CCA Smart Contract Auditing 3

Question 1

What vulnerability is introduced when a Solidity contract performs arithmetic without overflow/underflow checks in versions prior to 0.8.0?

Accepted Answer

Integer overflow/underflow

Answer

Prior to Solidity 0.8.0, arithmetic operations would silently wrap around on overflow/underflow, potentially allowing attackers to manipulate balances or counters.

Question 2

An auditor discovers a contract that relies on `block.timestamp` for a time-locked withdrawal. What is the main risk?

Accepted Answer

Miners can manipulate timestamps by a small margin to affect condition checks

Answer

Miners have limited ability to manipulate `block.timestamp` by roughly 15 seconds, which can be enough to influence time-sensitive conditions.

Question 3

What is the purpose of a 'fuzz testing' tool like Echidna in smart contract security?

Accepted Answer

To generate random inputs and detect property violations automatically

Answer

Echidna is a fuzzer that generates random transaction sequences to find inputs that violate user-defined properties or invariants in smart contracts.

Question 4

Which attack type exploits the ordering of transactions in the mempool to profit from a victim's pending transaction?

Accepted Answer

Front-running (MEV)

Answer

Front-running, a form of Miner/Maximal Extractable Value (MEV), allows bots to observe pending transactions and submit competing transactions with higher gas fees to execute first.

Question 5

A contract uses `delegatecall` to an untrusted address. What is the primary danger?

Accepted Answer

The callee's code executes in the caller's storage context, allowing state manipulation

Answer

With `delegatecall`, the called contract's code runs using the calling contract's storage and context, so a malicious callee can overwrite critical state variables.

(CCA) Certified Cryptocurrency Auditor Practice Test

(CCA) Certified Cryptocurrency Auditor Practice Test

CCA Smart Contract Auditing 3