CCA Transactions & Verification 2 — Questions and Answers
Question 1: In a Bitcoin UTXO model, what happens when a transaction output is partially spent?
- The remaining balance stays in the original UTXO
- A new change UTXO is created and sent back to the sender (Correct answer)
- The remainder is automatically destroyed
- Miners collect the unspent portion as a fee
Correct answer: A new change UTXO is created and sent back to the sender
Bitcoin transactions consume entire UTXOs; any leftover amount is returned to the sender as a new change output (UTXO).
Question 2: Which script type is used in standard Bitcoin Pay-to-Public-Key-Hash (P2PKH) transactions?
- SegWit bech32
- Legacy scriptPubKey with OP_DUP OP_HASH160 (Correct answer)
- Multisig 2-of-3
- P2SH wrapped script
Correct answer: Legacy scriptPubKey with OP_DUP OP_HASH160
P2PKH locking scripts use OP_DUP OP_HASH160 followed by the hash of the public key and OP_EQUALVERIFY OP_CHECKSIG.
Question 3: What is a Replace-By-Fee (RBF) transaction and its primary audit concern?
- A transaction that permanently reduces fees; concern is overpayment
- A mechanism to replace an unconfirmed transaction with a higher fee; concern is double-spend risk (Correct answer)
- A settled transaction with refund capability; concern is accounting mismatches
- A smart contract upgrade path; concern is code vulnerabilities
Correct answer: A mechanism to replace an unconfirmed transaction with a higher fee; concern is double-spend risk
RBF allows rebroadcasting an unconfirmed transaction with a higher fee, raising double-spend concerns before the original confirms.
Question 4: In Ethereum, what is the role of the 'nonce' field in a transaction?
- It sets the gas price for the transaction
- It prevents replay attacks and ensures transaction ordering per account (Correct answer)
- It identifies the contract being called
- It encodes the token transfer amount
Correct answer: It prevents replay attacks and ensures transaction ordering per account
The nonce is a sequential counter per Ethereum account that prevents replay attacks and enforces strict ordering of transactions.
Question 5: Which hashing algorithm does Bitcoin use to generate a transaction ID (TXID)?
- SHA-1
- Keccak-256
- SHA-256 applied twice (double SHA-256) (Correct answer)
- RIPEMD-160 alone
Correct answer: SHA-256 applied twice (double SHA-256)
Bitcoin TXIDs are computed by applying SHA-256 twice (SHA-256d) to the serialized transaction data.
Question 6: What is a 'dust' transaction in cryptocurrency auditing, and why is it significant?
- A transaction with an extremely low fee that never confirms
- A transaction output too small to spend economically, often used for tracking or spam (Correct answer)
- A failed smart contract call that burns gas
- A batch transaction combining hundreds of payments
Correct answer: A transaction output too small to spend economically, often used for tracking or spam
Dust outputs are UTXOs below the minimum economically spendable threshold and are used in dust attacks to deanonymize wallet addresses.
Question 7: In a multi-signature (multisig) transaction audit, what document should an auditor review to verify the required signing threshold?
- The mempool broadcast log
- The redeem script embedded in the P2SH or P2WSH output (Correct answer)
- The gas price oracle data
- The block's coinbase transaction
Correct answer: The redeem script embedded in the P2SH or P2WSH output
The redeem script specifies the M-of-N threshold and the participating public keys, making it the authoritative source for multisig verification.
CCA Transactions & Verification 2
In a Bitcoin UTXO model, what happens when a transaction output is partially spent?