Attack Surfaces in Blockchain Ecosystems BDC Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is oracle manipulation in a DeFi protocol?

   • AAn attacker influences the data feed that the protocol uses to determine asset prices, causing it to act on false information
   • BAn attacker sends a transaction that reverts the oracle's update
   • CAn attacker steals the private keys of the oracle operator
   • DAn attacker changes the source code of the oracle smart contract
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A smart contract allows users to deposit tokens and then call a withdraw function that sends tokens to the caller. The contract updates the user's balance only after the external transfer. An attacker creates a malicious contract that re-enters the withdraw function before the balance is updated. Which vulnerability is being exploited, and what is the MOST direct fix?

   • AInteger overflow; use a safe math library for all arithmetic operations.
   • BOracle manipulation; use a decentralized oracle for token prices.
   • CAccess control flaw; add a modifier to restrict withdraw to whitelisted addresses.
   • DReentrancy; update the user's balance before making the external transfer.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A smart contract allows users to set a `uint8` variable to any value they choose. An attacker sets the value to 255 and then adds 1 to it. The contract does not check for overflow. What is the result?

   • AThe variable becomes 256, and the contract continues to operate normally.
   • BThe transaction reverts automatically because the EVM detects overflow.
   • CThe variable wraps around to 0, potentially bypassing access control checks that rely on the variable being a specific value.
   • DThe contract throws an exception and all changes are rolled back.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A small proof-of-work blockchain network has a hash rate of 100 TH/s. A mining pool controls 45% of the network's hash rate. The network's difficulty adjustment is slow, and the block reward is significant. The pool's operators are considering an attack to increase profits. Which attack is most feasible and profitable given these conditions?

   • AA Sybil attack: create many fake nodes to outvote honest nodes in the consensus process.
   • BA 51% attack: temporarily acquire 6% more hash power to exceed 50% and then double-spend transactions.
   • CSelfish mining: withhold discovered blocks to create a private chain and release them strategically to orphan honest blocks, gaining a revenue advantage.
   • DAn eclipse attack: isolate the pool's nodes from the rest of the network to manipulate the blocks they see.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A user stores their private keys in a plain text file on their computer. They also use the same computer to browse the internet and download software. One day, they notice unauthorized transactions from their wallet. Which threat is MOST likely the cause, and what is a better practice?

   • AEclipse attack; use a VPN to hide the user's IP address.
   • BPhishing; always verify the URL of the wallet website.
   • CSybil attack; use a multi-signature wallet.
   • DMalware; use a hardware wallet and keep the private keys offline.
   Reveal Solution Discussion Select an answer first