Blockchain Security Training DeFi Security and Audits 5

Question 1

What is the main advantage of formal verification in a smart contract audit?

Accepted Answer

It mathematically proves the code satisfies specified properties

Answer

Formal verification uses mathematical methods to prove that code meets its specification under all inputs, catching flaws testing might miss.

Question 2

What does a 'fuzzing' tool do during a security review?

Accepted Answer

Feeds random or generated inputs to find unexpected reverts or invariant violations

Answer

Fuzzers bombard functions with varied inputs to surface edge-case failures and broken invariants that manual review can overlook.

Question 3

Why is a reentrancy guard (mutex) used in withdrawal functions?

Accepted Answer

It prevents a function from being re-entered before its first execution completes

Answer

A reentrancy guard locks the function so a malicious external call cannot recursively re-invoke it and drain funds.

Question 4

What is a signature replay attack in DeFi?

Accepted Answer

A valid signed message is reused to repeat an authorized action

Answer

Without a nonce or domain separator, an attacker can resubmit a previously valid signature to trigger the same action again.

Question 5

How does EIP-712 with nonces help prevent signature replay?

Accepted Answer

It binds signatures to a unique nonce and domain so each can be used only once

Answer

Including a per-user nonce and chain/contract domain in the signed data ensures a signature is valid only once and only on the intended contract.

Blockchain Practice Test