Blockchain Developer Security and Vulnerabilities — Questions and Answers

Question 1: A function transfers Ether to a user before updating their balance. What vulnerability does this introduce?

Reentrancy (Correct answer)
Integer overflow
Front-running
Timestamp dependence

Correct answer: Reentrancy

Sending Ether before updating state lets the recipient's fallback re-enter the function and drain funds.

Question 2: Which pattern is the recommended defense against reentrancy attacks?

Checks-Effects-Interactions (Correct answer)
Lazy initialization
Proxy delegation
Eager evaluation

Correct answer: Checks-Effects-Interactions

The Checks-Effects-Interactions pattern updates state before making external calls, preventing re-entry exploitation.

Question 3: In Solidity 0.8+, what happens by default when an arithmetic operation overflows?

The transaction reverts (Correct answer)
The value wraps around
It returns zero
It emits a warning

Correct answer: The transaction reverts

Solidity 0.8 and later include built-in overflow/underflow checks that revert on overflow.

Question 4: What is the main risk of using tx.origin for authorization?

A malicious intermediate contract can impersonate the user (Correct answer)
It costs more gas than msg.sender
It cannot be read in view functions
It only works for EOAs

Correct answer: A malicious intermediate contract can impersonate the user

tx.origin refers to the original sender, so a phishing contract called by the user passes the check.

Question 5: A lottery contract picks a winner using block.timestamp and blockhash. Why is this insecure?

Miners/validators can manipulate these values (Correct answer)
Timestamps are always zero on testnets
Blockhash is unavailable in Solidity
It uses too much storage

Correct answer: Miners/validators can manipulate these values

On-chain values like timestamp and blockhash can be influenced by block producers, making the randomness predictable or manipulable.

Question 6: What does the 'pull over push' payment pattern improve?

Resilience to failed external transfers and DoS (Correct answer)
Gas refunds on storage clearing
Faster block confirmation
Lower contract bytecode size

Correct answer: Resilience to failed external transfers and DoS

Letting users withdraw (pull) instead of the contract pushing payments avoids a single failing transfer blocking everyone.

Question 7: Which tool is commonly used for static analysis of Solidity contracts to detect vulnerabilities?

Slither (Correct answer)
Webpack
Prettier
Truffle migrate

Correct answer: Slither

Slither is a widely used static analysis framework that flags common Solidity security issues.

Question 8: What is a front-running attack in the context of a public mempool?

An attacker observes a pending transaction and submits their own with higher gas to execute first (Correct answer)
An attacker reverses finalized blocks
An attacker forges a digital signature
An attacker overflows a counter

Correct answer: An attacker observes a pending transaction and submits their own with higher gas to execute first

Because pending transactions are visible, attackers can pay more gas to be ordered ahead and profit from the victim's intended action.

Question 9: A commit-reveal scheme is primarily used to mitigate which problem?

Front-running of submitted values (Correct answer)
Integer underflow
Reentrancy
Unbounded gas loops

Correct answer: Front-running of submitted values

Committing a hash first and revealing later hides the value during the vulnerable ordering window.

Question 10: Why is using a single DEX spot price as a price oracle dangerous?

It can be manipulated with flash loans (Correct answer)
It always returns stale data
It cannot be read on-chain
It requires off-chain signatures

Correct answer: It can be manipulated with flash loans

An attacker can use a flash loan to skew the pool's spot price within a single transaction and exploit dependent contracts.

Question 11: What does a flash loan allow an attacker to do?

Borrow large amounts with no collateral if repaid in the same transaction (Correct answer)
Permanently mint new tokens
Bypass signature verification
Delete arbitrary storage slots

Correct answer: Borrow large amounts with no collateral if repaid in the same transaction

Flash loans provide uncollateralized capital that must be repaid within the same transaction, enabling large temporary capital for exploits.

Question 12: Which access-control mistake leaves an initialization function exploitable in upgradeable contracts?

Forgetting to protect or disable the initializer so anyone can call it (Correct answer)
Using immutable variables
Marking it as view
Returning a boolean

Correct answer: Forgetting to protect or disable the initializer so anyone can call it

An unprotected initializer can be called by an attacker to seize ownership of the proxy.

Question 13: What is the security concern with delegatecall to an untrusted contract?

The callee executes in the caller's storage context and can overwrite its state (Correct answer)
It always reverts
It bypasses gas limits
It cannot transfer Ether

Correct answer: The callee executes in the caller's storage context and can overwrite its state

delegatecall runs target code against the caller's storage, so malicious code can corrupt or hijack the calling contract.

Question 14: A contract uses an unbounded loop over a dynamically growing array. What risk does this create?

The function may exceed the block gas limit and become unusable (Correct answer)
It causes integer overflow
It breaks signature recovery
It corrupts the mempool

Correct answer: The function may exceed the block gas limit and become unusable

As the array grows, iterating over it can require more gas than a block allows, permanently locking the function (a DoS).

Question 15: What is the purpose of a reentrancy guard (nonReentrant modifier)?

It locks the function during execution to prevent nested calls (Correct answer)
It compresses calldata
It caches storage reads
It validates signatures

Correct answer: It locks the function during execution to prevent nested calls

A mutex-style lock set at entry and cleared at exit blocks recursive re-entry into the protected function.

Question 16: Why should the return value of a low-level .call be checked?

It does not revert on failure; the success boolean must be verified (Correct answer)
It always returns the gas used
It encrypts the payload
It locks the contract

Correct answer: It does not revert on failure; the success boolean must be verified

Low-level call returns a success boolean instead of reverting, so unchecked failures can be silently ignored.

Question 17: What is a signature replay attack?

Reusing a valid signature in a context where it should only be used once (Correct answer)
Forging a private key
Overflowing a nonce counter
Reordering blocks

Correct answer: Reusing a valid signature in a context where it should only be used once

Without a nonce or domain separator, a valid signature can be replayed on the same or another contract/chain.

Question 18: Which EIP standard defines structured, domain-separated data hashing to prevent cross-contract signature replay?

EIP-712 (Correct answer)
EIP-20
EIP-1559
EIP-721

Correct answer: EIP-712

EIP-712 specifies typed structured data signing with a domain separator that binds signatures to a specific contract and chain.

Question 19: What is the danger of leaving 'private' data in contract storage?

Private only restricts Solidity access, not on-chain readability (Correct answer)
It increases gas costs to infinity
It prevents the contract from deploying
It disables events

Correct answer: Private only restricts Solidity access, not on-chain readability

The private keyword only blocks other contracts/inheritance from reading it in code; all storage is publicly readable on-chain.

Question 20: A withdraw function uses transfer() to send Ether. Why might this break for smart-contract recipients after gas repricing?

transfer forwards only 2300 gas, which may be insufficient for the recipient (Correct answer)
transfer disables reentrancy guards
transfer reverts on EOAs
transfer ignores the value parameter

Correct answer: transfer forwards only 2300 gas, which may be insufficient for the recipient

The fixed 2300 gas stipend of transfer can fail when receiving contracts need more gas, so call with checks is now preferred.

Question 21: What does a 'griefing' attack typically aim to achieve?

Disrupt or block normal operation without direct financial gain (Correct answer)
Steal private keys
Mint unlimited tokens
Decrypt traffic

Correct answer: Disrupt or block normal operation without direct financial gain

Griefing seeks to deny service or waste resources for others, even when the attacker gains nothing financially.

Blockchain Developer Security and Vulnerabilities

A function transfers Ether to a user before updating their balance.
What vulnerability does this introduce?

🃏 Study This Quiz as Flashcards →

📚 Want to go deeper? Read the Full Exam Study Guide →

What Practice Test Geeks adds beyond an AI chat for Blockchain

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length Blockchain mock exam — 100 questions in 90 minutes with a 60% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed Blockchain question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable Blockchain cheat sheet you can print or save as a PDF.
Blockchain flashcards built from the same question bank.

Start the Timed Blockchain Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy