Testing, Debugging, and Auditing Contracts BDC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A developer is debugging a Solidity contract that is reverting unexpectedly during a transaction. The revert message is not informative. The developer wants to identify the exact line causing the revert. Which debugging technique is most effective?

   • AUse a debugger like Hardhat's `console.log` to add logging statements in the contract and run the transaction in a local development network to see the last log before the revert.
   • BRemove all `require` statements from the contract to see if the revert still occurs.
   • CUse a static analysis tool to scan the contract for common vulnerabilities.
   • DDeploy the contract to the mainnet and use a block explorer to view the transaction trace.
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   A developer wants to use a static analysis tool to detect potential security issues in a Solidity contract before deployment. Which tool is specifically designed for static analysis of Solidity code?

   • AGanache
   • BSlither
   • CTruffle
   • DRemix IDE
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security audit has identified a reentrancy vulnerability in a `withdraw` function. The developer is considering two fixes: (1) adding a reentrancy guard modifier, and (2) updating the balance before the external call. Which fix is more robust?

   • ABoth fixes are necessary; the reentrancy guard provides defense-in-depth, while updating the balance first follows the checks-effects-interactions pattern.
   • BNeither fix is sufficient; the contract should be rewritten to avoid external calls.
   • COnly the reentrancy guard is necessary because it blocks all reentrant calls.
   • DOnly updating the balance first is necessary because it eliminates the vulnerability entirely.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A developer is building a contract that interacts with an external ERC-20 token. The developer wants to write integration tests that verify the contract correctly handles the token's `transferFrom` call. Which approach is best?

   • AUse the real USDC contract on a public testnet and test against it.
   • BDeploy a mock ERC-20 token contract in the test environment and use it in the integration test.
   • CSkip integration testing and rely on static analysis to verify the interaction.
   • DWrite a unit test that mocks the token contract's `transferFrom` function using a mocking library.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a reentrancy attack in the context of smart contracts?

   • AAn attack where an attacker floods the network with transactions to cause a denial of service.
   • BAn attack where a malicious contract repeatedly calls a vulnerable function before the first call completes, potentially draining funds.
   • CAn attack where an attacker sends a transaction with a very high gas price to front-run a user's transaction.
   • DAn attack where an attacker exploits a bug in the compiler to generate incorrect bytecode.
   Reveal Solution Discussion Select an answer first