CBSE - Certified Blockchain Security Expert Blockchain Threat Modeling Questions and Answers 1 — Questions and Answers
Question 1: When applying the STRIDE threat model to a public, permissionless blockchain, which threat category would most accurately describe a 51% attack?
- Spoofing
- Information Disclosure
- Repudiation
- Tampering (Correct answer)
Correct answer: Tampering
A 51% attack allows a malicious actor to control the majority of the network's mining hash rate, enabling them to alter the ordering of transactions, prevent new transactions from gaining confirmations, and even reverse their own transactions. This direct, unauthorized modification of the ledger's state falls under the category of Tampering.
Question 2: A development team is building a decentralized application (dApp) for supply chain management. During the threat modeling process, they focus on ensuring that once a shipment's status is recorded on the blockchain, no party, including the originator, can deny having submitted that transaction. Which security principle is central to this requirement?
- Confidentiality
- Availability
- Non-repudiation (Correct answer)
- Integrity
Correct answer: Non-repudiation
Non-repudiation is the security principle that ensures a party cannot deny the authenticity of their signature on a document or the sending of a message that they originated. In blockchain, cryptographic signatures provide strong non-repudiation, as a valid transaction signature can only be created with the corresponding private key.
Question 3: Which of the following is a primary focus of threat modeling specifically for the smart contract layer of a blockchain application, as opposed to the network or consensus layer?
- Sybil attacks on network nodes
- Re-entrancy and integer overflow vulnerabilities (Correct answer)
- Eclipse attacks isolating a particular node
- Selfish mining strategies
Correct answer: Re-entrancy and integer overflow vulnerabilities
Re-entrancy and integer overflow are vulnerabilities that exist within the code of the smart contract itself. Threat modeling at this layer involves analyzing the application logic for such flaws. The other options (Sybil attacks, eclipse attacks, selfish mining) are primarily threats against the consensus and network layers of the blockchain protocol.
Question 4: A security analyst is performing a threat modeling exercise on a new DeFi lending protocol. The protocol uses a decentralized price oracle to determine asset values for collateralization. A potential threat identified is that an attacker could manipulate the oracle's price feed to cause unfair liquidations. Using the DREAD model to rate this threat, which component would likely score the highest?
- Reproducibility
- Discoverability
- Damage Potential (Correct answer)
- Affected Users
Correct answer: Damage Potential
The Damage Potential of a successful price oracle manipulation attack on a DeFi lending protocol is extremely high, as it could lead to the mass liquidation of user positions and the theft of millions of dollars in collateral. While other DREAD components are relevant, the potential for catastrophic financial loss makes Damage Potential the most significant factor.
Question 5: When creating a comprehensive threat model for a decentralized application (dApp), why is it insufficient to only analyze the on-chain components like smart contracts?
- Because smart contracts are immutable and cannot be changed once deployed.
- Because all dApp logic is contained within the smart contract.
- Because dApps also include off-chain components like web front-ends and wallets which introduce their own attack surfaces. (Correct answer)
- Because on-chain threat modeling is already handled by the blockchain's consensus mechanism.
Correct answer: Because dApps also include off-chain components like web front-ends and wallets which introduce their own attack surfaces.
A complete dApp architecture includes not just the on-chain smart contracts but also off-chain elements like user interfaces (web front-ends), wallets, and backend services that interact with the blockchain. These components have their own vulnerabilities (e.g., XSS, insecure key storage) that must be included in a holistic threat model.
Question 6: Which threat modeling methodology is specifically designed to focus on privacy-related threats, making it a valuable complement to STRIDE when analyzing blockchain systems that handle sensitive personal or enterprise data?
- PASTA
- CVSS
- DREAD
- LINDDUN (Correct answer)
Correct answer: LINDDUN
LINDDUN (Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance) is a threat modeling methodology that focuses specifically on privacy concerns. When analyzing a blockchain, STRIDE can identify technical security threats, while LINDDUN is used to assess privacy and data protection risks, which is crucial for enterprise and government deployments.
CBSE - Certified Blockchain Security Expert Blockchain Threat Modeling Questions and Answers 1
When applying the STRIDE threat model to a public, permissionless blockchain, which threat category would most accurately describe a 51% attack?