C4 DeFi & Smart Contracts Flashcards

What is a reentrancy attack on a smart contract?

Answer: An exploit where a malicious contract repeatedly calls back into a vulnerable contract before the first execution completes, draining funds

Reentrancy attacks (famously used in The DAO hack) exploit a contract that sends ETH before updating its internal state, allowing recursive re-entry to drain funds.

What is a flash loan in DeFi?

Answer: An uncollateralized loan that must be borrowed and repaid within the same blockchain transaction

Flash loans allow users to borrow large amounts of assets without collateral as long as the loan is repaid within the same transaction block; failure reverts the entire transaction.

What is an oracle in the context of smart contracts?

Answer: A service that provides real-world external data (e.g., asset prices) to smart contracts that cannot access off-chain information directly

Oracles bridge the on-chain/off-chain gap by feeding external data (prices, weather, election results) into smart contracts, which are otherwise isolated from outside information.

What is an oracle manipulation attack in DeFi?

Answer: An exploit where an attacker manipulates the price feed an oracle reports to trick a smart contract into executing at a false price

Oracle manipulation attacks use large trades or flash loans to artificially move spot prices in low-liquidity markets, causing oracles to report false values that exploit lending or derivatives protocols.

What is the purpose of a DAO (Decentralized Autonomous Organization) in the DeFi ecosystem?

Answer: To enable token holders to collectively govern a protocol's rules, treasury, and development through on-chain voting

A DAO uses smart contracts and governance tokens to allow a community of stakeholders to collaboratively manage a protocol without central leadership.

What is the difference between a custodial and a non-custodial DeFi wallet?

Answer: In a custodial wallet, a third party holds the private keys; in a non-custodial wallet, the user controls their own keys

Custodial wallets (e.g., exchange wallets) give control of keys to a third party, while non-custodial wallets ensure the user is the sole holder of their private keys.