Wallets and Key Management Flashcards

What is the primary risk of storing a seed phrase in a cloud service like iCloud or Google Drive?

Answer: A breach or unauthorized access to the cloud account exposes the seed phrase and all associated funds

Storing a seed phrase in the cloud means it is only as secure as the cloud account; a compromised account password or cloud breach can drain the wallet.

In Ethereum, what is the difference between an Externally Owned Account (EOA) and a smart contract wallet?

Answer: EOAs are controlled by a private key; smart contract wallets are governed by on-chain code that can implement custom logic like multi-sig

EOAs are controlled by a single private key, while smart contract wallets run code on-chain and can enforce rules such as multi-signature approval or social recovery.

What does 'social recovery' mean in the context of smart contract wallets?

Answer: A mechanism allowing pre-designated 'guardians' to collectively restore wallet access if the owner loses their key

Social recovery lets a user designate trusted guardians who can vote to replace the signing key, enabling recovery without a traditional seed phrase backup.

What is a 'dusting attack' targeting cryptocurrency wallets?

Answer: Sending tiny amounts of crypto to wallets in order to link addresses and de-anonymize owners

Attackers send minuscule amounts (dust) to many addresses and then analyze how those funds move to cluster addresses and identify wallet owners.

Which metal backup material is generally considered MOST durable for long-term seed phrase storage?

Answer: Stainless steel or titanium plates

Stainless steel and titanium are highly resistant to fire, water, and corrosion, making them far more durable than paper or softer metals for long-term seed storage.

What is the purpose of 'xpub' (extended public key) sharing in an HD wallet?

Answer: It enables a third party to generate all child public addresses for monitoring without exposing private keys

An xpub lets services derive the full sequence of public addresses for a wallet, supporting watch-only monitoring or payment address generation without any spending capability.

What is the recommended approach when a hardware wallet displays an 'unverified' address during a receive operation?

Answer: Always confirm the address on the hardware wallet's own trusted screen before sharing it

Always verify addresses on the hardware wallet's built-in display to ensure malware on the host computer has not substituted a different, attacker-controlled address.