CCA Security, Risk, and Vulnerabilities 2 — Questions and Answers
Question 1: Which attack vector exploits the predictability of a smart contract's pseudo-random number generation (PRNG) to manipulate lottery or gambling outcomes?
- Front-running attack
- PRNG manipulation attack (Correct answer)
- Reentrancy attack
- Eclipse attack
Correct answer: PRNG manipulation attack
PRNG manipulation attacks exploit weak randomness sources like block hashes or timestamps that miners or validators can influence to predict or bias outcomes.
Question 2: In the context of cryptocurrency exchange security, what is a 'cold wallet' sweep attack?
- Draining hot wallets by compromising API keys
- Stealing funds by accessing air-gapped systems through physical intrusion or insider threat (Correct answer)
- Using malware to redirect withdrawal addresses
- Exploiting weak private key generation during wallet creation
Correct answer: Stealing funds by accessing air-gapped systems through physical intrusion or insider threat
A cold wallet sweep attack targets air-gapped or offline storage through insider threats, physical access, or supply chain compromise to extract private keys.
Question 3: What vulnerability is introduced when a Solidity smart contract uses 'tx.origin' for authentication instead of 'msg.sender'?
- Integer overflow
- Phishing via contract intermediary (Correct answer)
- Denial of service
- Timestamp dependence
Correct answer: Phishing via contract intermediary
Using tx.origin allows a malicious intermediary contract to trick the original sender into unknowingly authorizing transactions, enabling phishing attacks.
Question 4: Which risk category does 'validator centralization' fall under in a Proof-of-Stake blockchain?
- Operational risk
- Systemic/concentration risk (Correct answer)
- Regulatory risk
- Liquidity risk
Correct answer: Systemic/concentration risk
Validator centralization creates systemic concentration risk because a small group controlling majority stake can collude to censor transactions or perform 51% attacks.
Question 5: What is the primary security concern with 'infinite approval' patterns in ERC-20 token interactions with DeFi protocols?
- They increase gas costs significantly
- They allow protocols to drain a user's entire token balance if compromised (Correct answer)
- They violate ERC-20 standards
- They prevent token transfers between wallets
Correct answer: They allow protocols to drain a user's entire token balance if compromised
Infinite approvals grant a protocol unlimited spending rights over a user's tokens, meaning if the protocol contract is exploited, all approved tokens can be stolen.
Question 6: Which type of attack involves an adversary isolating a blockchain node by monopolizing all of its peer connections?
- Sybil attack
- Eclipse attack (Correct answer)
- BGP hijacking
- Time-bandit attack
Correct answer: Eclipse attack
An eclipse attack monopolizes a victim node's peer connections with attacker-controlled nodes, isolating it from the honest network and enabling double-spend or selfish mining attacks.
Question 7: During a cryptocurrency audit, an auditor finds that a exchange stores user seed phrases encrypted with a single master key. What is the primary risk identified?
- Regulatory non-compliance with AML requirements
- Single point of failure — compromise of the master key exposes all user seeds (Correct answer)
- Insufficient transaction monitoring
- Lack of multi-signature for withdrawals
Correct answer: Single point of failure — compromise of the master key exposes all user seeds
A single master key is a critical single point of failure; if it is compromised, all encrypted seed phrases become accessible, jeopardizing every user's funds.
CCA Security, Risk, and Vulnerabilities 2
Which attack vector exploits the predictability of a smart contract's pseudo-random number generation (PRNG) to manipulate lottery or gambling outcomes?