Search papers, labs, and topics across Lattice.
Because the Ethereum Virtual Machine does not validate emitted logs against actual execution state, the authors systematized five classes of event-semantic defects and built EventSpec to detect when smart contract logs diverge from on-chain reality. This tackles a dangerous blind spot in decentralized ecosystems, where off-chain indexers, bridges, and wallets implicitly trust unverified event emissions to confirm critical state transitions. Evaluated across 6,617 contracts, EventSpec detected event-semantic bugs with 90.17% precision, exposing viable exploit vectors across bridges, explorers, and marketplaces that led to four confirmed wallet vulnerabilities.
Because the EVM never validates emitted logs against actual execution state, off-chain bridges and wallets are systematically vulnerable to phantom transactions even when contract code passes traditional logic audits.
In recent years, smart contracts have become the backbone of decentralized applications (DApps), and off-chain systems such as bridges, wallets, and indexers rely heavily on event logs to track contract execution and state changes. However, the Ethereum Virtual Machine (EVM) does not validate or enforce event semantics, so logs can diverge from on-chain state, misleading off-chain systems into accepting incorrect state transitions. Existing smart contract vulnerability detection tools focus on logic bugs, with limited support for detecting event-semantic defects. To address this gap, we collect audit reports and incident cases and apply open card sorting to define five classes of event-semantic defects: event collision, state-event mismatch, unauthorized event emission, event emission mismatch, and event parameter mismatch. We propose EventSpec, which infers event specifications from a contract corpus via behavior inference and semantic-constraint extraction and applies differential checking to identify event-semantic defects in target contracts. We run EventSpec on 6,617 real-world contracts and evaluate detection effectiveness based on manually labeled results; EventSpec achieves an overall comprehensive precision of 90.17%. We further provide an off-chain evaluation harness that reproduces two off-chain attack vectors on any EVM-compatible chain: event origin confusion caused by unintended emitters and event-state desynchronization where events lack matching state updates. Using this harness, we demonstrate the feasibility of these attacks on bridge relayers, blockchain explorers, and NFT marketplaces, and report six wallet issues, four of which were confirmed (including a $600 bounty), with two remaining pending.
