Testing, Debugging, and Auditing Contracts BDC Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A developer is using a static analysis tool that reports a potential integer overflow in a Solidity contract compiled with version 0.8.0. The developer is surprised because Solidity 0.8.0 includes built-in overflow checks. What should the developer do?

   • ARun the static analysis tool again with a different configuration to suppress the warning.
   • BIgnore the report because Solidity 0.8.0 automatically prevents all overflows.
   • CReview the code to see if the overflow is in an `unchecked` block or in assembly code, which bypasses the built-in checks.
   • DDowngrade the compiler to 0.7.6 to avoid the issue.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is formal verification in the context of smart contracts?

   • AUsing a linter to check code style.
   • BMathematically proving that a contract's code satisfies specified properties.
   • CManually reviewing the code line by line.
   • DRunning the contract on a testnet to check for runtime errors.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A team has a limited budget for a security audit and must choose between a manual audit by a reputable firm and running automated static analysis tools. The contract is complex and handles significant value. What is the best approach?

   • AUse both: run automated tools first to catch obvious issues, then use the manual audit to focus on logic and business logic flaws.
   • BSkip the audit and rely on unit tests to ensure security.
   • COnly use a manual audit because automated tools are unreliable.
   • DOnly use automated tools because they are cheaper and cover all common vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A smart contract allows users to deposit Ether and later withdraw it. The `withdraw` function sends Ether to the caller and then updates the user's balance to zero. A security auditor flags this as a reentrancy vulnerability. What is the most effective remediation?

   • AIncrease the gas limit for the withdraw function to ensure the external call completes.
   • BUpdate the user's balance to zero before sending Ether, and use a reentrancy guard on the withdraw function.
   • CMake the withdraw function `external` instead of `public` to prevent internal calls.
   • DUse `transfer` instead of `call` to send Ether, and keep the balance update after the transfer.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a common mitigation for integer overflow vulnerabilities in Solidity?

   • AUsing the `assert` function to check for overflow.
   • BUsing the `require` function to check for overflow.
   • CIncreasing the gas limit for transactions.
   • DUsing SafeMath library or Solidity 0.8+ built-in overflow checks.
   Reveal Solution Discussion Select an answer first