TVM Message Replay: Venom Wallet Exposed

A security vulnerability in Venom Wallet's smart contract implementation allows unlimited message replay attacks. The wallet uses a deprecated contract that calls accept_message() before any state commit, meaning failed transactions drain gas fees but roll back state, leaving the original signed message replayable from public transaction history. An attacker can retrieve the message BOC from the GraphQL API and resubmit it repeatedly without any signing privileges or gas costs. At ~0.0066 Venom per replay on a network capable of 150k TPS, a targeted wallet could lose ~1k Venom per second until the message expires. TON's standard WalletV4 and V5 contracts mitigate this by calling commit() immediately after accept_message() to preserve the incremented sequence number even on failure.