C4 C4 DeFi & Smart Contracts 2 — Questions and Answers
Question 1: What is a reentrancy attack on a smart contract?
- An attack where a miner reorders transactions to front-run a DeFi swap
- An exploit where a malicious contract repeatedly calls back into a vulnerable contract before the first execution completes, draining funds (Correct answer)
- A phishing attack targeting DeFi wallet users
- An attack that floods a network to delay smart contract execution
Correct answer: An exploit where a malicious contract repeatedly calls back into a vulnerable contract before the first execution completes, draining funds
Reentrancy attacks (famously used in The DAO hack) exploit a contract that sends ETH before updating its internal state, allowing recursive re-entry to drain funds.
Question 2: What is a flash loan in DeFi?
- A short-term loan from a centralized exchange with zero collateral
- An uncollateralized loan that must be borrowed and repaid within the same blockchain transaction (Correct answer)
- A loan denominated in a flash-minted stablecoin
- A rapid lending product offered by crypto-friendly banks
Correct answer: An uncollateralized loan that must be borrowed and repaid within the same blockchain transaction
Flash loans allow users to borrow large amounts of assets without collateral as long as the loan is repaid within the same transaction block; failure reverts the entire transaction.
Question 3: What is an oracle in the context of smart contracts?
- A prediction market protocol on Ethereum
- A service that provides real-world external data (e.g., asset prices) to smart contracts that cannot access off-chain information directly (Correct answer)
- A governance body that audits smart contract code
- A tool used to compile and deploy Solidity contracts
Correct answer: A service that provides real-world external data (e.g., asset prices) to smart contracts that cannot access off-chain information directly
Oracles bridge the on-chain/off-chain gap by feeding external data (prices, weather, election results) into smart contracts, which are otherwise isolated from outside information.
Question 4: What is an oracle manipulation attack in DeFi?
- An attack that corrupts a blockchain node's database
- An exploit where an attacker manipulates the price feed an oracle reports to trick a smart contract into executing at a false price (Correct answer)
- A social engineering attack targeting oracle network operators
- A denial-of-service attack on oracle API endpoints
Correct answer: An exploit where an attacker manipulates the price feed an oracle reports to trick a smart contract into executing at a false price
Oracle manipulation attacks use large trades or flash loans to artificially move spot prices in low-liquidity markets, causing oracles to report false values that exploit lending or derivatives protocols.
Question 5: What is the purpose of a DAO (Decentralized Autonomous Organization) in the DeFi ecosystem?
- To serve as a regulatory body for decentralized exchanges
- To enable token holders to collectively govern a protocol's rules, treasury, and development through on-chain voting (Correct answer)
- To provide insurance against smart contract exploits
- To act as the sole issuer of the protocol's governance token
Correct answer: To enable token holders to collectively govern a protocol's rules, treasury, and development through on-chain voting
A DAO uses smart contracts and governance tokens to allow a community of stakeholders to collaboratively manage a protocol without central leadership.
Question 6: What is the difference between a custodial and a non-custodial DeFi wallet?
- Custodial wallets support more blockchains
- In a custodial wallet, a third party holds the private keys; in a non-custodial wallet, the user controls their own keys (Correct answer)
- Non-custodial wallets require KYC verification
- Custodial wallets cannot interact with DeFi protocols
Correct answer: In a custodial wallet, a third party holds the private keys; in a non-custodial wallet, the user controls their own keys
Custodial wallets (e.g., exchange wallets) give control of keys to a third party, while non-custodial wallets ensure the user is the sole holder of their private keys.
C4 C4 DeFi & Smart Contracts 2
What is a reentrancy attack on a smart contract?