Blockchain Developer Security Principles — Questions and Answers

Question 1: A reentrancy attack on a smart contract is best mitigated by which design pattern?

Checks-effects-interactions pattern (Correct answer)
Storing all state in memory
Using delegatecall for transfers
Increasing the gas limit

Correct answer: Checks-effects-interactions pattern

Updating state before making external calls prevents an attacker's fallback from re-entering and draining funds.

Question 2: Which Solidity construct provides reentrancy protection by locking a function during execution?

nonReentrant modifier with a mutex (Correct answer)
pure modifier
view modifier
payable modifier

Correct answer: nonReentrant modifier with a mutex

A nonReentrant modifier uses a boolean mutex to block recursive calls into the same function.

Question 3: Integer overflow vulnerabilities in older Solidity were commonly prevented using which library?

SafeMath (Correct answer)
OpenZeppelin Ownable
Chainlink VRF
ERC20Detailed

Correct answer: SafeMath

SafeMath wrapped arithmetic to revert on overflow before Solidity 0.8 made checks built-in.

Question 4: From Solidity 0.8.0 onward, how is integer overflow handled by default?

Arithmetic reverts automatically on overflow/underflow (Correct answer)
Values silently wrap around
Compilation fails
Gas is refunded

Correct answer: Arithmetic reverts automatically on overflow/underflow

Solidity 0.8+ includes built-in overflow/underflow checks that revert the transaction.

Question 5: A front-running attack exploits which property of public blockchains?

Pending transactions are visible in the mempool before mining (Correct answer)
Blocks are immutable once finalized
Private keys are reused
Gas prices are fixed

Correct answer: Pending transactions are visible in the mempool before mining

Attackers observe pending transactions in the mempool and submit their own with higher gas to execute first.

Question 6: Which technique helps protect against front-running by hiding transaction intent until confirmation?

Commit-reveal scheme (Correct answer)
Increasing block size
Disabling events
Using tx.origin

Correct answer: Commit-reveal scheme

Commit-reveal first submits a hashed commitment, then reveals the value later, hiding intent from front-runners.

Question 7: Why is using tx.origin for authorization considered insecure?

A malicious intermediary contract can trick the original user into authorizing it (Correct answer)
It costs too much gas
It cannot be read in Solidity
It only works on testnets

Correct answer: A malicious intermediary contract can trick the original user into authorizing it

tx.origin returns the original sender, so a phishing contract can pass authorization checks on the victim's behalf.

Question 8: What is the primary security purpose of a multisignature wallet?

Requiring multiple keys to approve a transaction (Correct answer)
Lowering gas fees
Speeding up block confirmation
Encrypting on-chain data

Correct answer: Requiring multiple keys to approve a transaction

Multisig requires M-of-N signatures, removing single points of failure for key compromise.

Question 9: A 51% attack on a Proof-of-Work blockchain allows an attacker to do what?

Double-spend by reorganizing the chain (Correct answer)
Steal private keys directly
Change the total coin supply arbitrarily
Read encrypted wallet seeds

Correct answer: Double-spend by reorganizing the chain

Controlling majority hash power lets an attacker rewrite recent blocks and double-spend coins.

Question 10: Which storage location should NEVER be used for secrets like passwords in a smart contract?

On-chain contract storage, since it is publicly readable (Correct answer)
A local variable
An off-chain encrypted vault
A hardware security module

Correct answer: On-chain contract storage, since it is publicly readable

All on-chain storage is publicly visible even if marked private, so secrets must never be stored there.

Question 11: What does the principle of least privilege recommend for smart contract roles?

Grant each account only the minimum permissions it needs (Correct answer)
Give all users admin rights
Disable access control entirely
Allow anyone to call upgrade functions

Correct answer: Grant each account only the minimum permissions it needs

Limiting each role to the minimum required permissions reduces the blast radius of a compromise.

Question 12: An unprotected delegatecall to an untrusted contract is dangerous because it can do what?

Execute foreign code in the caller's storage context (Correct answer)
Refund all gas to the attacker
Permanently lock the blockchain
Reveal validator private keys

Correct answer: Execute foreign code in the caller's storage context

delegatecall runs the target's code against the caller's storage, letting malicious code overwrite state.

Question 13: Why should a withdrawal pattern be preferred over pushing funds to users in a loop?

It avoids failures and DoS when one recipient reverts (Correct answer)
It uses more gas intentionally
It hides transactions from the mempool
It bypasses access control

Correct answer: It avoids failures and DoS when one recipient reverts

Letting users pull funds prevents one failing transfer from blocking payouts to everyone else.

Question 14: Hardcoding a privileged owner address with no transfer mechanism creates which risk?

Permanent loss of control if that key is lost or compromised (Correct answer)
Higher transaction throughput
Automatic key rotation
Reduced storage costs

Correct answer: Permanent loss of control if that key is lost or compromised

Without ownership transfer, a lost or stolen key cannot be replaced, freezing or endangering the contract.

Question 15: Relying on block.timestamp for critical randomness is risky because miners can do what?

Manipulate the timestamp within a small range (Correct answer)
Read it off-chain only
Encrypt it from contracts
Reset it to zero

Correct answer: Manipulate the timestamp within a small range

Miners can slightly adjust block.timestamp, so it is not a safe source of randomness or precise timing.

Question 16: Which oracle service provides verifiable on-chain randomness resistant to manipulation?

Chainlink VRF (Correct answer)
block.number
keccak256 of timestamp
msg.value

Correct answer: Chainlink VRF

Chainlink VRF produces cryptographically verifiable random numbers that cannot be tampered with by miners or operators.

Question 17: An oracle manipulation attack on a DeFi protocol typically targets what?

The price feed used for collateral valuation (Correct answer)
The contract's bytecode size
The validator set
The gas price oracle only

Correct answer: The price feed used for collateral valuation

Attackers distort the price source to mis-value collateral and drain funds, often via flash loans.

Question 18: Why are time-weighted average price (TWAP) oracles more resistant to flash loan attacks?

They average prices over time, resisting single-block manipulation (Correct answer)
They ignore on-chain data
They require no gas
They use a single spot price

Correct answer: They average prices over time, resisting single-block manipulation

Averaging price over many blocks makes a one-block flash-loan distortion negligible.

Question 19: A flash loan enables an attacker to do what within a single transaction?

Borrow large uncollateralized funds that must be repaid before the transaction ends (Correct answer)
Permanently mint new tokens
Bypass private key signing
Halt block production

Correct answer: Borrow large uncollateralized funds that must be repaid before the transaction ends

Flash loans provide large capital with no collateral as long as repayment happens atomically in the same transaction.

Question 20: What is the main security benefit of using audited libraries like OpenZeppelin?

They reduce bugs by reusing community-reviewed, battle-tested code (Correct answer)
They eliminate all gas costs
They guarantee immunity from every attack
They prevent users from reading the contract

Correct answer: They reduce bugs by reusing community-reviewed, battle-tested code

Widely audited libraries lower the risk of introducing common vulnerabilities through well-vetted implementations.

Question 21: Why should external calls' return values always be checked?

A low-level call can fail silently without reverting (Correct answer)
Return values cost extra gas
It is required by the EVM compiler
It encrypts the call data

Correct answer: A low-level call can fail silently without reverting

Low-level calls return a success boolean instead of reverting, so unchecked failures can corrupt logic.

Blockchain Developer Security Principles

A reentrancy attack on a smart contract is best mitigated by which design pattern?

🃏 Study This Quiz as Flashcards →

📚 Want to go deeper? Read the Full Exam Study Guide →

What Practice Test Geeks adds beyond an AI chat for Blockchain

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length Blockchain mock exam — 100 questions in 90 minutes with a 60% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed Blockchain question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable Blockchain cheat sheet you can print or save as a PDF.
Blockchain flashcards built from the same question bank.

Start the Timed Blockchain Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy