CBSE Blockchain Threat Modeling 4

Question 1

A blockchain threat model categorizes a threat as affecting 'availability' of the network. Which specific attack does this BEST describe?

Accepted Answer

A transaction flooding DoS attack that fills the mempool and blocks legitimate transactions

Answer

A reentrancy attack draining contract funds

Answer

A front-running attack exploiting MEV

Answer

A private key theft leading to asset loss

Question 2

In a blockchain threat model, what role does the 'assume breach' principle play?

Accepted Answer

It designs security controls assuming an attacker has already gained partial access

Answer

It assumes the cryptographic primitives are broken and replaces them

Answer

It mandates that all smart contracts undergo formal verification

Answer

It requires multi-sig authorization for every on-chain action

Question 3

Which threat to blockchain node software is BEST categorized under the 'Elevation of Privilege' component of STRIDE?

Accepted Answer

A bug in the consensus client allowing a peer to trigger admin RPC calls without authentication

Answer

An attacker reading unencrypted node logs

Answer

A node operator denying they sent a governance transaction

Answer

Network congestion preventing block finalization

Question 4

A threat model for a blockchain wallet identifies seed phrase backup as a critical asset. Which threat to this asset is classified as an 'insider threat'?

Accepted Answer

A malicious wallet developer embedding a seed exfiltration backdoor in the app

Answer

A remote attacker brute-forcing the wallet password

Answer

A phishing site tricking the user into entering their seed phrase

Answer

A supply chain compromise of a hardware wallet firmware update

Question 5

Which technique in blockchain threat modeling specifically evaluates whether smart contract state transitions can lead to unintended final states?

Accepted Answer

Formal verification using model checkers

Answer

Penetration testing of API endpoints

Answer

Network traffic analysis

Answer

Fuzzing the consensus layer

Question 6

In threat modeling a blockchain's governance mechanism, which attack does vote delegation with no time-lock primarily enable?

Accepted Answer

A flash loan governance attack where borrowed tokens manipulate a vote within a single block

Answer

A long-range attack rewriting governance history

Answer

An eclipse attack isolating governance nodes

Answer

A Sybil attack using multiple validator identities

Question 7

A threat model document lists 'gas griefing' as a threat. What does this attack involve?

Accepted Answer

A caller passing insufficient gas to a sub-call so it fails while the outer call succeeds, corrupting contract state

Answer

Artificially inflating gas prices to price out competitors in a gas auction

Answer

Mining empty blocks to waste validators' computational resources

Answer

Deploying contracts that consume all available block gas on deployment