CCA Security, Risk, and Vulnerabilities 3

Question 1

What is a 'time-bandit' attack in the context of Proof-of-Work blockchains?

Accepted Answer

Rewriting recent blockchain history by bribing miners to reorganize profitable blocks

Answer

A time-bandit attack involves miners colluding to reorganize recent blocks to capture high-value MEV opportunities, destabilizing blockchain finality.

Question 2

Which vulnerability class does 'storage collision' in upgradeable proxy contracts fall under?

Accepted Answer

Logic/storage layout conflict vulnerability

Answer

Storage collision occurs when proxy and implementation contracts use the same storage slots for different variables, causing data corruption during contract upgrades.

Question 3

An auditor is reviewing a DeFi protocol that uses a single on-chain price feed from a low-liquidity AMM. Which attack is this protocol most susceptible to?

Accepted Answer

Flash loan price manipulation

Answer

Flash loans enable attackers to temporarily manipulate the price in a low-liquidity AMM within a single transaction, then exploit protocols relying on that manipulated price.

Question 4

What security risk does 'address poisoning' present to cryptocurrency users?

Accepted Answer

Sending dust transactions from look-alike addresses to trick users into copying the wrong recipient address

Answer

Address poisoning sends tiny transactions from addresses visually similar to frequent contacts, hoping users copy the attacker's address from their transaction history instead of the legitimate one.

Question 5

In a Proof-of-Stake system, what is 'long-range attack' and why is it a unique concern?

Accepted Answer

Using old private keys to rewrite blockchain history from a past point where an attacker had stake

Answer

Long-range attacks exploit the fact that old private keys, once spent, can be used to rewrite history from a past checkpoint in PoS systems without requiring current stake.

(CCA) Certified Cryptocurrency Auditor Practice Test

(CCA) Certified Cryptocurrency Auditor Practice Test

CCA Security, Risk, and Vulnerabilities 3