Attack Surfaces in Blockchain Ecosystems BDC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A smart contract has a function that allows users to set a 'manager' address. The function does not check if the caller is the current owner. An attacker calls this function and sets themselves as the manager, then calls a privileged function that only the manager can execute. Which vulnerability is this, and what is the MOST direct fix?

   • AAccess control flaw; add an owner-only modifier to the setManager function.
   • BOracle manipulation; use a decentralized oracle.
   • CReentrancy; update the manager before making an external call.
   • DInteger overflow; use a safe math library.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A blockchain node is configured to connect to a fixed set of peers. An attacker creates many fake nodes with the same IP addresses as the legitimate peers, causing the node to connect to the attacker-controlled nodes. The attacker then feeds the node false information about the blockchain state. Which attack is this, and what is a common defense?

   • A51% attack; increase the block size.
   • BSybil attack; require proof-of-work for all peers.
   • CDDoS attack; use rate limiting on incoming connections.
   • DEclipse attack; use a diverse set of peers and monitor for duplicate IPs.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An automated market maker (AMM) liquidity pool has a large imbalance in the ratio of two tokens. An attacker uses a flash loan to make a series of trades that exploit the pool's pricing formula, draining a significant portion of one token. Which type of DeFi risk is this, and what is a common mitigation?

   • AOracle manipulation; use a decentralized oracle for token prices.
   • BLiquidity pool exploit; use a more robust pricing formula and add slippage controls.
   • CSybil attack; require KYC for all liquidity providers.
   • DReentrancy attack; add a reentrancy guard to the swap function.
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A user receives a message on a social media platform from someone claiming to be a customer support agent for a popular wallet. The message says the user's wallet has been compromised and asks the user to click a link to 'verify' their private key. What is the most likely threat?

   • ASybil attack on the wallet's network
   • BDDoS attack on the wallet's servers
   • CEclipse attack on the user's node
   • DPhishing attack aimed at stealing the user's private key
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A user receives a direct message on social media from someone claiming to be a support agent for a popular cryptocurrency exchange. The agent says the user's account has been compromised and asks for the user's private key to 'verify ownership'. The user provides the key and later finds their funds stolen. Which attack vector is this, and what is the MOST effective prevention?

   • AMalware; install an antivirus and run a full system scan.
   • BSybil attack; use a hardware wallet to store the private key.
   • CEclipse attack; use a VPN to hide the user's IP address.
   • DSocial engineering; never share private keys with anyone, including support agents.
   Reveal Solution Discussion Select an answer first