EventSpec：定义与检测区块链生态系统中的事件语义问题
EventSpec: Defining and Detecting Event-Semantic Issues in Blockchain Ecosystems
- Nanyang Technological University（南洋理工大学）
- Peking University（北京大学）
- Beijing Institute of Technology（北京理工大学）
- Xi’an Jiaotong University（西安交通大学）
- Hong Kong Polytechnic University（香港理工大学）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
针对智能合约事件日志与链上状态不一致的问题，提出EventSpec方法，通过行为推断和差分检查检测五类事件语义缺陷，在6617个合约上达到90.17%精确率，并验证了链下攻击的可行性。
AI中文摘要：
近年来，智能合约已成为去中心化应用（DApps）的支柱，而桥接器、钱包和索引器等链下系统严重依赖事件日志来跟踪合约执行和状态变化。然而，以太坊虚拟机（EVM）并不验证或强制执行事件语义，因此日志可能与链上状态产生偏差，误导链下系统接受不正确的状态转换。现有的智能合约漏洞检测工具侧重于逻辑错误，对检测事件语义缺陷的支持有限。为弥补这一空白，我们收集了审计报告和事件案例，并应用开放式卡片分类法定义了五类事件语义缺陷：事件冲突、状态-事件不匹配、未授权事件发射、事件发射不匹配和事件参数不匹配。我们提出了EventSpec，它通过行为推断和语义约束提取从合约语料库中推断事件规范，并应用差分检查来识别目标合约中的事件语义缺陷。我们在6,617个真实世界合约上运行EventSpec，并基于人工标注结果评估检测有效性；EventSpec实现了90.17%的整体综合精确率。我们进一步提供了一个链下评估工具，可在任何兼容EVM的链上重现两种链下攻击向量：由非预期发射者引起的事件来源混淆，以及事件缺乏匹配状态更新的事件-状态失同步。利用该工具，我们证明了这些攻击在桥接中继器、区块链浏览器和NFT市场中的可行性，并报告了六个钱包问题，其中四个已确认（包括一个600美元的赏金），两个仍在等待处理。
英文摘要：
In recent years, smart contracts have become the backbone of decentralized applications (DApps), and off-chain systems such as bridges, wallets, and indexers rely heavily on event logs to track contract execution and state changes. However, the Ethereum Virtual Machine (EVM) does not validate or enforce event semantics, so logs can diverge from on-chain state, misleading off-chain systems into accepting incorrect state transitions. Existing smart contract vulnerability detection tools focus on logic bugs, with limited support for detecting event-semantic defects. To address this gap, we collect audit reports and incident cases and apply open card sorting to define five classes of event-semantic defects: event collision, state-event mismatch, unauthorized event emission, event emission mismatch, and event parameter mismatch. We propose EventSpec, which infers event specifications from a contract corpus via behavior inference and semantic-constraint extraction and applies differential checking to identify event-semantic defects in target contracts. We run EventSpec on 6,617 real-world contracts and evaluate detection effectiveness based on manually labeled results; EventSpec achieves an overall comprehensive precision of 90.17%. We further provide an off-chain evaluation harness that reproduces two off-chain attack vectors on any EVM-compatible chain: event origin confusion caused by unintended emitters and event-state desynchronization where events lack matching state updates. Using this harness, we demonstrate the feasibility of these attacks on bridge relayers, blockchain explorers, and NFT marketplaces, and report six wallet issues, four of which were confirmed (including a $600 bounty), with two remaining pending.
