CBSA Smart Contract Design 4 — Questions and Answers
Question 1: What is the key difference between 'delegatecall' and 'call' in Solidity?
- delegatecall executes the callee's code in the caller's storage context, while call executes in the callee's own context (Correct answer)
- delegatecall transfers Ether while call only transfers data
- delegatecall is cheaper in gas than call for all operations
- delegatecall requires the callee to be a verified contract
Correct answer: delegatecall executes the callee's code in the caller's storage context, while call executes in the callee's own context
With delegatecall, the called contract's code runs using the calling contract's storage, msg.sender, and msg.value — making it the foundation of upgradeable proxy contracts.
Question 2: In the context of Ethereum smart contracts, what is 'front-running' and how does a commit-reveal scheme mitigate it?
- Front-running is gas price manipulation; commit-reveal prevents it by locking gas prices
- Front-running is submitting a transaction with knowledge of a pending transaction; commit-reveal hides intent until after commitment (Correct answer)
- Front-running is a smart contract that executes before the block is mined; commit-reveal delays execution
- Front-running is a consensus attack; commit-reveal distributes block production
Correct answer: Front-running is submitting a transaction with knowledge of a pending transaction; commit-reveal hides intent until after commitment
In a commit-reveal scheme, users first submit a hash of their action (commit phase) and reveal the actual value later, so miners cannot exploit knowledge of pending transactions.
Question 3: What is the significance of the 'selector clash' vulnerability in smart contract proxy patterns?
- When a function in the proxy has the same 4-byte selector as a function in the logic contract, calls may be routed incorrectly (Correct answer)
- When two contracts compete for the same function name in an inheritance hierarchy
- When selector encoding differs between Solidity versions causing deployment failures
- When a contract's function signature changes between upgrades causing ABI incompatibility
Correct answer: When a function in the proxy has the same 4-byte selector as a function in the logic contract, calls may be routed incorrectly
Since Solidity routes calls using 4-byte function selectors, a collision between proxy admin functions and logic contract functions can allow unauthorized access to admin operations.
Question 4: Which Solidity data location must be used for function parameters of complex types (structs, arrays) when the function modifies the data?
- storage
- memory (Correct answer)
- calldata
- stack
Correct answer: memory
The 'memory' location creates a mutable copy for the function's execution, unlike 'calldata' which is read-only and 'storage' which would reference persistent state.
Question 5: What problem does the EIP-712 standard solve for smart contract interactions?
- It standardizes structured data hashing and signing so users can read what they're approving in wallet UIs (Correct answer)
- It defines a universal token transfer protocol replacing ERC-20
- It introduces a new consensus mechanism for smart contract execution
- It compresses ABI-encoded data to reduce transaction costs
Correct answer: It standardizes structured data hashing and signing so users can read what they're approving in wallet UIs
EIP-712 provides a structured, human-readable format for off-chain signatures, preventing users from blindly signing opaque hex data they cannot understand.
Question 6: When a Solidity smart contract needs to generate a pseudo-random number, why is 'block.timestamp' alone considered an insecure source?
- block.timestamp is not available within contract functions
- Miners can manipulate block.timestamp within a small range to influence outcomes in their favor (Correct answer)
- block.timestamp resets to zero at the start of each epoch
- block.timestamp returns the same value across all nodes due to consensus
Correct answer: Miners can manipulate block.timestamp within a small range to influence outcomes in their favor
Miners have some discretion (typically ±15 seconds) over the timestamp they include in a block, allowing them to selectively include or exclude their block to win timestamp-dependent outcomes.
Question 7: In smart contract architecture, what is the 'diamond standard' (EIP-2535) primarily designed to solve?
- The 24KB contract size limit by splitting functionality across multiple facets accessible through a single address (Correct answer)
- The gas cost of deploying contracts by batching multiple deployments into one transaction
- The reentrancy vulnerability by enforcing strict function call ordering
- The storage slot collision problem by using deterministic slot assignment
Correct answer: The 24KB contract size limit by splitting functionality across multiple facets accessible through a single address
EIP-2535 allows a single contract address to route function calls to multiple implementation contracts (facets), overcoming Ethereum's 24,576-byte contract size constraint.
CBSA Smart Contract Design 4
What is the key difference between 'delegatecall' and 'call' in Solidity?