees.
15	Access Control Validations	Implement robust access control validations in FunC by verifying message senders and permissions to ensure only authorized entities can execute sensitive contract functions.
16	Third-Party Code Interactions	Carefully validate and manage third-party code interactions in FunC to ensure external contract calls handle unexpected behaviors and maintain data integrity.
17	Parsing and Serialization Checks	Ensure correct use of end_parse() for robust parsing and serialization checks in FunC by validating data formats, lengths, and encoding to prevent errors, data corruption, or malicious payloads.
18	Business Logic Violations	Verify that all business logic in FunC adheres to intended rules and workflows, preventing unauthorized actions, bypasses, or misuse.
19	Freeze Prevention Checks	Test and verify FunC contracts to ensure they cannot enter a frozen or non-functional state due to unhandled errors or locked states.
20	Proper External Message Handling	Use accept_message() only after thorough validations to prevent potential gas-draining attacks.
21	Carry-Value Pattern	Ensuring the carry-value pattern exists to maintain and transfer state consistently across messages, guarantees reliable and predictable contract behavior.