CCA Cryptocurrency Transaction Auditing 4

Question 1

Which type of Ethereum transaction would have a 'to' field set to null?

Accepted Answer

A contract creation transaction

Answer

Contract creation transactions have a null 'to' field; the contract address is derived from the deployer's address and nonce after mining.

Question 2

An auditor identifies that a wallet received funds from a sanctioned entity on the OFAC SDN list three hops earlier in the transaction graph. What is the appropriate audit finding classification?

Accepted Answer

Indirect sanctions exposure requiring enhanced due diligence and potential SAR filing

Answer

Indirect sanctions exposure (funds traceable to an SDN within a few hops) triggers enhanced due diligence and potentially a SAR, even without direct counterparty contact.

Question 3

What is the significance of a Bitcoin transaction with an 'OP_RETURN' output from an audit perspective?

Accepted Answer

It embeds arbitrary data on-chain, which may include evidence of off-chain agreements or protocol-level metadata

Answer

OP_RETURN outputs store up to 80 bytes of arbitrary data on-chain and are used by audit trails, timestamping services, and some token protocols.

Question 4

When auditing a crypto exchange's proof of reserves, which cryptographic technique allows the exchange to prove it controls specific addresses without revealing customer balances individually?

Accepted Answer

Merkle tree-based proof of liabilities combined with signed address control messages

Answer

Merkle tree PoR allows exchanges to commit to total liabilities, let users verify their inclusion, and sign reserve addresses — proving solvency without exposing individual balances.

Question 5

A CCA auditor finds that a DeFi protocol's governance token holders voted to redirect protocol treasury funds to a newly created wallet. What governance attack does this pattern resemble?

Accepted Answer

A governance takeover via flash-loan-acquired voting power

Answer

Flash loan governance attacks borrow large token amounts within a single block to acquire temporary voting majority, pass malicious proposals, and repay the loan—all in one transaction.

(CCA) Certified Cryptocurrency Auditor Practice Test

(CCA) Certified Cryptocurrency Auditor Practice Test

CCA Cryptocurrency Transaction Auditing 4