Blockchain Security Training DeFi Security and Audits 2 — Questions and Answers
Question 1: In a flash loan attack, what makes the borrowed capital risk-free for the attacker?
- The loan is borrowed and repaid within a single atomic transaction (Correct answer)
- The lender insures all losses
- The borrower posts no gas fees
- The protocol forgives unpaid debt
Correct answer: The loan is borrowed and repaid within a single atomic transaction
Flash loans must be repaid in the same transaction, so if repayment fails the entire transaction reverts, leaving the attacker no downside.
Question 2: A DeFi lending protocol uses a single DEX spot price as its oracle. What is the primary vulnerability?
- Price oracle manipulation via large swaps or flash loans (Correct answer)
- Excessive gas consumption
- Front-running of governance votes
- Reentrancy in the withdraw function
Correct answer: Price oracle manipulation via large swaps or flash loans
Spot prices from a single liquidity pool can be skewed instantly by a large trade, letting an attacker manipulate collateral valuations.
Question 3: Which mitigation best protects against oracle price manipulation?
- Using a time-weighted average price (TWAP) or multiple oracle sources (Correct answer)
- Increasing the block gas limit
- Adding more frontend caching
- Reducing the number of validators
Correct answer: Using a time-weighted average price (TWAP) or multiple oracle sources
TWAPs and aggregated oracles like Chainlink smooth out short-term price spikes, making single-transaction manipulation impractical.
Question 4: What is 'impermanent loss' in an automated market maker (AMM)?
- The loss a liquidity provider incurs versus simply holding the tokens when prices diverge (Correct answer)
- A permanent theft of pool funds
- Gas wasted on failed swaps
- Slippage paid by traders
Correct answer: The loss a liquidity provider incurs versus simply holding the tokens when prices diverge
When the relative price of pooled assets changes, LPs end up with less value than if they had held the tokens, a divergence loss called impermanent loss.
Question 5: An auditor finds a function that updates state after making an external call. What pattern should be enforced?
- Checks-Effects-Interactions (Correct answer)
- Pull-over-push payments only
- Proxy delegation
- Commit-reveal scheme
Correct answer: Checks-Effects-Interactions
Checks-Effects-Interactions requires updating internal state before any external call, preventing reentrancy exploitation.
Question 6: What does a 'rug pull' typically involve in a DeFi project?
- Developers draining pooled liquidity or minting unlimited tokens then disappearing (Correct answer)
- A validator going offline
- Slow block finality
- An expired SSL certificate
Correct answer: Developers draining pooled liquidity or minting unlimited tokens then disappearing
A rug pull is an exit scam where insiders remove liquidity or abuse mint privileges, leaving holders with worthless tokens.
Question 7: Why is an unrestricted 'mint' function a critical audit finding?
- It can inflate token supply and dilute or steal value from holders (Correct answer)
- It increases gas costs for transfers
- It breaks ERC-20 event logging
- It prevents users from approving spenders
Correct answer: It can inflate token supply and dilute or steal value from holders
If anyone or an unchecked admin can mint tokens freely, the supply can be inflated arbitrarily, destroying token value.
Blockchain Security Training DeFi Security and Audits 2
In a flash loan attack, what makes the borrowed capital risk-free for the attacker?