Skip to content

Conversation

Karkarmath
Copy link
Contributor

Closes #668

Copy link

Thanks for the updates to the NFT transfer guide. A few high‑severity fixes are needed before this can merge.

Findings (5)

High (5)

[HIGH] Missing safety callout for keys and fund transfer

Location: https://github.com/tact-lang/mintlify-ton-docs/blob/1fd109a111d856d6e8678e4b0fc5e84a368c698d/standard/tokens/nft/how-to-transfer.mdx?plain=1#L30-L53

Description:
The example handles a private mnemonic and performs a TON value transfer, which requires a visible safety callout per the style guide. The page currently lacks a <Aside> covering risk, scope, rollback, and environment.

Suggestion:

@@
-Or you can do it manually. Below there is an illustrative example:
+Or you can do it manually. Below there is an illustrative example:
+
+import { Aside } from '/snippets/aside.jsx';
+
+<Aside type="danger" title="Funds and keys at risk">
+  Risk: This example uses a private mnemonic and sends TON value.
+  Scope: Affects your wallet and transferred assets.
+  Rollback: Transfers are irreversible. If a mnemonic is exposed, rotate it and move funds immediately.
+  Environment: Use TON Testnet and a disposable test wallet. Do not use real mnemonics on mainnet.
+</Aside>

[HIGH] Inline mnemonic encourages unsafe secret handling

Location: https://github.com/tact-lang/mintlify-ton-docs/blob/1fd109a111d856d6e8678e4b0fc5e84a368c698d/standard/tokens/nft/how-to-transfer.mdx?plain=1#L30-L31

Description:
The snippet inlines a mnemonic and derives a key from it, encouraging unsafe storage of secrets in source code. The style guide requires using environment variables or keystores and avoiding secrets in examples.

Suggestion:

-    const your_mnemonic = "put your mnemonic here, ...";
-    const keyPair = await mnemonicToPrivateKey(your_mnemonic.split(" "));
+    const MNEMONIC = process.env.MNEMONIC as string; // set MNEMONIC in your environment (testnet only)
+    const keyPair = await mnemonicToPrivateKey(MNEMONIC.split(" "));

[HIGH] Invalid placeholder format and undefined placeholders in code

Location: https://github.com/tact-lang/mintlify-ton-docs/blob/1fd109a111d856d6e8678e4b0fc5e84a368c698d/standard/tokens/nft/how-to-transfer.mdx?plain=1#L49-L53

Description:
The example uses ad‑hoc prompts inside strings rather than required <ANGLE_CASE> placeholders, and it does not define them on first use. This creates copy/paste hazards and ambiguity.

Suggestion:

-    const NFT_ADDRESS = Address.parse("put your NFT item address");
+    const NFT_ADDRESS = Address.parse("<NFT_ITEM_ADDR>");
@@
-    const RECEIVER_ADDRESS = Address.parse("put receiver address");
+    const RECEIVER_ADDRESS = Address.parse("<RECEIVER_ADDR>");

Define placeholders (first use) below the code:

  • <NFT_ITEM_ADDR> — NFT item address on testnet.
  • <RECEIVER_ADDR> — destination wallet address on testnet.

[HIGH] Incorrect field name for NFT transfer condition

Location: https://github.com/tact-lang/mintlify-ton-docs/blob/1fd109a111d856d6e8678e4b0fc5e84a368c698d/standard/tokens/nft/how-to-transfer.mdx?plain=1#L13-L13

Description:
The text uses forward_ton_amount, which is not part of the NFT transfer signature. For NFTs, the correct field is forward_amount. Using the jetton-style field name can mislead readers.

Suggestion:

-If `forward_ton_amount > 0`, then `forward_payload` must comply with one of the [standard formats](https://github.com/ton-blockchain/TEPs/blob/master/text/0062-nft-standard.md#forward_payload-format).
+If `forward_amount > 0`, then `forward_payload` must comply with one of the [standard formats](https://github.com/ton-blockchain/TEPs/blob/master/text/0062-nft-standard.md#forward_payload-format).

[HIGH] TEP links use moving “master” branch instead of stable permalinks

Location: https://github.com/tact-lang/mintlify-ton-docs/blob/1fd109a111d856d6e8678e4b0fc5e84a368c698d/standard/tokens/nft/how-to-transfer.mdx?plain=1#L6-L13

Description:
Both references to TEP‑62 point to the moving master branch. Normative references must use stable permalinks (specific commit) to avoid drift and preserve reproducibility.

Suggestion:

- NFT transfer is an operation specified in [TEP 0062](https://github.com/ton-blockchain/TEPs/blob/master/text/0062-nft-standard.md). Its implementation must comply with this standard,
+ NFT transfer is an operation specified in [TEP‑62](https://github.com/ton-blockchain/TEPs/blob/1fbc23cac69723c53251f686ec90d81bf0e83443/text/0062-nft-standard.md). Its implementation must comply with this standard,
@@
- If `forward_ton_amount > 0`, then `forward_payload` must comply with one of the [standard formats](https://github.com/ton-blockchain/TEPs/blob/master/text/0062-nft-standard.md#forward_payload-format).
+ If `forward_ton_amount > 0`, then `forward_payload` must comply with one of the [standard formats](https://github.com/ton-blockchain/TEPs/blob/1fbc23cac69723c53251f686ec90d81bf0e83443/text/0062-nft-standard.md#forward_payload-format).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Standards > NFT > How to transfer]

2 participants