OpenCyber Academy
Bachelor's · Chapter 25 · English
Course code: OCA-101Chapter 25: OCA-101-C025

Chapter 25 — Laboratory I

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 Why replay events"]
  N2["Lab — Event replay against a snapshot"]
  N3["25.2 Reading the result"]
  N4["25.3 Investigating calmly"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 Why replay events"]
  N2["Lab — Event replay against a snapshot"]
  N3["25.2 Reading the result"]
  N4["25.3 Investigating calmly"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX073"]
[Learning outcomes]
    |
    v
[25.1 Why replay events]
    |
    v
[Lab — Event replay against a snapshot]
    |
    v
[25.2 Reading the result]
    |
    v
[25.3 Investigating calmly]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) replay ledger events to compute balances; (2) compare replayed state with a snapshot; (3) investigate mismatches calmly.

25.1 Why replay events

Every voucher transfer emits an event recording sender, receiver and amount. Issuance uses a zero sender, and redemption uses a zero receiver. By replaying all events in order, Sofia can compute what every balance should be, independently of the contract's own stored balances. Comparing the two is a strong check: if they differ, either an event was missed, the snapshot is stale, or something unexpected happened. This lab uses six synthetic events and a snapshot of four members. It is read-only and uses only Python's standard library, so it can run safely on any computer.

Lab — Event replay against a snapshot

"""Replay synthetic Transfer events and compare with a balance snapshot (read-only)."""
# (from, to, amount); "0x0" as sender means issuance, as receiver means redemption
EVENTS = [
    ("0x0", "m01", 50), ("0x0", "m02", 30), ("m01", "m03", 20),
    ("m02", "0x0", 10), ("0x0", "m04", 40), ("m03", "m04", 5),
]
SNAPSHOT = {"m01": 30, "m02": 20, "m03": 15, "m04": 50}

def main():
    bal = {}
    for f, t, a in EVENTS:
        if f != "0x0":
            bal[f] = bal.get(f, 0) - a
        if t != "0x0":
            bal[t] = bal.get(t, 0) + a
    diff = [m for m in sorted(SNAPSHOT) if SNAPSHOT[m] != bal.get(m, 0)]
    print(f"events {len(EVENTS)}; replayed supply {sum(bal.values())}; snapshot supply {sum(SNAPSHOT.values())}")
    for m in diff:
        print(f"mismatch {m}: replay {bal.get(m, 0)} snapshot {SNAPSHOT[m]}")

if __name__ == "__main__":
    main()

Run with python3 lab_events.py. Verified output:

events 6; replayed supply 110; snapshot supply 115
mismatch m04: replay 45 snapshot 50

25.2 Reading the result

The lab replays six events and computes a supply of 110 vouchers, while the snapshot shows 115. One member differs: m04, with 45 in the replay and 50 in the snapshot. The other three members match exactly. Sofia does not assume wrongdoing. She lists possible explanations: a missed issuance event in her extract, a snapshot taken after a later event, or an issuance that bypassed events. She checks the extract's block range first, because the simplest explanation is usually a data-collection gap. In this synthetic case, the extract ended one block early, missing a valid issuance.

25.3 Investigating calmly

Sofia records the mismatch, the explanations considered, the checks made and the conclusion. She updates the extraction procedure so the block range is always recorded and compared with the snapshot's block. Dr Asante praises the calm approach: mismatches are signals to investigate, not proof of an incident. Jumping to conclusions can cause unnecessary alarm or wrongly blame someone. Equally, ignoring mismatches can let a real problem grow. A clear, recorded investigation is the right response, and she shares the improved procedure with the other volunteers so the same gap does not recur.

Worked example

The lab replays six events to a supply of 110 against a snapshot of 115, isolating m04 (45 versus 50), traced to an extract ending one block early.

Synthetic case. The events, snapshot and investigation are synthetic.

Errors and limits

Comparing data from different block ranges creates mismatches that are artefacts, not incidents.

Exercises

Synthesis

Event replay gives an independent check, and calm investigation explains its differences.

Continue studying — chapter 25 of 40

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →

Worked answers

EX073. Issuance of new vouchers.

EX074. 110 from the replay and 115 in the snapshot.

EX075. The extract ended one block early, missing a valid issuance.