CBSA Blockchain Security and Privacy 5 — Questions and Answers
Question 1: Which Ethereum improvement proposal introduced a mechanism to limit the maximum amount of Ether that can be extracted from a contract call, reducing reentrancy risk?
- EIP-1559
- EIP-2929
- Checks-Effects-Interactions pattern (CEI) (Correct answer)
- EIP-3675
Correct answer: Checks-Effects-Interactions pattern (CEI)
The Checks-Effects-Interactions pattern is the canonical defensive coding approach: validate inputs, update contract state, then interact with external contracts to prevent reentrancy.
Question 2: A blockchain project uses IPFS to store data off-chain and only stores the content hash on-chain. What is the main security risk of this approach?
- Hash collisions in SHA-256
- IPFS nodes may stop pinning data, causing content unavailability (link rot) (Correct answer)
- On-chain gas costs become unpredictable
- Smart contracts cannot verify IPFS CIDs
Correct answer: IPFS nodes may stop pinning data, causing content unavailability (link rot)
IPFS data persistence depends on nodes choosing to pin the content; if no node pins the data, it becomes unretrievable even though the on-chain hash reference remains valid.
Question 3: Which technique splits a secret across multiple parties so that a minimum threshold of shares is required to reconstruct it, used in blockchain key custody?
- Multi-signature (multisig)
- Shamir's Secret Sharing (SSS) (Correct answer)
- BLS signature aggregation
- Pedersen commitment
Correct answer: Shamir's Secret Sharing (SSS)
Shamir's Secret Sharing divides a secret into n shares so that any k shares (threshold) can reconstruct the secret, enabling distributed key custody without a single point of failure.
Question 4: In a public blockchain, transaction graph analysis can de-anonymize users. Which Bitcoin privacy technique mitigates this by combining multiple transactions into one?
- SegWit
- CoinJoin (Correct answer)
- Lightning Network
- Replace-by-Fee (RBF)
Correct answer: CoinJoin
CoinJoin merges multiple users' transactions into a single transaction with many inputs and outputs, obscuring the link between specific senders and receivers.
Question 5: What is the primary purpose of a bug bounty program in blockchain security architecture?
- Rewarding users who hold tokens for longer periods
- Incentivizing external researchers to responsibly disclose vulnerabilities before exploitation (Correct answer)
- Compensating validators for honest block production
- Funding smart contract audits from the protocol treasury
Correct answer: Incentivizing external researchers to responsibly disclose vulnerabilities before exploitation
Bug bounty programs offer financial rewards to ethical hackers who discover and responsibly report security vulnerabilities, expanding the security testing surface beyond internal teams.
Question 6: Which cryptographic primitive is used in blockchain Merkle trees to ensure data integrity of transactions within a block?
- Symmetric encryption (AES)
- Cryptographic hash functions (SHA-256) (Correct answer)
- Public key encryption (RSA)
- Digital signature algorithms (ECDSA)
Correct answer: Cryptographic hash functions (SHA-256)
Merkle trees use cryptographic hash functions to hash individual transactions and then recursively hash pairs of hashes, producing a single Merkle root that summarizes all transactions tamper-evidently.
Question 7: An architect is designing a consortium blockchain where regulators need read access to all transactions but participants want privacy from each other. Which approach best satisfies both requirements?
- Public blockchain with pseudonymous addresses
- Channel-based architecture with regulator nodes as members of all channels (Correct answer)
- Fully private sidechain with no external visibility
- Zero-knowledge proofs shared only with participants
Correct answer: Channel-based architecture with regulator nodes as members of all channels
Adding the regulator as a member of every channel in a permissioned blockchain (e.g., Hyperledger Fabric channels) grants full read access for compliance while keeping inter-participant data segregated.
CBSA Blockchain Security and Privacy 5
Which Ethereum improvement proposal introduced a mechanism to limit the maximum amount of Ether that can be extracted from a contract call, reducing reentrancy risk?