Blockchain Security Training DeFi Security and Audits 2

Question 1

In a flash loan attack, what makes the borrowed capital risk-free for the attacker?

Accepted Answer

The loan is borrowed and repaid within a single atomic transaction

Answer

The lender insures all losses

Answer

The borrower posts no gas fees

Answer

The protocol forgives unpaid debt

Question 2

A DeFi lending protocol uses a single DEX spot price as its oracle. What is the primary vulnerability?

Accepted Answer

Price oracle manipulation via large swaps or flash loans

Answer

Excessive gas consumption

Answer

Front-running of governance votes

Answer

Reentrancy in the withdraw function

Question 3

Which mitigation best protects against oracle price manipulation?

Accepted Answer

Using a time-weighted average price (TWAP) or multiple oracle sources

Answer

Increasing the block gas limit

Answer

Adding more frontend caching

Answer

Reducing the number of validators

Question 4

What is 'impermanent loss' in an automated market maker (AMM)?

Accepted Answer

The loss a liquidity provider incurs versus simply holding the tokens when prices diverge

Answer

A permanent theft of pool funds

Answer

Gas wasted on failed swaps

Answer

Slippage paid by traders

Question 5

An auditor finds a function that updates state after making an external call. What pattern should be enforced?

Accepted Answer

Checks-Effects-Interactions

Answer

Pull-over-push payments only

Answer

Proxy delegation

Answer

Commit-reveal scheme

Question 6

What does a 'rug pull' typically involve in a DeFi project?

Accepted Answer

Developers draining pooled liquidity or minting unlimited tokens then disappearing

Answer

A validator going offline

Answer

Slow block finality

Answer

An expired SSL certificate

Question 7

Why is an unrestricted 'mint' function a critical audit finding?

Accepted Answer

It can inflate token supply and dilute or steal value from holders

Answer

It increases gas costs for transfers

Answer

It breaks ERC-20 event logging

Answer

It prevents users from approving spenders