CBSE Smart Contract Vulnerabilities 2

Question 1

Which vulnerability allows an attacker to repeatedly call a withdrawal function before the balance is updated, draining contract funds?

Accepted Answer

Reentrancy

Answer

Reentrancy allows an attacker to re-enter a function before the first execution completes, exploiting the fact that the state update happens after the external call.

Question 2

In Solidity, which pattern best mitigates reentrancy attacks by updating state before making external calls?

Accepted Answer

Checks-Effects-Interactions pattern

Answer

The Checks-Effects-Interactions pattern mandates updating all state variables before interacting with external contracts, preventing reentrancy.

Question 3

A smart contract stores the block timestamp as a source of randomness for a lottery. What vulnerability does this introduce?

Accepted Answer

Miner manipulation of block.timestamp

Answer

Miners can adjust block.timestamp within a ~15-second window, allowing them to influence outcomes that depend on it as a randomness source.

Question 4

What is a 'tx.origin' attack in Ethereum smart contracts?

Accepted Answer

Using tx.origin instead of msg.sender for authorization, which can be exploited via phishing contracts

Answer

tx.origin returns the original external account that initiated the call chain, so a malicious intermediate contract can trick a victim into authorizing an action unintentionally.

Question 5

Which EVM feature limits the depth of nested calls, and what vulnerability arises when this limit is hit unexpectedly?

Accepted Answer

Call stack depth limit (1024) — causes unexpected call failures

Answer

The EVM enforces a maximum call stack depth of 1,024; an attacker can pre-fill the stack so a subsequent call in the victim contract fails silently if unchecked.

(CBSE) Certified Blockchain Security Expert Practice Test

(CBSE) Certified Blockchain Security Expert Practice Test

CBSE Smart Contract Vulnerabilities 2