Blockchain Security Training Smart Contract Exploit Analysis Questions and Answers

Question 1

A smart contract function intended for distributing rewards iterates through a dynamically-sized array of recipient addresses, sending funds to each one.
As the number of recipients grows, transactions calling this function begin to consistently fail.
What is the MOST likely cause of this failure?

Accepted Answer

The transaction's cumulative gas cost exceeds the block gas limit.

Answer

A reentrancy vulnerability in the fund transfer logic.

Answer

An integer underflow when calculating the remaining contract balance.

Answer

Incorrect access control allowing non-recipients to be added to the array.

Question 2

An analyst is reviewing a Solidity contract that handles token withdrawals. The function first sends the requested token amount to the user and then updates the user's balance in a mapping. Which classic smart contract vulnerability is this pattern susceptible to?

Accepted Answer

Reentrancy

Answer

Integer Overflow

Answer

Front-running

Answer

Timestamp Dependence

Question 3

A malicious user observes a large pending decentralized exchange (DEX) trade in the mempool that will significantly increase a token's price. The user quickly submits their own 'buy' transaction for the same token with a much higher gas fee, followed immediately by a 'sell' transaction. Which type of exploit is this user attempting?

Accepted Answer

A front-running attack

Answer

A flash loan attack

Answer

An access control bypass

Answer

A reentrancy attack

Question 4

A smart contract written in a very old version of Solidity (pre-0.8.0) allows users to transfer tokens. A user with a balance of 10 tokens attempts to transfer 20 tokens. The contract code subtracts the transfer amount from the sender's balance without any safety checks. What is the likely outcome for the sender's balance after the transaction?

Accepted Answer

The sender's balance will become a very large positive number.

Answer

The transaction will revert due to insufficient funds.

Answer

The sender's balance will become -10.

Answer

The sender's balance will be set to 0.

Question 5

During a security audit, you discover a public `initialize` function in a proxy contract that sets the contract's owner. The contract has already been deployed and is in use. Which of the following represents the MOST critical and immediate threat?

Accepted Answer

An attacker could call the function to take ownership of the contract.

Answer

An attacker could cause the contract to run out of gas.

Answer

A user could accidentally lock their own funds by calling the function.

Answer

The contract state could be corrupted by a reentrancy attack.

Question 6

Which of the following tools is primarily used for static analysis of Solidity smart contracts, allowing developers to detect vulnerabilities by examining the source code without actually executing it?

Accepted Answer

Slither

Answer

Ganache

Answer

Truffle

Answer

Remix IDE

A smart contract function intended for distributing rewards iterates through a dynamically-sized array of recipient addresses, sending funds to each one.As the number of recipients grows, transactions calling this function begin to consistently fail.What is the MOST likely cause of this failure?

A smart contract function intended for distributing rewards iterates through a dynamically-sized array of recipient addresses, sending funds to each one.
As the number of recipients grows, transactions calling this function begin to consistently fail.
What is the MOST likely cause of this failure?