Blockchain Developer Security and Vulnerabilities 2 — Questions and Answers
Question 1: A function transfers Ether to a user before updating their balance. What vulnerability does this introduce?
- Reentrancy (Correct answer)
- Integer overflow
- Front-running
- Timestamp dependence
Correct answer: Reentrancy
Sending Ether before updating state lets the recipient's fallback re-enter the function and drain funds.
Question 2: Which pattern is the recommended defense against reentrancy attacks?
- Checks-Effects-Interactions (Correct answer)
- Lazy initialization
- Proxy delegation
- Eager evaluation
Correct answer: Checks-Effects-Interactions
The Checks-Effects-Interactions pattern updates state before making external calls, preventing re-entry exploitation.
Question 3: In Solidity 0.8+, what happens by default when an arithmetic operation overflows?
- The transaction reverts (Correct answer)
- The value wraps around
- It returns zero
- It emits a warning
Correct answer: The transaction reverts
Solidity 0.8 and later include built-in overflow/underflow checks that revert on overflow.
Question 4: What is the main risk of using tx.origin for authorization?
- A malicious intermediate contract can impersonate the user (Correct answer)
- It costs more gas than msg.sender
- It cannot be read in view functions
- It only works for EOAs
Correct answer: A malicious intermediate contract can impersonate the user
tx.origin refers to the original sender, so a phishing contract called by the user passes the check.
Question 5: A lottery contract picks a winner using block.timestamp and blockhash. Why is this insecure?
- Miners/validators can manipulate these values (Correct answer)
- Timestamps are always zero on testnets
- Blockhash is unavailable in Solidity
- It uses too much storage
Correct answer: Miners/validators can manipulate these values
On-chain values like timestamp and blockhash can be influenced by block producers, making the randomness predictable or manipulable.
Question 6: What does the 'pull over push' payment pattern improve?
- Resilience to failed external transfers and DoS (Correct answer)
- Gas refunds on storage clearing
- Faster block confirmation
- Lower contract bytecode size
Correct answer: Resilience to failed external transfers and DoS
Letting users withdraw (pull) instead of the contract pushing payments avoids a single failing transfer blocking everyone.
Question 7: Which tool is commonly used for static analysis of Solidity contracts to detect vulnerabilities?
- Slither (Correct answer)
- Webpack
- Prettier
- Truffle migrate
Correct answer: Slither
Slither is a widely used static analysis framework that flags common Solidity security issues.
Blockchain Developer Security and Vulnerabilities 2
A function transfers Ether to a user before updating their balance.
What vulnerability does this introduce?