Network Layer, Consensus, Smart Contract, and Node Security Best Practices BDC Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A blockchain startup runs a small Ethereum validator node on a cloud VM. The node's JSON-RPC endpoint is exposed to the internet for a dApp, and the team has noticed a spike in failed connection attempts from many different IP addresses. The node is also configured to accept incoming peer connections from any IP. Which combination of measures would most directly reduce the risk of an eclipse attack while maintaining legitimate dApp access?

   • ARestrict JSON-RPC access to a whitelist of dApp server IPs and configure the node to connect only to a fixed set of trusted peers.
   • BSet the node's firewall to allow all inbound traffic on the P2P port and use a VPN for RPC traffic.
   • CDisable the JSON-RPC endpoint entirely and rely on a public gateway for dApp interactions.
   • DIncrease the node's maximum peer count and enable UPnP to improve network connectivity.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which vulnerability is inherent to proof-of-work (PoW) consensus when an attacker controls more than 50% of the network's hashing power?

   • AGrinding attack
   • BLong-range attack
   • C51% attack
   • DNothing-at-stake problem
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A DeFi protocol has just completed a smart contract audit. The audit report identifies a medium-severity reentrancy vulnerability in a withdrawal function. What is the most appropriate next step for the development team?

   • AFix the vulnerability, re-run the audit, and deploy after passing all tests.
   • BOnly fix the vulnerability if users complain about it.
   • CDeploy immediately because the vulnerability is only medium severity.
   • DIgnore the finding because the audit was not performed by a top-tier firm.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A smart contract has a function that allows users to claim rewards. The function currently uses a mapping to track whether a user has already claimed. A developer notices that a user could call the function multiple times before the state is updated, claiming rewards multiple times. Which best practice should be applied to fix this?

   • AUse a boolean flag to check if the user has claimed, but set it after the transfer.
   • BRely on the reward token's transfer function to prevent multiple claims.
   • CAdd a require statement that checks the user's balance is zero before allowing a claim.
   • DUpdate the mapping to mark the user as claimed before making the external reward transfer.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is threat modeling a new DeFi protocol that uses a PoS consensus with a BFT-based finality gadget. They identify a risk where an attacker with a large stake could influence finality. Which mitigation is most effective?

   • AReduce the number of validators to make consensus faster.
   • BIncrease the block time to give validators more time to vote.
   • CUse a random validator selection process without any penalties.
   • DImplement a slashing mechanism that penalizes validators for conflicting votes.
   Reveal Solution Discussion Select an answer first