Incident Response and Risk Mitigation BDC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   After a flash loan attack on a DEX, you are tracing the attacker's transactions. You see a series of swaps and a final transfer to a Tornado Cash-style mixer. Which forensic step is most useful for identifying the attacker's funding source?

   • ATrace the transaction graph backward from the attack contract to the first externally owned account (EOA) that funded it.
   • BAnalyze the mixer's smart contract bytecode to find the attacker's address.
   • CSubmit a request to the blockchain validator to revert the attack transaction.
   • DCheck the DEX's frontend logs for the attacker's IP address.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   After a major DeFi exploit, the protocol team must communicate with users, regulators, and the broader community. They have limited time and resources. What is the most effective communication strategy?

   • AOnly communicate with regulators and ignore the community.
   • BSend individual, tailored messages to every affected user.
   • CPublish a single, comprehensive post-mortem that addresses all stakeholders, then provide updates as new information emerges.
   • DDelay all communication until the investigation is complete.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   After a DeFi protocol is exploited, the team is developing a recovery plan. The plan includes restoring the protocol's operations and compensating affected users. Which element is most important to include in the recovery plan?

   • AA decision to permanently shut down the protocol to avoid future risks.
   • BA promise to compensate all users immediately, regardless of the investigation outcome.
   • CA plan to delete all on-chain data related to the exploit to prevent further attacks.
   • DA clear process for re-enabling the protocol after the vulnerability is fixed, including testing and user notification.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A DeFi protocol team is planning to launch a new lending product. They want to reduce the risk of smart contract exploits and also prepare for potential incidents. Which combination of measures is most appropriate for risk mitigation and incident readiness?

   • AConduct multiple independent audits, launch a bug bounty program, and establish an incident response plan with defined roles and communication channels.
   • BCreate a detailed incident response plan but postpone audits until after launch to save costs.
   • CRely solely on a single audit from a reputable firm and purchase insurance coverage for all potential losses.
   • DDeploy the contract without an audit to save time, but monitor on-chain activity closely for anomalies.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A DeFi protocol's monitoring system detects a series of transactions that appear to be a flash loan attack. The attack is ongoing, and the protocol has a governance timelock of 24 hours. The team needs to decide whether to attempt to pause the protocol or let the attack continue to gather evidence. What is the best decision?

   • ALet the attack continue to gather more evidence, then pause after the attack is complete.
   • BIgnore the attack because flash loan attacks are not considered serious.
   • CInitiate the pause process immediately, even though it will take 24 hours, and simultaneously begin on-chain analysis of the attack.
   • DAttempt to reverse the attack transactions by contacting miners or validators.
   Reveal Solution Discussion Select an answer first