CBSE Smart Contract Vulnerabilities 3

Question 1

What is a 'front-running' attack in the context of decentralized exchanges (DEXs)?

Accepted Answer

Submitting a higher-gas transaction to execute before a pending victim transaction and profit from the price change

Answer

Front-running (a form of MEV) involves observing a pending transaction in the mempool and submitting a competing transaction with higher gas to be mined first.

Question 2

A contract's 'selfdestruct' function is callable by any address. Which vulnerability category does this represent?

Accepted Answer

Logic error / missing access control

Answer

Allowing any address to call selfdestruct is a missing access control vulnerability; a proper guard (e.g., onlyOwner) should restrict this destructive function.

Question 3

Which attack exploits the fact that an ERC-20 'approve' operation can be front-run to spend both the old and new allowance?

Accepted Answer

Allowance race condition (approve/transferFrom race)

Answer

If an owner calls approve to change an existing non-zero allowance, a spender can front-run and spend the old allowance, then spend the new allowance too, extracting double the intended amount.

Question 4

What is a 'griefing attack' in smart contract security?

Accepted Answer

Making a contract unusable or forcing it into a bad state without direct financial gain

Answer

A griefing attack aims to harm or permanently disrupt a contract's functionality (e.g., blocking withdrawals) rather than extracting funds.

Question 5

An attacker sends ETH directly to a contract address using 'selfdestruct' before the contract is deployed (via CREATE2). What impact can this have?

Accepted Answer

The pre-loaded ETH may break invariants that assume the contract starts with zero balance

Answer

Because a CREATE2 address is deterministic, an attacker can seed ETH to that address beforehand; contracts that assume they start with zero balance (e.g., checking address(this).balance == 0) will behave incorrectly.

(CBSE) Certified Blockchain Security Expert Practice Test

(CBSE) Certified Blockchain Security Expert Practice Test

CBSE Smart Contract Vulnerabilities 3