Blockchain Security Training DeFi Security and Audits 3

Question 1

What is the danger of an unprotected 'delegatecall' to an attacker-controlled address?

Accepted Answer

The attacker's code runs in the caller's storage context and can overwrite state

Answer

It only wastes gas

Answer

It reverts automatically

Answer

It can only read, never write

Question 2

In an upgradeable proxy pattern, what is a common security risk?

Accepted Answer

Storage slot collisions between proxy and implementation

Answer

Too many compiler warnings

Answer

Lack of NatSpec comments

Answer

Higher deployment gas

Question 3

What is a sandwich attack against a DEX trader?

Accepted Answer

An attacker front-runs and back-runs a victim swap to profit from induced price movement

Answer

A double-spend of stablecoins

Answer

A reentrancy on the swap callback

Answer

A governance takeover

Question 4

How can a trader reduce exposure to sandwich attacks?

Accepted Answer

Set a tight slippage tolerance and use private transaction relays

Answer

Increase the gas price only

Answer

Disable token approvals

Answer

Use a larger trade size

Question 5

An audit flags integer arithmetic without SafeMath in a pre-0.8.0 Solidity contract. Why?

Accepted Answer

Unchecked overflow/underflow can corrupt balances

Answer

It increases bytecode size

Answer

It disables events

Answer

It blocks contract verification

Question 6

What risk does an unbounded loop over a user-controlled array introduce?

Accepted Answer

A denial-of-service if the loop exceeds the block gas limit

Answer

Reentrancy

Answer

Oracle manipulation

Answer

Signature replay

Question 7

Why is using 'tx.origin' for authorization a vulnerability?

Accepted Answer

A malicious intermediary contract can phish the original signer's authority

Answer

It costs more gas than msg.sender

Answer

It returns a random address

Answer

It is deprecated in all versions