CCA Security & Risk Analysis 3 — Questions and Answers
Question 1: Which type of oracle manipulation attack artificially moves the price reported to a DeFi protocol within a single block to exploit lending or liquidation logic?
- Wash trading attack
- Flash loan oracle attack (Correct answer)
- Sandwich attack
- Long-range attack
Correct answer: Flash loan oracle attack
Flash loan oracle attacks use uncollateralized loans within one transaction to manipulate spot price oracles and exploit protocols relying on them.
Question 2: What cryptographic property ensures that a transaction signed with a private key cannot be repudiated by the signer in blockchain systems?
- Confidentiality
- Integrity
- Non-repudiation (Correct answer)
- Availability
Correct answer: Non-repudiation
Non-repudiation via digital signatures means the key owner cannot deny authorizing a transaction because only they possess the private key.
Question 3: When auditing a cryptocurrency exchange, which control is most effective at detecting unauthorized access to production systems?
- Enforcing strong password policies
- Implementing privileged access management (PAM) with session recording (Correct answer)
- Requiring two-factor authentication for all staff
- Conducting annual penetration tests
Correct answer: Implementing privileged access management (PAM) with session recording
PAM with session recording provides granular logging and replay of all privileged actions, enabling detection and forensic investigation of unauthorized access.
Question 4: A blockchain auditor discovers that a protocol's emergency pause function is controlled by a single externally owned account (EOA). What risk does this represent?
- Decentralization risk only
- Single point of failure and key-person risk for critical safety functions (Correct answer)
- Increased gas cost for pause transactions
- Regulatory non-compliance with MiCA
Correct answer: Single point of failure and key-person risk for critical safety functions
A single EOA controlling emergency functions creates a key-person dependency where compromise or loss of one key disables the protocol's safety mechanism.
Question 5: What is the primary purpose of a Merkle proof in the context of cryptocurrency exchange audits and proof-of-reserves?
- To verify a user's KYC identity without revealing personal data
- To cryptographically prove a specific account balance is included in the exchange's total reserve set (Correct answer)
- To authenticate API calls between exchange and blockchain nodes
- To validate miner signatures on newly produced blocks
Correct answer: To cryptographically prove a specific account balance is included in the exchange's total reserve set
Merkle proofs allow a user to verify their balance is included in the exchange's liability tree without the exchange revealing all other customer balances.
Question 6: In the CVSS scoring system used for vulnerability severity ratings, which metric group captures the ease of exploiting a vulnerability remotely without authentication?
- Temporal metrics
- Environmental metrics
- Base metrics — Attack Vector and Privileges Required (Correct answer)
- Supplemental metrics
Correct answer: Base metrics — Attack Vector and Privileges Required
CVSS base metrics including Attack Vector (Network) and Privileges Required (None) capture remote, unauthenticated exploitability.
Question 7: Which smart contract upgrade pattern introduces the most significant centralization and proxy-admin key risk?
- Diamond (EIP-2535) pattern
- Transparent proxy with a single admin key (Correct answer)
- Beacon proxy pattern
- Minimal proxy (EIP-1167) pattern
Correct answer: Transparent proxy with a single admin key
A transparent proxy with a single admin key allows one compromised key to silently upgrade contract logic and redirect all funds.
CCA Security & Risk Analysis 3
Which type of oracle manipulation attack artificially moves the price reported to a DeFi protocol within a single block to exploit lending or liquidation logic?