CBSE Blockchain Threat Modeling 2 — Questions and Answers
Question 1: In STRIDE threat modeling applied to a blockchain node, which threat category specifically addresses a malicious node falsely claiming to be a trusted validator?
- Tampering
- Repudiation
- Spoofing (Correct answer)
- Information Disclosure
Correct answer: Spoofing
Spoofing in STRIDE covers identity impersonation, such as a node falsely presenting itself as a legitimate validator to gain trust.
Question 2: Which attack vector does a threat model for a public blockchain's mempool primarily need to address regarding transaction ordering?
- Replay attacks
- Miner Extractable Value (MEV) front-running (Correct answer)
- Sybil attacks
- 51% attacks
Correct answer: Miner Extractable Value (MEV) front-running
MEV front-running exploits the ability of miners/validators to reorder, insert, or censor pending transactions in the mempool for profit.
Question 3: A threat model identifies that an attacker can intercept peer-to-peer gossip messages between blockchain nodes. Which control BEST mitigates this threat?
- Implementing TLS/noise protocol encryption for P2P communication (Correct answer)
- Increasing block confirmation requirements
- Using a proof-of-work consensus
- Enabling token-based access control
Correct answer: Implementing TLS/noise protocol encryption for P2P communication
Encrypting P2P communication with TLS or noise protocol prevents eavesdropping and man-in-the-middle attacks on gossip traffic.
Question 4: In a DeFi protocol threat model, what does 'oracle manipulation' represent as an attack surface?
- Compromising the RPC node API endpoint
- Feeding false external price data to influence on-chain contract logic (Correct answer)
- Exploiting the block reward algorithm
- Bypassing gas fee limits in smart contracts
Correct answer: Feeding false external price data to influence on-chain contract logic
Oracle manipulation involves supplying tampered off-chain data (e.g., asset prices) to smart contracts, allowing attackers to exploit dependent logic.
Question 5: Which threat modeling methodology uses an attacker-centric approach by enumerating attack trees rooted at a specific adversary goal against a blockchain system?
- STRIDE
- PASTA
- Attack Tree Analysis (Correct answer)
- LINDDUN
Correct answer: Attack Tree Analysis
Attack Tree Analysis models threats from the attacker's perspective by decomposing a top-level adversarial goal into sub-goals and leaf-node attack methods.
Question 6: During threat modeling of a permissioned blockchain, which trust boundary is MOST critical to define between the ordering service and peer nodes?
- The boundary where consensus messages are validated and authenticated (Correct answer)
- The boundary between the user wallet and the UI
- The block gas limit enforcement point
- The database replication boundary
Correct answer: The boundary where consensus messages are validated and authenticated
The ordering service-to-peer boundary is critical because unauthenticated consensus messages could allow a compromised orderer to inject invalid blocks.
Question 7: A threat model rates a vulnerability with high likelihood but low impact. How should this be prioritized compared to a low-likelihood, high-impact threat?
- Always prioritize the high-likelihood threat regardless of impact
- Use risk scoring (likelihood × impact) to compare and prioritize objectively (Correct answer)
- Always prioritize the high-impact threat regardless of likelihood
- Defer both threats since neither scores maximum on both axes
Correct answer: Use risk scoring (likelihood × impact) to compare and prioritize objectively
Risk scoring multiplies likelihood and impact to produce a comparable risk value, enabling objective prioritization across asymmetric threat profiles.
CBSE Blockchain Threat Modeling 2
In STRIDE threat modeling applied to a blockchain node, which threat category specifically addresses a malicious node falsely claiming to be a trusted validator?