CBSA Blockchain Security and Privacy 3 — Questions and Answers
Question 1: Which type of smart contract vulnerability allows an external contract to re-enter a function before the first execution completes, draining funds?
- Integer overflow
- Reentrancy attack (Correct answer)
- Front-running
- Denial of service via gas limit
Correct answer: Reentrancy attack
Reentrancy attacks exploit the pattern of sending Ether before updating internal state, allowing the recipient contract to call back and repeat the withdrawal.
Question 2: What does the term 'front-running' mean in the context of blockchain security?
- Deploying a contract before the network upgrade
- Miners or bots inserting transactions ahead of pending ones to profit from known price movements (Correct answer)
- Submitting multiple conflicting transactions simultaneously
- Using a faster consensus algorithm
Correct answer: Miners or bots inserting transactions ahead of pending ones to profit from known price movements
Front-running exploits the public visibility of the mempool, allowing adversaries to observe pending transactions and submit their own with higher gas fees to be processed first.
Question 3: Which encryption scheme allows computations to be performed on encrypted data without decrypting it first?
- Elliptic curve cryptography (ECC)
- Homomorphic encryption (Correct answer)
- Symmetric AES-256
- RSA-OAEP
Correct answer: Homomorphic encryption
Homomorphic encryption enables operations on ciphertexts that produce encrypted results matching the operations performed on the plaintext, preserving data privacy during computation.
Question 4: In Ethereum, which opcode is commonly blamed for the Parity multi-sig wallet freeze of 2017?
- SELFDESTRUCT
- DELEGATECALL (Correct answer)
- CALLCODE
- STATICCALL
Correct answer: DELEGATECALL
DELEGATECALL executes library code in the context of the calling contract; the Parity freeze occurred when an attacker called DELEGATECALL to a library and invoked its suicide function, destroying it.
Question 5: A blockchain architect wants to prevent Sybil attacks in a permissionless network without proof of work. Which mechanism is most effective?
- Increasing block size
- Proof of stake with economic slashing (Correct answer)
- Sharding
- Merkle DAG
Correct answer: Proof of stake with economic slashing
Proof of stake requires validators to lock up economic value (stake) and introduces slashing penalties, making Sybil attacks costly because each fake identity requires real capital.
Question 6: Which privacy-enhancing feature in Monero hides the sender's address by mixing it with other public keys in a transaction?
- Stealth addresses
- Ring signatures (Correct answer)
- RingCT
- Bulletproofs
Correct answer: Ring signatures
Ring signatures bundle the actual signer's key with decoy public keys from the blockchain, making it computationally infeasible to identify the true sender.
Question 7: What is the purpose of a time-lock in a blockchain smart contract from a security perspective?
- Speeding up consensus finality
- Enforcing a mandatory delay before critical actions execute, allowing detection of malicious changes (Correct answer)
- Encrypting transaction data for a set period
- Preventing miners from including the transaction prematurely
Correct answer: Enforcing a mandatory delay before critical actions execute, allowing detection of malicious changes
Time-locks introduce a delay (e.g., 48-72 hours) before admin actions take effect, giving users time to review and exit if they detect unauthorized or malicious governance changes.
CBSA Blockchain Security and Privacy 3
Which type of smart contract vulnerability allows an external contract to re-enter a function before the first execution completes, draining funds?