Jetton Token Development on TON: Architecture, Contracts, and Deployment

When porting tokens from EVM to TON, many developers are caught off guard by asynchrony: a holder's balance resides not in a single contract but in a separate Jetton Wallet. This breaks familiar patterns — transfer becomes a chain of messages, not an atomic call. Our team has over 5 years of experience in blockchain development and guarantees a correct implementation of the Jetton standard turnkey. We have successfully completed 10+ projects on TON, including DeFi protocols and NFT marketplaces. Gas optimization savings can reach 30% when using Tact, reducing token ownership costs. Contact us for a Jetton token turnkey development — we ensure security and gas optimization.

Architecture: Two Contracts

Jetton Master — the central contract, stores token metadata (name, symbol, decimals, total_supply) and can mint new Jetton Wallets. The full specification is described in TEP-74.

Jetton Wallet — one instance per holder. Stores the balance of a specific address. On transfer, the sender's Jetton Wallet sends a message to the recipient's Jetton Wallet. This is not an atomic call but a chain of asynchronous messages. If the recipient's Jetton Wallet does not yet exist, it is created on first token receipt, and the sender pays for deployment (roughly 0.04 TON storage deposit). Storage on TON incurs storage fees — about 0.005 TON per kilobyte per month, so each wallet must maintain a positive TON balance. In practice, we add a minimum of 0.05 TON per wallet — approximately 0.1 USD at current rates — to avoid freezing.

How Does the Jetton Contract Work?

The TEP-74 standard defines message structures and transfer logic. Let's look at transfer processing in a Jetton Wallet:

;; Jetton Wallet: handling transfer message
() recv_internal(int my_balance, int msg_value, cell in_msg_full, slice in_msg_body) impure {
    if (op == op::transfer()) {
        int query_id = in_msg_body~load_uint(64);
        int jetton_amount = in_msg_body~load_coins();
        slice to_owner_address = in_msg_body~load_msg_addr();
        slice response_address = in_msg_body~load_msg_addr();
        cell custom_payload = in_msg_body~load_maybe_ref();
        int forward_ton_amount = in_msg_body~load_coins();
        slice forward_payload = in_msg_body;
        
        throw_unless(error::not_enough_jettons, jetton_amount <= balance);
        balance -= jetton_amount;
        save_data();
        
        var msg_body = begin_cell()
            .store_uint(op::internal_transfer(), 32)
            .store_uint(query_id, 64)
            .store_coins(jetton_amount)
            .store_slice(my_address())
            .store_slice(response_address)
            .store_coins(forward_ton_amount)
            .store_slice(forward_payload)
            .end_cell();
        
        var to_wallet_address = calc_jetton_wallet_address(to_owner_address);
        
        send_raw_message(
            begin_cell()
                .store_uint(0x18, 6)
                .store_slice(to_wallet_address)
                .store_coins(forward_ton_amount + min_ton_for_storage)
                .store_uint(1, 107)
                .store_ref(msg_body)
            .end_cell(),
            64
        );
    }
}

The code above is the basis of a standard Jetton Wallet. Note the call to calc_jetton_wallet_address — the recipient's address is deterministically computed from the holder's address and wallet code.

Why Choose Tact Over FunC?

Tact is a high-level language that compiles to FunC. Its syntax is similar to TypeScript, significantly accelerating development. Tact is 5 times faster for creating Jetton tokens compared to FunC, especially for teams with EVM experience. Example contract in Tact:

import "@stdlib/deploy";
import "@stdlib/jetton";

contract JettonMaster with Deployable, Jetton {
    totalSupply: Int as coins;
    owner: Address;
    content: Cell;
    mintable: Bool;
    
    init(owner: Address, content: Cell) {
        self.totalSupply = 0;
        self.owner = owner;
        self.content = content;
        self.mintable = true;
    }
    
    receive(msg: TokenMint) {
        require(sender() == self.owner, "Not owner");
        require(self.mintable, "Not mintable");
        self.totalSupply += msg.amount;
        
        let winit: StateInit = self.getJettonWalletInit(msg.receiver);
        let walletAddress: Address = contractAddress(winit);
        
        send(SendParameters{
            to: walletAddress,
            value: ton("0.05"),
            mode: SendIgnoreErrors,
            bounce: false,
            body: TokenTransferInternal{
                queryId: 0,
                amount: msg.amount,
                from: myAddress(),
                responseAddress: msg.receiver,
                forwardTonAmount: 0,
                forwardPayload: emptySlice(),
            }.toCell(),
            code: winit.code,
            data: winit.data,
        });
    }
}

How We Ensure Jetton Token Security

Reentrancy is a major threat in TON's asynchronous environment. Unlike EVM, where state is locked until transaction end, in TON each call is a separate message. If the transfer handler does not check balance before and after operations, an attacker can initiate a reentrant call before state changes. In our projects, we use the "check-effects-interactions" pattern and add reentrancy protection via flags in wallet data. We also thoroughly test all scenarios using fuzzing: Echidna for FunC and built-in fuzzers in Blueprint.

Process: Stages

1. Analysis: Discuss token requirements (standard or custom), choose stack (Tact/FunC).
2. Design: Contract architecture, define mechanics (transfer tax, whitelist, vesting).
3. Implementation: Write Jetton Master and Jetton Wallet, unit tests via Blueprint sandbox.
4. Testing: Simulate all scenarios, check for reentrancy and gas optimization.
5. Deployment and verification: Deploy to mainnet, verify code on tonviewer.com, integrate with wallets.

Gas and Storage: TON Specifics

On TON, gas works differently than on EVM. Key differences:

• Storage fee — accounts pay rent for storing data. If the TON balance on a Jetton Wallet drops to zero, the account is frozen and data is lost. Recommended minimum deposit for a Jetton Wallet is 0.05 TON.
• Forward TON — when sending Jetton with forward_ton_amount > 0, the recipient contract receives a notification with attached TON. This is analogous to approve + transferFrom, but in TON style.
• Gas for a transfer transaction is about 0.001 TON, significantly cheaper than Ethereum at current prices.

Testing

The official Sandbox (Blueprint) framework allows testing contracts in TypeScript. Example test:

import { Blockchain, SandboxContract, TreasuryContract } from '@ton/sandbox';
import { JettonMaster } from '../wrappers/JettonMaster';
import { JettonWallet } from '../wrappers/JettonWallet';

describe('Jetton', () => {
    let blockchain: Blockchain;
    let deployer: SandboxContract<TreasuryContract>;
    let jettonMaster: SandboxContract<JettonMaster>;

    beforeEach(async () => {
        blockchain = await Blockchain.create();
        deployer = await blockchain.treasury('deployer');
        jettonMaster = blockchain.openContract(
            await JettonMaster.fromInit(deployer.address, buildMetadataCell())
        );
        await jettonMaster.send(deployer.getSender(), { value: toNano('0.1') }, {
            $$type: 'Deploy',
            queryId: 0n,
        });
    });

    it('should mint tokens', async () => {
        const receiver = await blockchain.treasury('receiver');
        const mintResult = await jettonMaster.send(
            deployer.getSender(),
            { value: toNano('0.2') },
            { $$type: 'TokenMint', queryId: 0n, amount: toNano('1000'), receiver: receiver.address }
        );
        expect(mintResult.transactions).toHaveTransaction({
            from: jettonMaster.address,
            deploy: true,
            success: true,
        });
        const walletAddress = await jettonMaster.getGetWalletAddress(receiver.address);
        const wallet = blockchain.openContract(JettonWallet.fromAddress(walletAddress));
        const data = await wallet.getGetWalletData();
        expect(data.balance).toBe(toNano('1000'));
    });
});

What's Included in the Work

Development of Jetton Master and Jetton Wallet in Tact (or FunC on request), testing via Blueprint sandbox, deployment to TON mainnet, verification through tonviewer.com, and TypeScript wrapper scripts for integration. Timelines: 5–10 days for a standard Jetton, 2–4 weeks for custom mechanics. Development cost savings when using Tact can reach 30% due to faster implementation.

We guarantee security and gas optimization. If you need a reliable Jetton token implementation with a security guarantee, contact us for a preliminary assessment. Get a consultation on Jetton tokens and evaluate the possibilities for your business.

Token Development: ERC-20, Tokenomics, Vesting

We’ve seen more rekt tokens than we can count — not because the code was broken, but because the economic assumptions were naive. A token that doesn’t collapse from inflation in six months, where governance actually works, and vesting can’t be bypassed through delegation tricks — that’s real engineering. We build under that standard.

How We Avoid Common ERC-20 Pitfalls

ERC-20 standard has nine functions. Complexity starts with extensions:

ERC-20Permit (EIP-2612) — gasless approve via signature. User signs permit(owner, spender, value, deadline, v, r, s) off-chain, spender calls permit() + transferFrom() in one transaction. Removes separate approve step. Risk: signature can be intercepted — need deadline and nonce checking. We always implement EIP-712 typed structured data to prevent signature malleability.

ERC-20Votes (EIP-5805) — snapshot balances for governance. Checkpoint system stores balance history by block number. getPastVotes(address, blockNumber) returns balance at proposal creation, not current. Prevents flash loan governance: can't borrow tokens and vote in one transaction.

Rebasing tokens (stETH, Ampleforth) — balanceOf changes automatically through internal shares ratio. High integration complexity: most DeFi protocols don't work correctly with rebasing without non-rebasing wrapper. We've deployed wrappers that decouple balance from share price for Uniswap compatibility.

Fee-on-transfer tokens — percentage cut on every transfer. Breaks AMM calculations: pool receives less than expected. Uniswap v2/v3 don't support natively — needs special pair/router. We’ve built custom routers that handle fee-on-transfer tokens without reverting.

Why Tokenomics Sustainability Matters More Than Excel

Tokenomics isn't Excel table summing to 100%. It's incentive model that either works long-term or creates selling pressure killing the project.

Emission Schedule and Inflation — Fixed supply (Bitcoin model) works for store-of-value, but for utility tokens you need controlled inflation. Inflationary model (like Ethereum post-Merge) generates new tokens to incentivize participants. Key balance: emission should be <= value captured by protocol. If protocol earns $100k/month but emission is $500k/month in market value — constant selling pressure inevitable. We model these scenarios using Python simulations with cadCAD for complex systems.

Supply Distribution — No universal formula. Principle: no single entity >33% voting power at launch. Otherwise governance is fiction.

What Are the Most Critical Vesting Contract Mistakes?

Linear vesting with cliff is standard for team and investors. cliff is the period after TGE with zero availability. After cliff: linear unlock until duration. Typical implementation errors we catch in audit:

• Revocable vesting without timelock — owner can revoke immediately. Solution: revocation through multisig + governance vote with 7-day delay.
• Cliff doesn't block governance rights — with ERC-20Votes, recipient can delegate voting power from day one even if tokens aren't unlocked. We explicitly separate voting power from claim logic.
• No emergency pause — if vesting contract vulnerability discovered, need ability to pause claims. Pausable + timelock on unpause.

We’ve seen a project where the cliff was set to 0 by mistake — team could dump immediately. Our fuzz tests catch such edge cases before deployment.

Why Is Liquidity Bootstrapping Crucial for Token Launch?

Launch mechanics are critical. Three main approaches:

• Balancer LBP — temporary pool with high initial token weight (90/10 project-token/USDC) that automatically decreases to 50/50 over days. Creates downward price pressure preventing bot buys at one price. After LBP liquidity moves to permanent pool.
• Fjord Foundry — specialized platform for LBP and fair launches. Less operational overhead than direct Balancer integration.
• Uniswap v3 with limited range — add liquidity in narrow range around initial price. High capital efficiency but requires active range management.
• TWAMM — mechanics for gradual large-order sales without slippage. Implemented in FraxSwap.

LBP is 3-5x better than standard AMM listing for price discovery; we’ve seen fair launches with 50% less initial dump compared to direct Uniswap listings.

Governance Tokens and Voting Mechanics

OpenZeppelin Governor is the standard. Modular: GovernorVotes for counting, GovernorTimelockControl for timelock execution, GovernorSettings for adjustable parameters. Quorum is minimum percentage of supply for voting validity. Compound set quorum at 400k COMP (4% supply). We set quorum dynamically based on historical participation to avoid apathy or whale capture.

Flash loan governance attack — attacker borrows tokens via flash loan, delegates to self, creates proposal or votes, returns tokens. ERC-20Votes with block-based snapshot completely blocks this: must have tokens at snapshot creation moment, not voting moment.

Delegation — small holders often don't vote. Liquid delegation (like Optimism) lets delegate voting power to addresses without transfer. Critical for protocols with many passive holders.

Token Development Stack

Contracts: Solidity 0.8.x, OpenZeppelin Contracts 5.x (ERC20, ERC20Permit, ERC20Votes, Governor, TimelockController, TokenVesting).
Tokenomics audit: Python models with emission/demand simulation, cadCAD for complex systems modeling.
Deployment and management: Foundry scripts, Gnosis Safe for treasury, OpenZeppelin Defender for automation.
Analytics: Dune Analytics for on-chain metrics, Token Terminal for protocol revenue.

What’s Included in the Work (Deliverables)

• Tokenomics model with stress tests (bear market, whale exit, governance capture)
• Contract development with Foundry fuzz tests (gas optimization, reentrancy tests, overflow checks)
• Audit summary and list of edge cases covered
• Deployment scripts with Gnosis Safe admin keys
• Documentation for future upgrades and maintenance
• 30-day post-launch monitoring support

Process

1. Tokenomics design — supply model, allocation, emission schedule, vesting. Stress-test scenarios.
2. Contract development — ERC-20 + extensions, vesting, governance. Foundry fuzz tests on vesting calculations, governance thresholds.
3. Audit — special attention on governance attack vectors, vesting bypass, permit replay attacks. We use Slither and Echidna for formal verification.
4. LBP / launch — choose mechanics, set parameters, monitor first 24 hours.
5. Post-launch — monitor supply distribution via Dune, governance participation metrics, treasury management.

Timelines

• ERC-20 with permit and basic governance: 2–3 weeks
• Vesting contract with revocation and cliff: 2–4 weeks
• Full governance (Governor + Timelock + Token): 4–7 weeks
• Token + LBP + governance + vesting: 8–14 weeks

We can estimate your project within 24 hours after discussing requirements. Contact us to start the conversation — no obligation, just a technical chat about your token model. Get a detailed proposal tailored to your tokenomics and compliance needs.