Blockchain Developer FREE Blockchain Developer Blockchain Security and Vulnerabilities Questions and Answers 2 — Questions and Answers
Question 1: What is a flash loan attack in DeFi?
- Exploiting uncollateralized loans within a single transaction to manipulate protocol state (Correct answer)
- Stealing private keys from a lending protocol
- Draining funds by sending multiple small transactions rapidly
- Attacking the consensus layer of a blockchain network
Correct answer: Exploiting uncollateralized loans within a single transaction to manipulate protocol state
Flash loan attacks exploit the ability to borrow large amounts without collateral within one transaction, using the funds to manipulate prices or exploit vulnerable smart contracts before repaying.
Question 2: Which vulnerability does the Checks-Effects-Interactions pattern specifically prevent?
- Integer overflow
- Reentrancy attacks (Correct answer)
- Front-running
- Denial of service
Correct answer: Reentrancy attacks
The Checks-Effects-Interactions pattern prevents reentrancy by updating contract state before making external calls, so re-entrant calls see the already-updated state.
Question 3: What is transaction front-running on a blockchain?
- Submitting a transaction with higher gas to execute before a pending target transaction (Correct answer)
- Reversing a confirmed transaction by forking the chain
- Injecting malicious code into a pending transaction
- Sending duplicate transactions to congest the mempool
Correct answer: Submitting a transaction with higher gas to execute before a pending target transaction
Front-running involves observing a pending transaction in the mempool and submitting a competing transaction with higher gas fees to get it mined first.
Question 4: What is the primary risk of using tx.origin for authentication in Solidity?
- It returns the zero address for contract calls
- It can be spoofed by any externally owned account
- A malicious intermediate contract can pass the tx.origin check of the original sender (Correct answer)
- It consumes significantly more gas than msg.sender
Correct answer: A malicious intermediate contract can pass the tx.origin check of the original sender
Using tx.origin for auth is dangerous because if a user interacts with a malicious contract, that contract can call the target contract and tx.origin will still be the user's address.
Question 5: Which attack vector targets the random number generation in smart contracts that use block variables?
- Sybil attack
- Block timestamp manipulation by miners (Correct answer)
- Replay attack
- Eclipse attack
Correct answer: Block timestamp manipulation by miners
Miners can influence block timestamps and other block variables within certain bounds, making on-chain randomness based on these values predictable and exploitable.
Question 6: What does a sandwich attack in DeFi involve?
- Placing transactions both before and after a victim's swap to profit from the price impact (Correct answer)
- Wrapping a malicious token inside a legitimate token contract
- Layering multiple flash loans across different protocols
- Exploiting two different DEXs simultaneously for arbitrage
Correct answer: Placing transactions both before and after a victim's swap to profit from the price impact
A sandwich attack places a buy order before and a sell order after a victim's large swap, profiting from the predictable price movement caused by the victim's trade.
Blockchain Developer FREE Blockchain Developer Blockchain Security and Vulnerabilities Questions and Answers 2
What is a flash loan attack in DeFi?