Blockchain Technology Security and Attacks 4

Question 1

What vulnerability did the 2016 DAO hack on Ethereum exploit?

Accepted Answer

Reentrancy: the withdraw function called an external contract before updating the internal balance

Answer

The DAO attacker repeatedly called the withdraw function before the balance was updated, draining ~3.6 million ETH through recursive external calls.

Question 2

What is a 'price oracle manipulation' attack in DeFi?

Accepted Answer

Artificially moving an asset's spot price on a DEX used as a price reference to exploit lending protocols

Answer

Attackers manipulate the spot price of a token on a DEX (often via flash loans) that a lending protocol uses as an oracle, enabling under-collateralized borrowing.

Question 3

Which consensus attack requires controlling more than one-third of stake in a Proof-of-Stake system?

Accepted Answer

Finality delay or safety failure attacks requiring ≥1/3 of stake to prevent or break consensus

Answer

In BFT-based PoS systems like Ethereum's Casper, controlling ≥1/3 of stake lets an attacker prevent finality or, with ≥2/3, revert finalized blocks.

Question 4

What is 'signature malleability' and which Bitcoin transaction issue did it enable?

Accepted Answer

Altering a signature's encoding without invalidating it, allowing third parties to change transaction IDs before confirmation

Answer

Signature malleability let attackers tweak ECDSA signatures to produce valid but different transaction IDs (txids), complicating transaction tracking and was central to the MtGox issues.

Question 5

What does 'access control misconfiguration' most commonly allow in smart contract exploits?

Accepted Answer

Unauthorized users calling privileged functions like mint, pause, or upgrade due to missing onlyOwner checks

Answer

Missing or incorrect modifiers (e.g., onlyOwner) allow arbitrary users to call administrative functions, enabling minting, fund draining, or contract upgrades.

Blockchain Practice Test

Blockchain Practice Test

Blockchain Technology Security and Attacks 4