Chapter 19 — Web3, blockchain and cryptoasset security: monitoring
Lesson map
Lesson 19 published. Map, example, EX055.
flowchart TD
N0["Learning outcomes"]
N1["19.1 What to monitor"]
N2["Lab — Privileged event matching"]
N3["19.2 Interpreting the result"]
N4["19.3 Escalating unmatched events"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX055"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["19.1 What to monitor"]
N2["Lab — Privileged event matching"]
N3["19.2 Interpreting the result"]
N4["19.3 Escalating unmatched events"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX055"]
[Learning outcomes]
|
v
[19.1 What to monitor]
|
v
[Lab — Privileged event matching]
|
v
[19.2 Interpreting the result]
|
v
[19.3 Escalating unmatched events]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX055]
Learning outcomes
You will (1) monitor privileged ledger events; (2) match events to approved changes; (3) escalate unmatched events.
19.1 What to monitor
Privileged events show changes to the system's rules: roles granted or revoked, pauses, cap changes and contract upgrades. Each should correspond to an approved change ticket or incident record. Lucas writes a read-only script that reads these events and checks each against a list of approved references. Unmatched events are not automatically wrong, but they must be explained. Monitoring privileged events is one of the highest-value checks for a token system, because these actions can change who controls credits or how the contract behaves for everyone.
Lab — Privileged event matching
"""Match privileged ledger events to approved change tickets (synthetic, read-only)."""
EVENTS = [
("blk 5021", "RoleGranted", "minter", "CHG-104"),
("blk 5390", "Paused", "-", "INC-007"),
("blk 5391", "Unpaused", "-", "INC-007"),
("blk 6012", "RoleGranted", "admin", None),
("blk 6450", "CapChanged", "200->250", "CHG-111"),
("blk 6702", "Upgraded", "v1.3", "CHG-115"),
]
APPROVED = {"CHG-104", "INC-007", "CHG-111"}
def main():
unmatched = [e for e in EVENTS if e[3] not in APPROVED]
print(f"privileged events {len(EVENTS)}; unmatched {len(unmatched)}")
for blk, kind, detail, ref in unmatched:
print(f" {blk} {kind} {detail} ref={ref}")
if __name__ == "__main__":
main()
Run with python3 lab_privlog.py. Verified output:
privileged events 6; unmatched 2
blk 6012 RoleGranted admin ref=None
blk 6702 Upgraded v1.3 ref=CHG-115
19.2 Interpreting the result
The lab reads six privileged events and finds two unmatched. At block 6012 an admin role was granted with no ticket reference at all. At block 6702 the contract was upgraded to version 1.3 citing ticket CHG-115, which is not in the approved list. The other four events match approved tickets or an incident. Lucas does not assume misuse. He checks the change system: CHG-115 was approved late in the day and the export he used was taken before approval. The admin grant, however, has no ticket at all and needs urgent explanation.
19.3 Escalating unmatched events
Following the runbook, Lucas escalates the unmatched admin grant to the manager within the hour, with the block number and evidence. The manager confirms the developer granted a temporary admin role during testing on the wrong network and forgot to remove it. The role is revoked through the timelocked process, a ticket is raised retrospectively and the developer's deployment checklist gains a network confirmation step. For CHG-115, Lucas changes the export to run after the daily approval window closes, removing the timing gap that caused the false alarm.
Worked example
The lab finds two unmatched events of six; CHG-115 is a timing gap in the export, while the ticketless admin grant is escalated and revoked.
Synthetic case. The events, tickets and response are synthetic.
Errors and limits
Ignoring an unmatched privileged event can leave unexpected control in place.
Exercises
- EX055 — Event count. How many privileged events does the lab read? Rubric: 3 = six;; 2 = 6;; 1 = two;; 0 = none.
- EX056 — Ticketless event. Which event had no ticket at all? Rubric: 3 = admin role grant at block 6012;; 2 = admin grant;; 1 = upgrade;; 0 = none.
- EX057 — CHG-115 explanation. Why was CHG-115 unmatched? Rubric: 3 = the export was taken before approval;; 2 = timing;; 1 = fraud;; 0 = none.
Synthesis
Matching privileged events to approvals and escalating gaps keeps control visible.
Continue studying — chapter 19 of 30
← Chapter 18 (draft) · Course chapter index · Chapter 20 (draft) →