CCA Security, Risk, and Vulnerabilities Questions and Answers

Question 1

An auditor is reviewing a DeFi protocol and identifies a vulnerability where an attacker can borrow a massive amount of cryptocurrency without collateral, manipulate an asset's price on a decentralized exchange, and then repay the loan within the same transaction, profiting from the price difference.
What is this type of exploit called?

Accepted Answer

Flash Loan Attack

Answer

Reentrancy Attack

Answer

51% Attack

Answer

Sybil Attack

Question 2

During a security audit of a Decentralized Autonomous Organization (DAO), which of the following findings represents the most significant governance risk?

Accepted Answer

A small number of addresses hold enough governance tokens to unilaterally pass proposals.

Answer

The DAO's treasury is diversified across multiple stablecoins.

Answer

The user interface for proposal submission has a minor cosmetic bug.

Answer

Smart contract code is well-documented with inline comments.

Question 3

An auditor is examining a Proof-of-Work blockchain and is concerned about an attack where a single entity or pool gains control of more than 50% of the network's hash rate. What is the primary risk associated with this type of attack?

Accepted Answer

The attacker can prevent new transactions from being confirmed and can double-spend their own coins.

Answer

The attacker can steal private keys from user wallets.

Answer

The attacker can reverse old, deeply confirmed transactions.

Answer

The attacker can increase the total supply of the cryptocurrency beyond its defined limit.

Question 4

A smart contract audit reveals a critical flaw. The contract's `withdraw` function first sends funds to an external address and then updates the user's internal balance afterward. An attacker could exploit this by creating a contract that calls the `withdraw` function repeatedly before the balance is updated. This vulnerability is known as a:

Accepted Answer

Reentrancy Attack

Answer

Timestamp Dependency

Answer

Integer Overflow

Answer

Denial of Service

Question 5

An auditor is assessing the security of a cross-chain bridge. Which of the following represents the MOST critical vulnerability, often leading to the largest exploits in this type of protocol?

Accepted Answer

Compromise of the centralized validator keys or multisig wallets that secure the bridge's assets.

Answer

High network fees on one of the connected blockchains.

Answer

Slow transaction finality during periods of network congestion.

Answer

Lack of a dark mode option on the bridge's user interface.

Question 6

When auditing an organization's internal controls over its cryptocurrency holdings, which procedure provides the strongest evidence of the entity's control over its private keys?

Accepted Answer

Requesting the organization to sign a specific message with the private key associated with a public address.

Answer

Reviewing a screenshot of the wallet balance from a block explorer.

Answer

Observing an employee logging into the company's exchange account.

Answer

Verifying the physical security of the facility where the hardware wallets are stored.