Blockchain Developer Security Principles 2 — Questions and Answers
Question 1: A reentrancy attack on a smart contract is best mitigated by which design pattern?
- Checks-effects-interactions pattern (Correct answer)
- Storing all state in memory
- Using delegatecall for transfers
- Increasing the gas limit
Correct answer: Checks-effects-interactions pattern
Updating state before making external calls prevents an attacker's fallback from re-entering and draining funds.
Question 2: Which Solidity construct provides reentrancy protection by locking a function during execution?
- nonReentrant modifier with a mutex (Correct answer)
- pure modifier
- view modifier
- payable modifier
Correct answer: nonReentrant modifier with a mutex
A nonReentrant modifier uses a boolean mutex to block recursive calls into the same function.
Question 3: Integer overflow vulnerabilities in older Solidity were commonly prevented using which library?
- SafeMath (Correct answer)
- OpenZeppelin Ownable
- Chainlink VRF
- ERC20Detailed
Correct answer: SafeMath
SafeMath wrapped arithmetic to revert on overflow before Solidity 0.8 made checks built-in.
Question 4: From Solidity 0.8.0 onward, how is integer overflow handled by default?
- Arithmetic reverts automatically on overflow/underflow (Correct answer)
- Values silently wrap around
- Compilation fails
- Gas is refunded
Correct answer: Arithmetic reverts automatically on overflow/underflow
Solidity 0.8+ includes built-in overflow/underflow checks that revert the transaction.
Question 5: A front-running attack exploits which property of public blockchains?
- Pending transactions are visible in the mempool before mining (Correct answer)
- Blocks are immutable once finalized
- Private keys are reused
- Gas prices are fixed
Correct answer: Pending transactions are visible in the mempool before mining
Attackers observe pending transactions in the mempool and submit their own with higher gas to execute first.
Question 6: Which technique helps protect against front-running by hiding transaction intent until confirmation?
- Commit-reveal scheme (Correct answer)
- Increasing block size
- Disabling events
- Using tx.origin
Correct answer: Commit-reveal scheme
Commit-reveal first submits a hashed commitment, then reveals the value later, hiding intent from front-runners.
Question 7: Why is using tx.origin for authorization considered insecure?
- A malicious intermediary contract can trick the original user into authorizing it (Correct answer)
- It costs too much gas
- It cannot be read in Solidity
- It only works on testnets
Correct answer: A malicious intermediary contract can trick the original user into authorizing it
tx.origin returns the original sender, so a phishing contract can pass authorization checks on the victim's behalf.
Blockchain Developer Security Principles 2
A reentrancy attack on a smart contract is best mitigated by which design pattern?