CCA Security, Risk, and Vulnerabilities 2

Question 1

Which attack vector exploits the predictability of a smart contract's pseudo-random number generation (PRNG) to manipulate lottery or gambling outcomes?

Accepted Answer

PRNG manipulation attack

Answer

PRNG manipulation attacks exploit weak randomness sources like block hashes or timestamps that miners or validators can influence to predict or bias outcomes.

Question 2

In the context of cryptocurrency exchange security, what is a 'cold wallet' sweep attack?

Accepted Answer

Stealing funds by accessing air-gapped systems through physical intrusion or insider threat

Answer

A cold wallet sweep attack targets air-gapped or offline storage through insider threats, physical access, or supply chain compromise to extract private keys.

Question 3

What vulnerability is introduced when a Solidity smart contract uses 'tx.origin' for authentication instead of 'msg.sender'?

Accepted Answer

Phishing via contract intermediary

Answer

Using tx.origin allows a malicious intermediary contract to trick the original sender into unknowingly authorizing transactions, enabling phishing attacks.

Question 4

Which risk category does 'validator centralization' fall under in a Proof-of-Stake blockchain?

Accepted Answer

Systemic/concentration risk

Answer

Validator centralization creates systemic concentration risk because a small group controlling majority stake can collude to censor transactions or perform 51% attacks.

Question 5

What is the primary security concern with 'infinite approval' patterns in ERC-20 token interactions with DeFi protocols?

Accepted Answer

They allow protocols to drain a user's entire token balance if compromised

Answer

Infinite approvals grant a protocol unlimited spending rights over a user's tokens, meaning if the protocol contract is exploited, all approved tokens can be stolen.

(CCA) Certified Cryptocurrency Auditor Practice Test

(CCA) Certified Cryptocurrency Auditor Practice Test

CCA Security, Risk, and Vulnerabilities 2