Blockchain Developer Security and Vulnerabilities 2

Question 1

A function transfers Ether to a user before updating their balance. What vulnerability does this introduce?

Accepted Answer

Reentrancy

Answer

Sending Ether before updating state lets the recipient's fallback re-enter the function and drain funds.

Question 2

Which pattern is the recommended defense against reentrancy attacks?

Accepted Answer

Checks-Effects-Interactions

Answer

The Checks-Effects-Interactions pattern updates state before making external calls, preventing re-entry exploitation.

Question 3

In Solidity 0.8+, what happens by default when an arithmetic operation overflows?

Accepted Answer

The transaction reverts

Answer

Solidity 0.8 and later include built-in overflow/underflow checks that revert on overflow.

Question 4

What is the main risk of using tx.origin for authorization?

Accepted Answer

A malicious intermediate contract can impersonate the user

Answer

tx.origin refers to the original sender, so a phishing contract called by the user passes the check.

Question 5

A lottery contract picks a winner using block.timestamp and blockhash. Why is this insecure?

Accepted Answer

Miners/validators can manipulate these values

Answer

On-chain values like timestamp and blockhash can be influenced by block producers, making the randomness predictable or manipulable.

Blockchain Practice Test