Blockchain Technology Security and Attacks 3 — Questions and Answers
Question 1: What is the 'long-range attack' threat specific to Proof-of-Stake blockchains?
- An attacker uses old private keys from past validators to rewrite blockchain history from a distant point (Correct answer)
- An attacker sustains a 51% attack for an extended period
- An attacker mines blocks over long distances using satellite relays
- An attacker gradually increases network latency to isolate validators
Correct answer: An attacker uses old private keys from past validators to rewrite blockchain history from a distant point
Long-range attacks use old validator keys (when stake was cheaper) to create an alternative chain from far in the past, which PoS systems mitigate with checkpointing.
Question 2: What is 'front-running' in the context of blockchain transaction ordering?
- Observing a pending transaction in the mempool and submitting a competing one with higher gas to be processed first (Correct answer)
- Adding transactions to a block before verifying their signatures
- Mining empty blocks to delay competitors' transactions
- Broadcasting a transaction on multiple chains simultaneously
Correct answer: Observing a pending transaction in the mempool and submitting a competing one with higher gas to be processed first
Front-running exploits the public mempool by inserting a transaction with higher gas fees ahead of a target transaction to capture arbitrage or MEV profits.
Question 3: Which Ethereum upgrade mechanism is exploited in an 'upgrade proxy attack'?
- Attackers compromise the admin key of an upgradeable proxy contract to replace the logic contract with malicious code (Correct answer)
- Attackers exploit the EIP upgrade process to insert backdoors in the base protocol
- Attackers submit fake governance votes to trigger unauthorized protocol upgrades
- Attackers exploit the beacon chain upgrade path to double-spend ETH
Correct answer: Attackers compromise the admin key of an upgradeable proxy contract to replace the logic contract with malicious code
Upgradeable proxy contracts delegate calls to a logic contract; if the admin key is compromised, attackers can swap in a malicious implementation.
Question 4: What security risk does 'tx.origin' pose compared to 'msg.sender' in Solidity?
- tx.origin reveals the original EOA, making phishing contracts able to pass authorization checks (Correct answer)
- tx.origin is deprecated and causes contract compilation failures
- tx.origin exposes validator addresses making them targets for slashing
- tx.origin leaks private key data to other contracts in the call chain
Correct answer: tx.origin reveals the original EOA, making phishing contracts able to pass authorization checks
Using tx.origin for authentication allows malicious intermediary contracts to impersonate the original caller, bypassing security checks.
Question 5: What is 'miner extractable value' (MEV) and why is it a security concern?
- Profits miners capture by reordering, inserting, or censoring transactions, creating unfair advantages and potential instability (Correct answer)
- The computational value miners extract from solving hash puzzles during PoW
- Revenue validators earn from staking rewards beyond the base issuance rate
- Fees extracted from smart contracts during automated liquidations
Correct answer: Profits miners capture by reordering, inserting, or censoring transactions, creating unfair advantages and potential instability
MEV allows block producers to exploit their ordering power to profit at users' expense, leading to network congestion, unfairness, and potential consensus instability.
Question 6: What is a 'flash loan attack' and which property makes flash loans uniquely risky?
- Borrowing large uncollateralized sums within one transaction to manipulate prices and repay, possible because atomicity guarantees repayment (Correct answer)
- Quickly withdrawing staked ETH before a slashing event is recorded
- Flooding the network with rapid small loans to exhaust liquidity pools
- Borrowing tokens across chains using bridges faster than price oracles update
Correct answer: Borrowing large uncollateralized sums within one transaction to manipulate prices and repay, possible because atomicity guarantees repayment
Flash loans are uncollateralized because they must be repaid in the same transaction; attackers use the temporary capital to manipulate DeFi protocols profitably.
Question 7: How does 'griefing' differ from theft in smart contract attacks?
- Griefing aims to cause financial loss or inconvenience to others without direct profit to the attacker (Correct answer)
- Griefing steals funds but returns them anonymously to avoid detection
- Griefing corrupts contract storage permanently unlike theft which is reversible
- Griefing only affects gas costs while theft targets token balances
Correct answer: Griefing aims to cause financial loss or inconvenience to others without direct profit to the attacker
Griefing attacks cause harm (wasted gas, locked contracts, failed transactions) as the goal itself rather than as a means to steal funds.
Blockchain Technology Security and Attacks 3
What is the 'long-range attack' threat specific to Proof-of-Stake blockchains?