EventSpec finds hidden event bugs that confuse blockchain tracking systems
EventSpec: Defining and Detecting Event-Semantic Issues in Blockchain Ecosystems
Cryptography and SecuritySoftware Engineering
Summary
Blockchain apps rely on special messages called events to keep things running smoothly, but these events aren't always checked for mistakes. The authors found five common types of errors in these event messages that can mislead systems tracking blockchain activities. They made a tool named EventSpec that learns rules from many contracts and spots when events don't match the real state of the blockchain. When tested on thousands of contracts, EventSpec was accurate and helped discover real issues in wallets and other blockchain tools that could be exploited.
smart contractsblockchainEthereum Virtual Machineevent logsdecentralized applicationsoff-chain systemsevent semanticsstate synchronizationvulnerability detectionbridge relayers
Authors
Yixuan Liu, Yuxin Dong, Ye Liu, Yin Wu, Chengxuan Zhang, Xiapu Luo, Yi Li
Abstract
In recent years, smart contracts have become the backbone of decentralized applications (DApps), and off-chain systems such as bridges, wallets, and indexers rely heavily on event logs to track contract execution and state changes. However, the Ethereum Virtual Machine (EVM) does not validate or enforce event semantics, so logs can diverge from on-chain state, misleading off-chain systems into accepting incorrect state transitions. Existing smart contract vulnerability detection tools focus on logic bugs, with limited support for detecting event-semantic defects. To address this gap, we collect audit reports and incident cases and apply open card sorting to define five classes of event-semantic defects: event collision, state-event mismatch, unauthorized event emission, event emission mismatch, and event parameter mismatch. We propose EventSpec, which infers event specifications from a contract corpus via behavior inference and semantic-constraint extraction and applies differential checking to identify event-semantic defects in target contracts. We run EventSpec on 6,617 real-world contracts and evaluate detection effectiveness based on manually labeled results; EventSpec achieves an overall comprehensive precision of 90.17%. We further provide an off-chain evaluation harness that reproduces two off-chain attack vectors on any EVM-compatible chain: event origin confusion caused by unintended emitters and event-state desynchronization where events lack matching state updates. Using this harness, we demonstrate the feasibility of these attacks on bridge relayers, blockchain explorers, and NFT marketplaces, and report six wallet issues, four of which were confirmed (including a $600 bounty), with two remaining pending.