Blockchain Security Training DeFi Security and Audits 3

Question 1

What is the danger of an unprotected 'delegatecall' to an attacker-controlled address?

Accepted Answer

The attacker's code runs in the caller's storage context and can overwrite state

Answer

delegatecall executes external code using the caller's storage, so a malicious target can rewrite the caller's variables, including ownership.

Question 2

In an upgradeable proxy pattern, what is a common security risk?

Accepted Answer

Storage slot collisions between proxy and implementation

Answer

If the proxy and implementation use overlapping storage layouts, an upgrade can corrupt critical variables like the admin slot.

Question 3

What is a sandwich attack against a DEX trader?

Accepted Answer

An attacker front-runs and back-runs a victim swap to profit from induced price movement

Answer

The attacker buys before the victim's trade and sells after, exploiting the price impact, a classic MEV technique.

Question 4

How can a trader reduce exposure to sandwich attacks?

Accepted Answer

Set a tight slippage tolerance and use private transaction relays

Answer

Tight slippage limits the price movement an attacker can exploit, and private relays keep the transaction out of the public mempool.

Question 5

An audit flags integer arithmetic without SafeMath in a pre-0.8.0 Solidity contract. Why?

Accepted Answer

Unchecked overflow/underflow can corrupt balances

Answer

Before Solidity 0.8.0, arithmetic did not revert on overflow, allowing balances to wrap around and be manipulated.

Blockchain Practice Test