Blockchain Technology Security and Attacks 2 — Questions and Answers
Question 1: What is a 'selfish mining' attack in blockchain networks?
- A miner hoards discovered blocks and releases them strategically to waste honest miners' work (Correct answer)
- A miner refuses to validate transactions from competitors
- A miner submits fraudulent transactions to steal fees
- A miner creates fake identities to claim multiple block rewards
Correct answer: A miner hoards discovered blocks and releases them strategically to waste honest miners' work
Selfish mining withholds blocks to make honest miners waste effort on orphaned chains, giving the attacker a disproportionate share of rewards.
Question 2: Which attack exploits the time gap between when a smart contract checks a condition and when it executes the action?
- Reentrancy attack
- Time-of-check to time-of-use (TOCTOU) attack (Correct answer)
- Front-running attack
- Oracle manipulation attack
Correct answer: Time-of-check to time-of-use (TOCTOU) attack
A TOCTOU attack exploits the window between a condition check and execution, allowing state to change in between.
Question 3: What does a 'dust attack' target in cryptocurrency networks?
- Mining pool coordination by sending tiny amounts to wallets to de-anonymize owners (Correct answer)
- Network nodes by flooding them with small packets
- Smart contracts by depleting their gas reserves
- Validators by reducing their staking balance below minimums
Correct answer: Mining pool coordination by sending tiny amounts to wallets to de-anonymize owners
Dust attacks send tiny amounts ('dust') to many addresses, then trace how those funds move to cluster addresses and break pseudonymity.
Question 4: What is the primary risk of using weak random number generation in a blockchain smart contract?
- Higher gas costs for random operations
- Predictable outcomes that attackers can exploit before transactions confirm (Correct answer)
- Slower block confirmation times
- Incompatibility with other smart contracts
Correct answer: Predictable outcomes that attackers can exploit before transactions confirm
Weak randomness (e.g., using block hash or timestamp) is predictable by miners, allowing them to manipulate lottery or gambling contract outcomes.
Question 5: In blockchain security, what is an 'eclipse attack'?
- Intercepting a node's network connections so it only communicates with attacker-controlled peers (Correct answer)
- Blocking light from reaching solar-powered mining farms
- Hiding malicious code inside smart contract bytecode
- Overwhelming a network with encrypted garbage data
Correct answer: Intercepting a node's network connections so it only communicates with attacker-controlled peers
An eclipse attack isolates a node by controlling all its peer connections, feeding it false information about the blockchain state.
Question 6: What vulnerability does 'integer overflow' create in Ethereum smart contracts?
- Values wrap around to unintended numbers, enabling exploits like minting unlimited tokens (Correct answer)
- The contract runs out of gas and halts execution permanently
- Transaction signatures become invalid and are rejected
- Block timestamps become inaccurate causing ordering issues
Correct answer: Values wrap around to unintended numbers, enabling exploits like minting unlimited tokens
Integer overflow causes arithmetic values to wrap around (e.g., max uint256 + 1 = 0), which attackers exploit to create massive balances from near-zero amounts.
Question 7: Which technique do attackers use in a 'sandwich attack' on decentralized exchanges?
- Place a buy order before and a sell order after a victim's large trade to profit from price impact (Correct answer)
- Insert malicious code between two legitimate smart contract calls
- Intercept messages between two nodes and alter transaction data
- Create two fraudulent blocks surrounding a valid block to trigger a reorg
Correct answer: Place a buy order before and a sell order after a victim's large trade to profit from price impact
A sandwich attack front-runs a victim's trade to push the price up, then back-runs it to sell at a profit, exploiting the victim's price slippage.
Blockchain Technology Security and Attacks 2
What is a 'selfish mining' attack in blockchain networks?