Blockchain Security Training Risk Mitigation 2 — Questions and Answers
Question 1: Which control most directly reduces the risk of a single compromised key draining a treasury wallet?
- Multi-signature (multisig) wallet requiring multiple approvers (Correct answer)
- Increasing the gas limit on transactions
- Using a shorter block confirmation time
- Storing the seed phrase in a password manager
Correct answer: Multi-signature (multisig) wallet requiring multiple approvers
Multisig spreads signing authority so no single compromised key can move funds alone.
Question 2: A protocol wants to limit losses if an exploit is discovered after deployment. Which mechanism best mitigates this risk?
- A pausable/circuit-breaker function controlled by a guardian (Correct answer)
- Removing all event logging
- Hardcoding admin private keys in the contract
- Disabling reentrancy guards to save gas
Correct answer: A pausable/circuit-breaker function controlled by a guardian
A circuit breaker lets defenders halt vulnerable functions before more funds are lost.
Question 3: What is the primary risk-mitigation purpose of a timelock on protocol governance actions?
- It gives users time to react or exit before a change takes effect (Correct answer)
- It permanently prevents any upgrades
- It speeds up malicious proposals
- It removes the need for audits
Correct answer: It gives users time to react or exit before a change takes effect
A timelock delays execution, giving the community a window to detect and respond to malicious changes.
Question 4: Which practice best mitigates oracle manipulation risk in a DeFi lending protocol?
- Using a time-weighted average price (TWAP) from multiple sources (Correct answer)
- Reading the spot price from a single low-liquidity pool
- Letting users self-report asset prices
- Caching the deployment-time price forever
Correct answer: Using a time-weighted average price (TWAP) from multiple sources
TWAP across multiple liquid sources makes price manipulation far more expensive.
Question 5: A team holds an admin upgrade key. What mitigation reduces insider and single-point-of-failure risk for that key?
- Placing the key behind a multisig with a timelock (Correct answer)
- Sharing the key over email with the whole team
- Storing the key in the contract's public storage
- Reusing the key across all environments
Correct answer: Placing the key behind a multisig with a timelock
A multisig plus timelock removes single-person control and delays any malicious upgrade.
Question 6: Which approach most effectively mitigates the risk of unknown vulnerabilities reaching production code?
- Independent third-party security audits plus a bug bounty program (Correct answer)
- Skipping testing to ship faster
- Relying only on the developers' self-review
- Deploying directly to mainnet without testnet trials
Correct answer: Independent third-party security audits plus a bug bounty program
External audits and bug bounties surface flaws that internal teams often miss.
Question 7: What does setting per-transaction and daily withdrawal limits on a bridge primarily mitigate?
- The size of losses during an active exploit (Correct answer)
- Network latency between chains
- The cost of gas fees
- The number of supported tokens
Correct answer: The size of losses during an active exploit
Rate limits cap how much can be drained before defenders intervene.
Blockchain Security Training Risk Mitigation 2
Which control most directly reduces the risk of a single compromised key draining a treasury wallet?