Security & Risk Management Flashcards

A DeFi protocol's smart contract contains a reentrancy vulnerability that is exploited before the development team can respond. Under the NIST Cybersecurity Framework, which function was MOST critically deficient given that the exploit drained funds over 47 separate transactions across 12 minutes before the attack was stopped?

Answer: Detect — no real-time anomaly detection flagged the abnormal withdrawal pattern in time

The attack succeeded over 47 transactions spanning 12 minutes, meaning protections in the code were already absent (a Protect failure), but the question asks what was MOST critically deficient given the timeline. A functioning Detect capability — on-chain anomaly detection or a monitoring system watching for repeated withdrawal patterns — would have triggered an alert within the first few transactions, enabling a Respond action (pausing the contract) before most funds were lost. The 12-minute window makes the Detect gap the decisive factor in the scale of the loss.

A cryptocurrency exchange holds client assets in a 3-of-5 multisignature cold wallet. Two key holders are based in the same jurisdiction. Which risk scenario is LEAST mitigated by this multisig architecture?

Answer: A simultaneous coordinated regulatory seizure of all assets held by entities in the shared jurisdiction

Multisignature schemes are designed to eliminate single points of failure for theft or key loss — they effectively mitigate insider threats (requiring collusion of at least 3 holders), hardware failures (redundant keys), and single-credential phishing. However, if two of five key holders share a jurisdiction and regulators in that jurisdiction issue a simultaneous seizure order, the exchange may be legally compelled to produce two signatures. With only one more signature needed (from the remaining three), the 3-of-5 threshold offers no structural protection against coordinated legal compulsion targeting co-located signers. This is a jurisdictional concentration risk that cryptographic multisig alone cannot address.

Under the Basel III framework as applied to crypto-asset exposures, a bank holds 1,500 BTC classified as a Group 2b unbacked crypto-asset. The current BTC price is $60,000. What is the minimum Tier 1 capital the bank must hold against this position under the conservative 1250% risk weight?

Answer: $90,000,000

The exposure value is 1,500 × $60,000 = $90,000,000. Under Basel III's 1250% risk weight for Group 2b unbacked crypto-assets, the risk-weighted asset (RWA) = $90,000,000 × 12.5 = $1,125,000,000. The minimum Tier 1 capital requirement is 8% of RWA = $1,125,000,000 × 0.08 = $90,000,000. Critically, the 1250% risk weight is specifically calibrated so that the capital requirement equals the full exposure value — a 100% effective capital charge — making the answer equal to the original exposure, not a multiple of it.

A blockchain analytics firm identifies that a transaction involving a cryptocurrency exchange wallet passed through a 'peel chain' of 200 hops before reaching a mixing service. The exchange's AML officer must file a Suspicious Activity Report (SAR). Which element is MOST critical to include to maximize law enforcement utility of this SAR?

Answer: The on-chain graph visualization showing the full transaction path with timestamps and TXID hashes

While all elements have some value, law enforcement's primary need when investigating blockchain-based layering is the ability to trace and seize assets or identify actors. The on-chain graph with timestamps and TXID hashes gives investigators independent, immutable, on-chain evidence that they can verify and extend using their own blockchain analytics tools. This is operationally superior to a USD aggregate (which lacks traceable specificity), KYC records alone (useful but already obtainable via subpoena), or a regulatory citation (which is legal framing, not investigative evidence). FinCEN guidance on SAR narrative quality specifically emphasizes providing 'as complete a picture as possible' of the transaction trail.

A crypto hedge fund uses a perpetual futures contract to hedge its spot BTC exposure. The fund is long 100 BTC spot and short 100 BTC via perpetual futures on a centralized exchange. The funding rate turns sharply negative (shorts pay longs) at −0.15% per 8 hours for 30 consecutive days. What risk category BEST describes the loss the fund incurs from this scenario, and why is it particularly insidious in a crypto context?

Answer: Basis risk — the hedge does not perfectly track spot price because funding costs alter the effective cost basis of the futures position

When funding rates are negative, shorts (the hedge) pay longs, creating a direct cash outflow that erodes the hedge's P&L independent of BTC price movements. This is basis risk: the futures position no longer moves 1:1 with spot because the effective cost of holding the short diverges from spot price. At −0.15% per 8 hours for 30 days (90 funding intervals), the fund pays 0.15% × 90 = 13.5% of the notional in funding costs alone — representing a pure hedge inefficiency loss. This is particularly insidious in crypto because perpetual futures (absent in traditional finance) can sustain extreme funding rates for extended periods with no natural expiry forcing convergence, unlike dated futures contracts which converge to spot at settlement.

A nation-state threat actor compromises a validator node in a Proof-of-Stake network, gaining access to the validator's private key but not achieving 33% of stake. The attacker begins selectively withholding attestations for specific blocks. Which attack is the adversary MOST likely executing, and what is its primary strategic objective?

Answer: A liveness attack via targeted attestation withholding, attempting to grief specific validators into inactivity penalties while avoiding detectable slashable behavior

Without 33% of stake, the attacker cannot unilaterally prevent finality (which requires withholding >33% of attestations) and cannot execute a long-range rewrite without additional compromised keys. Selective attestation withholding from a single validator is below the threshold for systemic finality disruption and is not itself a slashable offense (only equivocation — double-signing — triggers slashing). The most viable strategic objective is therefore a targeted liveness attack: by selectively withholding attestations, the attacker can cause specific validators to accumulate inactivity penalties (in Ethereum's inactivity leak, validators who miss attestations lose stake), potentially knocking targeted validators below minimum stake thresholds. This constitutes covert economic warfare that avoids the attribution risk of slashable behavior.