CBSE DeFi and Token Security 2 — Questions and Answers
Question 1: What is a 'rug pull' in the context of DeFi token security?
- A smart contract upgrade that patches a vulnerability
- Developers abandoning a project and draining liquidity, leaving investors with worthless tokens (Correct answer)
- A consensus fork initiated by validators
- A decentralized governance vote to freeze a pool
Correct answer: Developers abandoning a project and draining liquidity, leaving investors with worthless tokens
Rug pulls occur when malicious developers withdraw all liquidity pool funds after attracting investors, causing the token price to collapse to zero.
Question 2: Which type of DeFi attack exploits the ordering of transactions within a block for profit?
- Eclipse attack
- Maximal Extractable Value (MEV) exploitation (Correct answer)
- Timejacking
- Long-range attack
Correct answer: Maximal Extractable Value (MEV) exploitation
MEV refers to profit extracted by reordering, inserting, or censoring transactions within a block, often at the expense of regular users.
Question 3: A liquidity pool uses a constant product formula (x * y = k). What attack surface does this create for low-liquidity pools?
- Replay attacks on LP token transfers
- High price impact susceptibility making oracle manipulation cheaper and more effective (Correct answer)
- Underflow errors in the k constant calculation
- Governance token dilution
Correct answer: High price impact susceptibility making oracle manipulation cheaper and more effective
Low-liquidity constant-product pools can be significantly price-manipulated with relatively small capital, making them ideal oracle attack targets.
Question 4: What is a token vesting contract security concern that a CBSE professional should audit?
- The token's decimal precision
- Improper access control allowing beneficiaries or admins to bypass vesting schedules and drain tokens early (Correct answer)
- The token's name and symbol fields
- Gas optimization in transfer functions
Correct answer: Improper access control allowing beneficiaries or admins to bypass vesting schedules and drain tokens early
Vesting contracts must enforce time-locks and access controls; bugs in these checks allow premature withdrawal that undermines tokenomics.
Question 5: What does 'approval phishing' target in the DeFi ecosystem?
- Validator approval keys
- Tricking users into signing unlimited ERC-20 token approvals that drain their wallets (Correct answer)
- Governance proposal approval signatures
- Bridge validator approval thresholds
Correct answer: Tricking users into signing unlimited ERC-20 token approvals that drain their wallets
Approval phishing tricks victims into authorizing malicious contracts to spend all their tokens via a standard ERC-20 approve() call.
Question 6: Which security practice best mitigates the risk of a compromised DeFi protocol admin key?
- Storing the key in an HSM
- Using a multi-signature wallet with time-locked governance for all admin operations (Correct answer)
- Encrypting the key with AES-256
- Rotating the key monthly
Correct answer: Using a multi-signature wallet with time-locked governance for all admin operations
Multi-sig wallets require multiple key holders to approve critical actions, and time-locks give the community time to detect and respond to malicious proposals.
CBSE DeFi and Token Security 2
What is a 'rug pull' in the context of DeFi token security?