CBSE Blockchain Threat Modeling 2

Question 1

In STRIDE threat modeling applied to a blockchain node, which threat category specifically addresses a malicious node falsely claiming to be a trusted validator?

Accepted Answer

Spoofing

Answer

Spoofing in STRIDE covers identity impersonation, such as a node falsely presenting itself as a legitimate validator to gain trust.

Question 2

Which attack vector does a threat model for a public blockchain's mempool primarily need to address regarding transaction ordering?

Accepted Answer

Miner Extractable Value (MEV) front-running

Answer

MEV front-running exploits the ability of miners/validators to reorder, insert, or censor pending transactions in the mempool for profit.

Question 3

A threat model identifies that an attacker can intercept peer-to-peer gossip messages between blockchain nodes. Which control BEST mitigates this threat?

Accepted Answer

Implementing TLS/noise protocol encryption for P2P communication

Answer

Encrypting P2P communication with TLS or noise protocol prevents eavesdropping and man-in-the-middle attacks on gossip traffic.

Question 4

In a DeFi protocol threat model, what does 'oracle manipulation' represent as an attack surface?

Accepted Answer

Feeding false external price data to influence on-chain contract logic

Answer

Oracle manipulation involves supplying tampered off-chain data (e.g., asset prices) to smart contracts, allowing attackers to exploit dependent logic.

Question 5

Which threat modeling methodology uses an attacker-centric approach by enumerating attack trees rooted at a specific adversary goal against a blockchain system?

Accepted Answer

Attack Tree Analysis

Answer

Attack Tree Analysis models threats from the attacker's perspective by decomposing a top-level adversarial goal into sub-goals and leaf-node attack methods.

(CBSE) Certified Blockchain Security Expert Practice Test

(CBSE) Certified Blockchain Security Expert Practice Test

CBSE Blockchain Threat Modeling 2