Lesson 3: The Pulse of the Blockchain (Smart Contracts, the EVM, and Event Logs)

In the last two lessons, we explored what Forta is and how Ethereum works beneath the surface. Today, we go one layer deeper: to the level where blockchain logic is born, executed, and echoed: the smart contract, the Ethereum Virtual Machine, and event logs.

This lesson is about learning how bots truly “see” the world.

What Is a Smart Contract?

A smart contract is an autonomous piece of code deployed on a blockchain. It sits there permanently, waiting for users or other contracts to call it. Once deployed, it can’t be changed, it only reacts.

Think of it like a vending machine: insert coins, press a button, get a snack. No human needed.

It contains:

• Functions (the buttons you press)

• Storage (what snacks are in the machine)

• Logic (what happens if you press Button A)

But unlike a vending machine, it can:

• Send and receive money (ETH, tokens)

• Interact with other contracts

• Emit events

Smart contracts are the programmable layer of the blockchain: the invisible government of decentralized applications.

What Is the EVM?

The Ethereum Virtual Machine (EVM) is the engine that runs smart contract code.

It’s like a little computer that processes one transaction at a time. It doesn’t know the future or remember the past, it just takes input, follows instructions, and updates the world state.

Here’s how it works:

• The EVM runs bytecode (compiled from Solidity)

• It uses a stack, memory, and storage

• Each operation (like ADD, SSTORE, LOG3) consumes gas

Think of it like a monk reading a scroll one line at a time. It doesn’t skip ahead or make assumptions. It does exactly what the scroll says, step by step, until the message is fully processed.

The gas cost of each step determines how much you pay to run the contract.

What Are Events?

Events are how smart contracts communicate with the outside world.

While contract storage changes are internal and invisible unless queried directly, events are publicly emitted and recorded in the blockchain logs.

Here’s an example from an ERC-20 token:

event Transfer(address indexed from, address indexed to, uint256 value);

This event is emitted whenever tokens are sent from one address to another.

It’s like the contract raising its hand and saying:

"Hey! Just so everyone knows, a transfer just happened!"

Events are crucial because:

• They are lightweight (don’t cost much gas)

• They are indexed — meaning bots can quickly filter them

• They are permanent — logged with the transaction

How Forta Bots Use Events

Forta agents are blind to the code of smart contracts. They only observe what happens on-chain, and one of the clearest signals they rely on are event logs.

Here’s what happens:

1. A user sends a transaction calling a smart contract.

2. The smart contract executes and emits an event.

3. That event is included in the transaction receipt.

4. Forta scan nodes capture the event and pass it to your agent.

5. Your agent parses the log and checks: is this something suspicious?

6. If yes, it emits an alert.

This is how your agent can, for example, detect:

• Transfers larger than a certain threshold

• Suspicious token approvals

• Fake token creations

• Protocol-specific events like liquidation, flash loans, or emergency withdrawals

Your agent is not watching the contract, it’s watching the footprints the contract leaves behind.

Example: Detecting Large Token Transfers

Let’s say you want to detect when someone sends more than 1,000,000 USDC.

You could write a bot that:

• Listens for Transfer() events from the USDC contract

• Decodes the value field

• Compares it to your threshold

• Emits an alert if it’s too large

A simple logic but a powerful result.

This is the core mechanic of most detection bots: observe, decode, check, alert.

Technical Terms Simplified

Forta Agent Logic (Simplified)

Here’s a very simple pseudocode structure of what your Forta bot will do with events:

function handleTransaction(txEvent) {
      for (const log of txEvent.logs) { 
         if (log.address === TARGET_CONTRACT && log.name === "Transfer") { 
      const value = log.args.value; 
         if (value > 1_000_000) { 
   return alert("Large transfer detected"); 
      } 
     } 
    } 
   }

This is the beginning of your skillset as a monitoring monk: learning to read the signals, track behaviors, and catch patterns before the damage is done.

Why This Lesson is important

As a Forta Administrator or detection engineer, your job is to:

• Understand how smart contracts work at the execution level

• Decode event logs accurately

• Use this data to build reactive security agents

Most attacks ( from rug pulls to governance exploits) leave event signatures. The sooner your bots detect them, the faster your team can act.

This lesson teaches you how to observe the blockchain’s heartbeat. Next, we’ll learn how to interact with Forta itself — and write our first detection bot.

Until next meditation,
The Blockchain Security Monk