Free Blockchain Security Training Smart Contract Vulnerabilities Questions and Answers

Question 1

A smart contract function updates a user's balance *after* making an external call to send them funds. Which vulnerability is most likely to be exploited in this scenario?

Accepted Answer

Reentrancy

Answer

This scenario perfectly describes a reentrancy attack. An attacker's contract can use its fallback function to recursively call the withdraw function before the balance is updated, allowing them to drain more funds than they are entitled to. The famous DAO hack was a result of this vulnerability.

Question 2

A developer is creating a token contract. To save gas, they use the `uint8` data type for user balances. What potential vulnerability should the developer be most concerned about when users transfer large numbers of tokens?

Accepted Answer

Integer Overflow/Underflow

Answer

Using a small integer type like `uint8` (which has a maximum value of 255) for balances is highly susceptible to integer overflow. If a user's balance is 250 and they receive 10 more tokens, the value will wrap around to 4 (250 + 10 = 260; 260 % 256 = 4), causing an incorrect and exploitable state. Conversely, subtracting from a zero balance can cause an underflow, resulting in the maximum possible value.

Question 3

An attacker observes a large pending transaction in the mempool to buy a specific token on a decentralized exchange. The attacker quickly submits their own 'buy' transaction for the same token with a higher gas fee, followed by a 'sell' transaction. What is this type of attack called?

Accepted Answer

Front-Running

Answer

This is a classic example of a front-running attack, specifically a 'sandwich attack'. The attacker sees a pending transaction that will affect the price, pays a higher gas fee to get their transaction processed first, and profits from the price slippage caused by the original user's large trade.

Question 4

A smart contract has a function that iterates through an array of investor addresses to distribute dividends. An attacker adds thousands of new addresses to this array, causing the transaction to always fail due to exceeding the block gas limit. Which vulnerability has been exploited?

Accepted Answer

Denial of Service (DoS)

Answer

This is a Denial of Service (DoS) attack. By causing an unbounded loop to consume an excessive amount of gas, the attacker makes a critical function of the contract unusable for legitimate users, as any attempt to call it will run out of gas and fail.

Question 5

Which of the following is the BEST mitigation strategy against reentrancy attacks in Solidity?

Accepted Answer

Implementing the Checks-Effects-Interactions pattern.

Answer

The Checks-Effects-Interactions pattern is the most robust defense against reentrancy. This design pattern dictates that a function should first perform all internal checks (e.g., `require` statements), then update its internal state (Effects, e.g., changing balances), and only then interact with external contracts. This ensures that the state is updated *before* the external call, preventing recursive calls from exploiting a stale state.

Blockchain Practice Test

Blockchain Practice Test

Free Blockchain Security Training Smart Contract Vulnerabilities Questions and Answers