CCA Smart Contract Auditing 2 — Questions and Answers
Question 1: Which smart contract vulnerability allows an attacker to repeatedly call a function and drain funds before the initial execution updates the contract state?
- Front-running
- Reentrancy (Correct answer)
- Integer overflow
- Access control bypass
Correct answer: Reentrancy
Reentrancy occurs when an external call is made before state updates, allowing attackers to re-enter the function and repeatedly withdraw funds.
Question 2: What is the primary purpose of a 'checks-effects-interactions' pattern in Solidity smart contracts?
- To optimize gas consumption
- To prevent reentrancy attacks by updating state before external calls (Correct answer)
- To validate input parameters first
- To enforce role-based access control
Correct answer: To prevent reentrancy attacks by updating state before external calls
The checks-effects-interactions pattern mitigates reentrancy by performing checks, then updating state (effects), and only then making external calls (interactions).
Question 3: During a smart contract audit, you identify that a mapping is never deleted after funds are transferred. What risk does this pose?
- Reentrancy vulnerability
- Unbounded storage growth leading to excessive gas costs (Correct answer)
- Front-running opportunity
- Oracle manipulation
Correct answer: Unbounded storage growth leading to excessive gas costs
Unmaintained mappings cause unbounded state growth that increases storage costs and can make contract operations prohibitively expensive over time.
Question 4: Which tool is specifically designed for formal verification of Ethereum smart contracts?
- Slither
- Mythril
- Certora Prover (Correct answer)
- Echidna
Correct answer: Certora Prover
Certora Prover uses formal verification to mathematically prove that a smart contract satisfies specified properties under all conditions.
Question 5: A smart contract uses `tx.origin` for authentication. What attack does this enable?
- Sandwich attack
- Phishing via malicious intermediary contract (Correct answer)
- Signature replay attack
- Flash loan attack
Correct answer: Phishing via malicious intermediary contract
`tx.origin` returns the original transaction sender, so a malicious contract can trick the original user into calling it, then use `tx.origin` to impersonate them.
Question 6: What is 'gas griefing' in the context of smart contract security?
- Paying excessive gas to front-run transactions
- An attack where a caller sends just enough gas to cause a sub-call to fail (Correct answer)
- Exploiting gas refunds to extract value
- A denial-of-service by spamming the mempool
Correct answer: An attack where a caller sends just enough gas to cause a sub-call to fail
Gas griefing occurs when an attacker provides insufficient gas so that a sub-call fails, potentially causing the parent transaction to behave unexpectedly.
Question 7: Which of the following best describes a 'proxy upgrade' vulnerability in smart contracts?
- Incorrect event emissions after an upgrade
- Storage slot collisions between proxy and implementation contracts (Correct answer)
- Insufficient gas for upgrade transactions
- Missing fallback functions in the proxy
Correct answer: Storage slot collisions between proxy and implementation contracts
Storage slot collisions happen when the proxy and implementation contracts use the same storage slots for different variables, causing data corruption.
CCA Smart Contract Auditing 2
Which smart contract vulnerability allows an attacker to repeatedly call a function and drain funds before the initial execution updates the contract state?