Security Principles Flashcards
21 cards from real Blockchain Technology practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 20 Security Principles flashcards as text
A reentrancy attack on a smart contract is best mitigated by which design pattern?
Answer: Checks-effects-interactions pattern
Updating state before making external calls prevents an attacker's fallback from re-entering and draining funds.
Which Solidity construct provides reentrancy protection by locking a function during execution?
Answer: nonReentrant modifier with a mutex
A nonReentrant modifier uses a boolean mutex to block recursive calls into the same function.
Integer overflow vulnerabilities in older Solidity were commonly prevented using which library?
Answer: SafeMath
SafeMath wrapped arithmetic to revert on overflow before Solidity 0.8 made checks built-in.
From Solidity 0.8.0 onward, how is integer overflow handled by default?
Answer: Arithmetic reverts automatically on overflow/underflow
Solidity 0.8+ includes built-in overflow/underflow checks that revert the transaction.
A front-running attack exploits which property of public blockchains?
Answer: Pending transactions are visible in the mempool before mining
Attackers observe pending transactions in the mempool and submit their own with higher gas to execute first.
Which technique helps protect against front-running by hiding transaction intent until confirmation?
Answer: Commit-reveal scheme
Commit-reveal first submits a hashed commitment, then reveals the value later, hiding intent from front-runners.
Why is using tx.origin for authorization considered insecure?
Answer: A malicious intermediary contract can trick the original user into authorizing it
tx.origin returns the original sender, so a phishing contract can pass authorization checks on the victim's behalf.
What is the primary security purpose of a multisignature wallet?
Answer: Requiring multiple keys to approve a transaction
Multisig requires M-of-N signatures, removing single points of failure for key compromise.
A 51% attack on a Proof-of-Work blockchain allows an attacker to do what?
Answer: Double-spend by reorganizing the chain
Controlling majority hash power lets an attacker rewrite recent blocks and double-spend coins.
Which storage location should NEVER be used for secrets like passwords in a smart contract?
Answer: On-chain contract storage, since it is publicly readable
All on-chain storage is publicly visible even if marked private, so secrets must never be stored there.
What does the principle of least privilege recommend for smart contract roles?
Answer: Grant each account only the minimum permissions it needs
Limiting each role to the minimum required permissions reduces the blast radius of a compromise.
An unprotected delegatecall to an untrusted contract is dangerous because it can do what?
Answer: Execute foreign code in the caller's storage context
delegatecall runs the target's code against the caller's storage, letting malicious code overwrite state.
Why should a withdrawal pattern be preferred over pushing funds to users in a loop?
Answer: It avoids failures and DoS when one recipient reverts
Letting users pull funds prevents one failing transfer from blocking payouts to everyone else.
Hardcoding a privileged owner address with no transfer mechanism creates which risk?
Answer: Permanent loss of control if that key is lost or compromised
Without ownership transfer, a lost or stolen key cannot be replaced, freezing or endangering the contract.
Relying on block.timestamp for critical randomness is risky because miners can do what?
Answer: Manipulate the timestamp within a small range
Miners can slightly adjust block.timestamp, so it is not a safe source of randomness or precise timing.
Which oracle service provides verifiable on-chain randomness resistant to manipulation?
Answer: Chainlink VRF
Chainlink VRF produces cryptographically verifiable random numbers that cannot be tampered with by miners or operators.
An oracle manipulation attack on a DeFi protocol typically targets what?
Answer: The price feed used for collateral valuation
Attackers distort the price source to mis-value collateral and drain funds, often via flash loans.
Why are time-weighted average price (TWAP) oracles more resistant to flash loan attacks?
Answer: They average prices over time, resisting single-block manipulation
Averaging price over many blocks makes a one-block flash-loan distortion negligible.
A flash loan enables an attacker to do what within a single transaction?
Answer: Borrow large uncollateralized funds that must be repaid before the transaction ends
Flash loans provide large capital with no collateral as long as repayment happens atomically in the same transaction.
What is the main security benefit of using audited libraries like OpenZeppelin?
Answer: They reduce bugs by reusing community-reviewed, battle-tested code
Widely audited libraries lower the risk of introducing common vulnerabilities through well-vetted implementations.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy