Cryptocurrency Wallets and Key Management 5 — Questions and Answers
Question 1: What is the primary risk of storing a seed phrase in a cloud service like iCloud or Google Drive?
- Cloud services charge fees for storing sensitive files
- A breach or unauthorized access to the cloud account exposes the seed phrase and all associated funds (Correct answer)
- The seed phrase file format is incompatible with cloud storage
- Cloud services automatically share files with government agencies
Correct answer: A breach or unauthorized access to the cloud account exposes the seed phrase and all associated funds
Storing a seed phrase in the cloud means it is only as secure as the cloud account; a compromised account password or cloud breach can drain the wallet.
Question 2: In Ethereum, what is the difference between an Externally Owned Account (EOA) and a smart contract wallet?
- EOAs are controlled by a private key; smart contract wallets are governed by on-chain code that can implement custom logic like multi-sig (Correct answer)
- EOAs hold ERC-20 tokens; smart contract wallets hold only ETH
- Smart contract wallets are cheaper to use than EOAs
- EOAs require KYC while smart contract wallets do not
Correct answer: EOAs are controlled by a private key; smart contract wallets are governed by on-chain code that can implement custom logic like multi-sig
EOAs are controlled by a single private key, while smart contract wallets run code on-chain and can enforce rules such as multi-signature approval or social recovery.
Question 3: What does 'social recovery' mean in the context of smart contract wallets?
- Recovering a wallet by logging in with a social media account
- A mechanism allowing pre-designated 'guardians' to collectively restore wallet access if the owner loses their key (Correct answer)
- Using social engineering to obtain someone else's seed phrase
- Sharing a wallet with members of a social network
Correct answer: A mechanism allowing pre-designated 'guardians' to collectively restore wallet access if the owner loses their key
Social recovery lets a user designate trusted guardians who can vote to replace the signing key, enabling recovery without a traditional seed phrase backup.
Question 4: What is a 'dusting attack' targeting cryptocurrency wallets?
- Sending spam transactions to clog the mempool
- Sending tiny amounts of crypto to wallets in order to link addresses and de-anonymize owners (Correct answer)
- Attacking a wallet's encryption with small computational increments
- Forcing a wallet to generate dust UTXOs below the fee threshold
Correct answer: Sending tiny amounts of crypto to wallets in order to link addresses and de-anonymize owners
Attackers send minuscule amounts (dust) to many addresses and then analyze how those funds move to cluster addresses and identify wallet owners.
Question 5: Which metal backup material is generally considered MOST durable for long-term seed phrase storage?
- Laminated paper
- Stainless steel or titanium plates (Correct answer)
- Aluminum foil
- PVC plastic cards
Correct answer: Stainless steel or titanium plates
Stainless steel and titanium are highly resistant to fire, water, and corrosion, making them far more durable than paper or softer metals for long-term seed storage.
Question 6: What is the purpose of 'xpub' (extended public key) sharing in an HD wallet?
- It allows anyone with the xpub to spend funds from the wallet
- It enables a third party to generate all child public addresses for monitoring without exposing private keys (Correct answer)
- It is used to encrypt outgoing transactions
- It serves as the wallet's unique identifier on the blockchain
Correct answer: It enables a third party to generate all child public addresses for monitoring without exposing private keys
An xpub lets services derive the full sequence of public addresses for a wallet, supporting watch-only monitoring or payment address generation without any spending capability.
Question 7: What is the recommended approach when a hardware wallet displays an 'unverified' address during a receive operation?
- Proceed normally; the warning is cosmetic
- Always confirm the address on the hardware wallet's own trusted screen before sharing it (Correct answer)
- Contact the wallet manufacturer to whitelist the address
- Reset the hardware wallet and regenerate the address
Correct answer: Always confirm the address on the hardware wallet's own trusted screen before sharing it
Always verify addresses on the hardware wallet's built-in display to ensure malware on the host computer has not substituted a different, attacker-controlled address.
Cryptocurrency Wallets and Key Management 5
What is the primary risk of storing a seed phrase in a cloud service like iCloud or Google Drive?