Blockchain Developer Security and Vulnerabilities 3 — Questions and Answers
Question 1: What is a front-running attack in the context of a public mempool?
- An attacker observes a pending transaction and submits their own with higher gas to execute first (Correct answer)
- An attacker reverses finalized blocks
- An attacker forges a digital signature
- An attacker overflows a counter
Correct answer: An attacker observes a pending transaction and submits their own with higher gas to execute first
Because pending transactions are visible, attackers can pay more gas to be ordered ahead and profit from the victim's intended action.
Question 2: A commit-reveal scheme is primarily used to mitigate which problem?
- Front-running of submitted values (Correct answer)
- Integer underflow
- Reentrancy
- Unbounded gas loops
Correct answer: Front-running of submitted values
Committing a hash first and revealing later hides the value during the vulnerable ordering window.
Question 3: Why is using a single DEX spot price as a price oracle dangerous?
- It can be manipulated with flash loans (Correct answer)
- It always returns stale data
- It cannot be read on-chain
- It requires off-chain signatures
Correct answer: It can be manipulated with flash loans
An attacker can use a flash loan to skew the pool's spot price within a single transaction and exploit dependent contracts.
Question 4: What does a flash loan allow an attacker to do?
- Borrow large amounts with no collateral if repaid in the same transaction (Correct answer)
- Permanently mint new tokens
- Bypass signature verification
- Delete arbitrary storage slots
Correct answer: Borrow large amounts with no collateral if repaid in the same transaction
Flash loans provide uncollateralized capital that must be repaid within the same transaction, enabling large temporary capital for exploits.
Question 5: Which access-control mistake leaves an initialization function exploitable in upgradeable contracts?
- Forgetting to protect or disable the initializer so anyone can call it (Correct answer)
- Using immutable variables
- Marking it as view
- Returning a boolean
Correct answer: Forgetting to protect or disable the initializer so anyone can call it
An unprotected initializer can be called by an attacker to seize ownership of the proxy.
Question 6: What is the security concern with delegatecall to an untrusted contract?
- The callee executes in the caller's storage context and can overwrite its state (Correct answer)
- It always reverts
- It bypasses gas limits
- It cannot transfer Ether
Correct answer: The callee executes in the caller's storage context and can overwrite its state
delegatecall runs target code against the caller's storage, so malicious code can corrupt or hijack the calling contract.
Question 7: A contract uses an unbounded loop over a dynamically growing array. What risk does this create?
- The function may exceed the block gas limit and become unusable (Correct answer)
- It causes integer overflow
- It breaks signature recovery
- It corrupts the mempool
Correct answer: The function may exceed the block gas limit and become unusable
As the array grows, iterating over it can require more gas than a block allows, permanently locking the function (a DoS).
Blockchain Developer Security and Vulnerabilities 3
What is a front-running attack in the context of a public mempool?