Blockchain Developer Security Principles 3 — Questions and Answers
Question 1: What is the primary security purpose of a multisignature wallet?
- Requiring multiple keys to approve a transaction (Correct answer)
- Lowering gas fees
- Speeding up block confirmation
- Encrypting on-chain data
Correct answer: Requiring multiple keys to approve a transaction
Multisig requires M-of-N signatures, removing single points of failure for key compromise.
Question 2: A 51% attack on a Proof-of-Work blockchain allows an attacker to do what?
- Double-spend by reorganizing the chain (Correct answer)
- Steal private keys directly
- Change the total coin supply arbitrarily
- Read encrypted wallet seeds
Correct answer: Double-spend by reorganizing the chain
Controlling majority hash power lets an attacker rewrite recent blocks and double-spend coins.
Question 3: Which storage location should NEVER be used for secrets like passwords in a smart contract?
- On-chain contract storage, since it is publicly readable (Correct answer)
- A local variable
- An off-chain encrypted vault
- A hardware security module
Correct answer: On-chain contract storage, since it is publicly readable
All on-chain storage is publicly visible even if marked private, so secrets must never be stored there.
Question 4: What does the principle of least privilege recommend for smart contract roles?
- Grant each account only the minimum permissions it needs (Correct answer)
- Give all users admin rights
- Disable access control entirely
- Allow anyone to call upgrade functions
Correct answer: Grant each account only the minimum permissions it needs
Limiting each role to the minimum required permissions reduces the blast radius of a compromise.
Question 5: An unprotected delegatecall to an untrusted contract is dangerous because it can do what?
- Execute foreign code in the caller's storage context (Correct answer)
- Refund all gas to the attacker
- Permanently lock the blockchain
- Reveal validator private keys
Correct answer: Execute foreign code in the caller's storage context
delegatecall runs the target's code against the caller's storage, letting malicious code overwrite state.
Question 6: Why should a withdrawal pattern be preferred over pushing funds to users in a loop?
- It avoids failures and DoS when one recipient reverts (Correct answer)
- It uses more gas intentionally
- It hides transactions from the mempool
- It bypasses access control
Correct answer: It avoids failures and DoS when one recipient reverts
Letting users pull funds prevents one failing transfer from blocking payouts to everyone else.
Question 7: Hardcoding a privileged owner address with no transfer mechanism creates which risk?
- Permanent loss of control if that key is lost or compromised (Correct answer)
- Higher transaction throughput
- Automatic key rotation
- Reduced storage costs
Correct answer: Permanent loss of control if that key is lost or compromised
Without ownership transfer, a lost or stolen key cannot be replaced, freezing or endangering the contract.
Blockchain Developer Security Principles 3
What is the primary security purpose of a multisignature wallet?