Skip to content

Conversation

Karkarmath
Copy link
Contributor

@Karkarmath Karkarmath commented Oct 7, 2025

Closes #216

Copy link

github-actions bot commented Oct 7, 2025

Thanks for the update to the jetton burning how‑to. I reviewed the changes in standard/tokens/jettons/how-to-burning.mdx; a few blocking doc/style fixes are needed before merge.

Findings (5)

High (5)

[HIGH] Missing safety callout for funds and keys

Location:

```typescript
import { Address, beginCell, internal, toNano } from "@ton/core";
import { TonClient, WalletContractV4 } from "@ton/ton";
import { mnemonicToPrivateKey } from "@ton/crypto";
async function main() {

Description:
This guide performs chain‑affecting operations (burning jettons and sending a wallet message) and uses wallet credentials but lacks the required safety callout before the actionable code. Per the style guide, steps that move funds or perform on‑chain operations must include a Warning/Caution covering risk, scope, rollback, and testnet‑first guidance (see https://github.com/tact-lang/mintlify-ton-docs/blob/main/contribute/style-guide-extended.mdx?plain=1#L465-L470 and https://github.com/tact-lang/mintlify-ton-docs/blob/main/contribute/style-guide-extended.mdx?plain=1#L472-L479).

Suggestion:
Add a Warning callout immediately before the code block clarifying risk, scope, rollback, and to use Testnet first.

 It is possible to do it manually via your favorite IDE:
+
+> [!WARNING] Funds and keys at risk — use Testnet first
+> This example moves value on-chain and uses a mnemonic/private key.
+> Risk: irreversible transactions; Rollback: none; Scope: your wallet and jetton wallet.
+> Use TON Testnet first and label environments explicitly. Never paste real mnemonics; use secure storage.
+
 ```typescript

[HIGH] Inlined mnemonic in code (unsafe secret handling)

Location:

const your_mnemonic = 'put your mnemonic here, ...';
const keyPair = await mnemonicToPrivateKey(your_mnemonic.split(" "));
const walletContract = WalletContractV4.create({
workchain: 0,
publicKey: keyPair.publicKey,

Description:
The example inlines a mnemonic as a string literal, normalizing unsafe handling of secrets. This risks accidental leaks via source control, logs, or screenshots and violates the rule to never inline secrets in guides (see https://github.com/tact-lang/mintlify-ton-docs/blob/main/contribute/style-guide-extended.mdx?plain=1#L498-L500).

Suggestion:
Replace the inline mnemonic with an environment variable and validate its presence.

-    const your_mnemonic = 'put your mnemonic here, ...';
-    const keyPair = await mnemonicToPrivateKey(your_mnemonic.split(" "));
+    const MNEMONIC = process.env.MNEMONIC;
+    if (!MNEMONIC) throw new Error("Set MNEMONIC env var with a test mnemonic.");
+    const keyPair = await mnemonicToPrivateKey(MNEMONIC.split(" "));

[HIGH] Undefined placeholders in example (copy/paste hazard)

Location:

.parse('put your Jetton wallet address');
const destinationAddress = Address
.parse('put your regular wallet address');

Description:
The snippet uses free‑form text placeholders like “put your … address” that are not defined on first use and do not follow the required placeholder formats. Undefined placeholders increase copy/paste errors and violate the placeholder convention (see https://github.com/tact-lang/mintlify-ton-docs/blob/main/contribute/style-guide-extended.mdx?plain=1#L392-L400).

Suggestion:
Use <ANGLE_CASE> placeholders and define them after the code block.

-    const jettonWalletAddress = Address
-                                .parse('put your Jetton wallet address');
-    const destinationAddress = Address
-                                .parse('put your regular wallet address');
+    const jettonWalletAddress = Address.parse('<JETTON_WALLET_ADDR>');
+    const destinationAddress = Address.parse('<WALLET_ADDR>');

Add after the code block:

Define placeholders (first use):
`<JETTON_WALLET_ADDR>` — your jetton wallet address.
`<WALLET_ADDR>` — your wallet address to receive responses.
`<RPC_URL_TESTNET>` — HTTPS endpoint of your TON testnet RPC provider.
`<MNEMONIC>` — your 24‑word seed phrase (set via `MNEMONIC` environment variable).

[HIGH] UI strings formatted as code instead of quotation marks

Location:

Or via web services as [TON MINTER](https://minter.ton.org/). Connect your wallet via Ton connect.
Insert the Jetton master contract address in the `Jetton address` field. Next, click the `Burn` button in the balance field of your wallet
and enter the amount to burn.

Description:
UI labels (“Jetton address”, “Burn”) are wrapped in code backticks instead of double quotation marks. UI strings must appear verbatim in double quotes for accurate copying and translation (see https://github.com/tact-lang/mintlify-ton-docs/blob/main/contribute/style-guide-extended.mdx?plain=1#L262-L266).

Suggestion:
Replace backticks with double quotation marks for UI labels.

-Or via web services as [TON MINTER](https://minter.ton.org/). Connect your wallet via Ton connect.
-Insert the Jetton master contract address in the `Jetton address` field. Next, click the `Burn` button in the balance field of your wallet
+Or via web services as [TON MINTER](https://minter.ton.org/). Connect your wallet via Ton connect.
+Insert the Jetton master contract address in the "Jetton address" field. Next, click the "Burn" button in the balance field of your wallet
 and enter the amount to burn.

[HIGH] Unlabeled non‑runnable snippet

Location:

```typescript
import { Address, beginCell, internal, toNano } from "@ton/core";
import { TonClient, WalletContractV4 } from "@ton/ton";
import { mnemonicToPrivateKey } from "@ton/crypto";
async function main() {

Description:
The code block requires real addresses, a mnemonic, and network setup, and cannot run as shown. Partial snippets must be clearly labeled as “Not runnable” to prevent copy/paste failures (see https://github.com/tact-lang/mintlify-ton-docs/blob/main/contribute/style-guide-extended.mdx?plain=1#L430-L434).

Suggestion:
Label the snippet as not runnable.

 It is possible to do it manually via your favorite IDE:
 
+Not runnable
+
 ```typescript

import { Aside } from '/snippets/aside.jsx';

<Aside type="danger" title="Warning — funds at risk">
Burning can move funds. Scope: your wallet and the target jetton contracts.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Didn't understand this whole paragraph.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was advice from AI. I think I will just remove it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Jettons burning is primarily intended to get rid of unnecessary jettons (those with low liquidity or a zero price) and
to influence the market (burning a large number of jettons could increase its liquidity).

It is possible to do it manually via your favorite IDE:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't really matter if IDE is favorite.

The intent of the sentence should've been "here is the code for that".

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

const jettonWalletAddress = Address.parse('<JETTON_WALLET_ADDR>');
const destinationAddress = Address.parse('<WALLET_ADDR>');

const messageBody = beginCell()
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't we have bindings for that?

@ton/ton or @ton-community/assets-sdk should have constructors for all these Jetton messages.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, we have. I added a full construction of message just as illustrative example. I will add after that the code used assets-sdk.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done


// connect to your regular wallet
const client = new TonClient({
endpoint: 'https://toncenter.com/api/v2/jsonRPC',
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider using prettier

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

void main();
```

Or via web services as [TON MINTER](https://minter.ton.org/). Connect your wallet via Ton connect.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Alternative approach should go under separate ##;
  • Grammar;
  • Lists should be formatted as - lists, not paragraphs;
  • Need a screenshot here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. On TON MINTER there is no dark theme, so there will be only one screenshot.

Copy link
Collaborator

@verytactical verytactical left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

Copy link

To fix the formatting issues:

  1. Install necessary dependencies: npm ci
  2. Then, run this command:
npx remark -o --silent --silently-ignore standard/tokens/jettons/how-to-burning.mdx 

@skywardboundd
Copy link
Collaborator

skywardboundd commented Oct 10, 2025

We can burn some asset just send it to null account:
UQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJKZ

Copy link

Thanks for the improvements to the jetton burning guide. A couple of high‑impact fixes are needed before merge.

Findings (2)

High (2)

[HIGH] Missing safety callout for funds and keys

Location:

// send the burning message through a user wallet
const seqno = await walletContract.getSeqno(provider);
await walletContract.sendTransfer(provider, {
seqno: seqno,
secretKey: keyPair.secretKey,
messages: [burningMessage],
});

Description:
This page performs fund‑affecting actions and uses a mnemonic‑derived key to sign transfers without the required Warning/Caution. The risk starts before the first code block and is reinforced where the mnemonic is read and burn/transfer calls are sent (e.g., import/read of process.env.MNEMONIC, sendTransfer, sendBurn). The callout must cover risk, scope, rollback, and testnet‑first guidance.

Suggestion:

--- a/standard/tokens/jettons/how-to-burning.mdx
+++ b/standard/tokens/jettons/how-to-burning.mdx
@@
 Jettons burning is primarily intended to get rid of unnecessary jettons (those with low liquidity or a zero price) and
 to influence the market (burning a large number of jettons could increase its liquidity).
 
+Warning — funds at risk
+Burning jettons transfers assets and requires your private key/mnemonic. Scope: your wallet’s jetton balance. Rollback: none—on‑chain burns are final. Do first (testnet): set `NETWORK="testnet"` (for SDK) and use a testnet RPC endpoint.
+
 Here is the code for that:

[HIGH] Placeholders not defined on first use

Location:

const jettonWalletAddress = Address.parse("<JETTON_WALLET_ADDR>");
const destinationAddress = Address.parse("<WALLET_ADDR>");

Description:
Placeholders appear in examples without first‑use definitions, creating copy/paste hazards. In the first snippet, <JETTON_WALLET_ADDR> and <WALLET_ADDR> lack definitions; in the SDK snippet, MY_JETTON_ADDRESS and RECEIVER_ADDRESS are also undefined (see standard/tokens/jettons/how-to-burning.mdx?plain=1#L97-L101).

Suggestion:

--- a/standard/tokens/jettons/how-to-burning.mdx
+++ b/standard/tokens/jettons/how-to-burning.mdx
@@
 void main();

+Define placeholders (first use):
+<JETTON_WALLET_ADDR> — address of your jetton wallet contract (the wallet you will burn from).
+<WALLET_ADDR> — your wallet address to receive responses (same wallet controlling the burn).
@@
void main();


+Define placeholders (first use):
+`MY_JETTON_ADDRESS` — address of the jetton wallet you control on the selected network.
+`RECEIVER_ADDRESS` — address placeholder used in SDK examples (not used by `sendBurn` here; keep consistent with your wallet context).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Jetton > How to: burning]

3 participants