CBSE DeFi and Token Security 1 — Questions and Answers
Question 1: What is a flash loan attack in the context of DeFi security?
- An attack that overloads the network with loan requests
- Borrowing a large uncollateralized loan within a single transaction to manipulate prices and exploit protocols (Correct answer)
- A social engineering attack targeting loan officers
- A front-running attack on lending protocol liquidations
Correct answer: Borrowing a large uncollateralized loan within a single transaction to manipulate prices and exploit protocols
Flash loans are repaid within one transaction; attackers use the temporary capital to manipulate oracle prices or drain protocol reserves.
Question 2: Which vulnerability type allows an attacker to repeatedly call a DeFi protocol's withdrawal function before the balance is updated?
- Integer overflow
- Reentrancy (Correct answer)
- Front-running
- Signature replay
Correct answer: Reentrancy
Reentrancy exploits occur when external contract calls are made before state changes, allowing recursive withdrawals that drain funds.
Question 3: What is price oracle manipulation in DeFi, and why is it dangerous?
- Altering block timestamps to change staking rewards
- Using flash loans or low-liquidity pools to distort on-chain price feeds, causing protocols to mis-price assets (Correct answer)
- Intercepting API calls between oracles and exchanges
- Modifying the Chainlink node software
Correct answer: Using flash loans or low-liquidity pools to distort on-chain price feeds, causing protocols to mis-price assets
Manipulated oracles cause lending protocols to accept inflated collateral or release excess funds, enabling massive theft in a single transaction.
Question 4: A token contract includes a hidden mint function accessible only to the deployer. What security risk does this represent?
- Increased gas costs for transfers
- A backdoor allowing unlimited token creation, enabling rug pulls and inflation attacks (Correct answer)
- Slower block confirmation times
- Reduced ERC-20 compliance
Correct answer: A backdoor allowing unlimited token creation, enabling rug pulls and inflation attacks
Hidden privileged mint functions are a common rug pull vector, allowing the deployer to devalue existing holders by inflating supply at will.
Question 5: What is a 'sandwich attack' in DeFi trading?
- An attack that wraps malicious code around legitimate contract calls
- Front-running a victim's transaction and back-running it to profit from the price impact (Correct answer)
- A double-spend attempt on AMM pools
- A Sybil attack on liquidity providers
Correct answer: Front-running a victim's transaction and back-running it to profit from the price impact
In a sandwich attack, the attacker places a buy before and a sell after the victim's trade, profiting from the slippage they create.
Question 6: Which ERC standard is specifically designed to prevent token approval exploits by introducing permit-based approvals?
- ERC-20
- ERC-2612 (Correct answer)
- ERC-721
- ERC-1155
Correct answer: ERC-2612
ERC-2612 adds a permit() function that uses off-chain signatures for approvals, eliminating the unlimited approval attack surface.
CBSE DeFi and Token Security 1
What is a flash loan attack in the context of DeFi security?