Attack Surfaces in Blockchain Ecosystems BDC Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A DeFi protocol uses a price oracle that reads from a single DEX pool. An attacker uses a flash loan to manipulate the pool's price, causing the protocol to allow undercollateralized loans. The attacker then borrows a large amount of another asset and repays the flash loan, leaving the protocol with bad debt. Which combination of mitigations would be MOST effective?

   • AIncrease the collateral factor and require a longer loan duration.
   • BDeploy the protocol on a private blockchain with a smaller set of validators.
   • CAdd a reentrancy guard to the loan function and restrict flash loan usage.
   • DUse a TWAP oracle and add a maximum price deviation check against a secondary reference.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A blockchain project's core developers are targeted by a social engineering campaign. An attacker poses as a contributor and sends a malicious link to a developer, claiming it contains a proposal document. The developer clicks the link, which installs malware that steals their private key for the project's GitHub account. The attacker then pushes a malicious code change to the smart contract repository. Which combination of attacks is being used?

   • A51% attack and selfish mining; the attacker gained majority hash power to push code.
   • BEclipse attack and Sybil attack; the attacker isolated the developer's node and created fake identities.
   • CSocial engineering and malware; the attacker used phishing to deliver malware that stole credentials.
   • DFlash loan attack and oracle manipulation; the attacker manipulated prices to gain governance power.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A user's hardware wallet is lost. The user had written down the recovery seed phrase on a piece of paper and stored it in a safe. However, the user also took a photo of the seed phrase and stored it in their cloud drive. What is the most significant risk?

   • AThe hardware wallet could be found and used to access the funds.
   • BThe cloud drive could be compromised, exposing the seed phrase to attackers.
   • CThe paper copy could be stolen from the safe.
   • DThe user could forget the seed phrase.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A smart contract uses a variable to track the total supply of a token. The contract allows users to mint tokens by calling a function that increments the total supply. An attacker discovers that by calling the mint function with a very large value, the total supply wraps around to a small number, allowing them to mint an excessive amount. Which vulnerability is this, and what is the MOST direct fix?

   • AReentrancy; update the total supply before the mint function returns.
   • BOracle manipulation; use a decentralized oracle for token prices.
   • CInteger overflow; use a safe math library or check for overflow before updating.
   • DAccess control flaw; restrict the mint function to the owner.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A user receives an email that appears to be from a popular wallet provider, warning of a 'suspicious login' and asking the user to click a link to 'verify their recovery phrase'. The link leads to a fake website that looks identical to the real wallet site. The user enters their recovery phrase and later finds their funds stolen. Which attack vector was used, and what is the MOST effective prevention?

   • AEclipse attack; use a VPN to hide the user's IP address.
   • BSybil attack; use a hardware wallet to store the recovery phrase.
   • CPhishing; never enter recovery phrases on websites and always verify the URL's domain.
   • DMalware; install an antivirus and run a full system scan.
   Reveal Solution Discussion Select an answer first