DeFi Security and Audits Flashcards
7 cards from real Blockchain Technology practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 DeFi Security and Audits flashcards as text
In a flash loan attack, what makes the borrowed capital risk-free for the attacker?
Answer: The loan is borrowed and repaid within a single atomic transaction
Flash loans must be repaid in the same transaction, so if repayment fails the entire transaction reverts, leaving the attacker no downside.
A DeFi lending protocol uses a single DEX spot price as its oracle. What is the primary vulnerability?
Answer: Price oracle manipulation via large swaps or flash loans
Spot prices from a single liquidity pool can be skewed instantly by a large trade, letting an attacker manipulate collateral valuations.
Which mitigation best protects against oracle price manipulation?
Answer: Using a time-weighted average price (TWAP) or multiple oracle sources
TWAPs and aggregated oracles like Chainlink smooth out short-term price spikes, making single-transaction manipulation impractical.
What is 'impermanent loss' in an automated market maker (AMM)?
Answer: The loss a liquidity provider incurs versus simply holding the tokens when prices diverge
When the relative price of pooled assets changes, LPs end up with less value than if they had held the tokens, a divergence loss called impermanent loss.
An auditor finds a function that updates state after making an external call. What pattern should be enforced?
Answer: Checks-Effects-Interactions
Checks-Effects-Interactions requires updating internal state before any external call, preventing reentrancy exploitation.
What does a 'rug pull' typically involve in a DeFi project?
Answer: Developers draining pooled liquidity or minting unlimited tokens then disappearing
A rug pull is an exit scam where insiders remove liquidity or abuse mint privileges, leaving holders with worthless tokens.
Why is an unrestricted 'mint' function a critical audit finding?
Answer: It can inflate token supply and dilute or steal value from holders
If anyone or an unchecked admin can mint tokens freely, the supply can be inflated arbitrarily, destroying token value.