Smart Contracts for Finance BFC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security auditor is reviewing a smart contract that manages a decentralized lending pool. The contract allows users to deposit collateral and borrow stablecoins. The auditor finds that the contract uses a 'transfer' function to send funds to users and that the contract's state is updated after the transfer. What is the most likely vulnerability, and what is the best remediation?

   • AInteger overflow; use SafeMath libraries.
   • BReentrancy; use a checks-effects-interactions pattern and a pull-payment mechanism.
   • CGas limit issues; increase the gas limit for the transaction.
   • DOracle manipulation; use a decentralized oracle.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A global remittance company wants to use a smart contract to settle cross-border payments. The company must comply with both the EU's GDPR and the US's sanctions list. The smart contract will process payments between EU residents and recipients in sanctioned countries. Which design is most appropriate?

   • AUse a smart contract that automatically blocks any transaction to a sanctioned country based on IP address.
   • BImplement an off-chain compliance layer that screens parties against sanctions lists before the smart contract executes the payment.
   • CStore all transaction data on-chain to provide full transparency to regulators.
   • DDeploy the smart contract on a public blockchain and rely on pseudonymity to avoid sanctions screening.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A cross-border payments company wants to use a smart contract to settle transactions between parties in the EU and a non-EU country. The company must ensure that personal data embedded in the contract does not violate GDPR transfer rules. Which action is most appropriate?

   • AEncrypt all personal data before storing it in the smart contract, assuming encryption makes it non-personal.
   • BKeep personal data off-chain and store only hashes or references in the smart contract.
   • CObtain explicit consent from every user to store their personal data on a public blockchain.
   • DDeploy the smart contract on a private blockchain located only in the EU to avoid any cross-border transfer.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A smart contract for a decentralized insurance protocol uses a price oracle to determine payouts. The team discovers that the oracle can be manipulated by an attacker who posts a large number of fake price updates. The team must choose a mitigation that balances security, cost, and decentralization. Which option is best?

   • AUse a time-weighted average price (TWAP) from a single exchange.
   • BRely on a single trusted oracle provided by a reputable company.
   • CAllow users to vote on the correct price before each payout.
   • DUse a decentralized oracle network with multiple independent nodes and a median price calculation.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A fintech company is deploying a smart contract for a tokenized real estate investment fund. The fund must comply with securities regulations that require investor accreditation checks before allowing purchases. The company also wants to allow secondary trading of the tokens. Which design best satisfies both requirements?

   • AUse a permissioned token contract that only allows transfers to addresses that have been pre-verified as accredited investors.
   • BRequire every transfer to be manually approved by the fund manager.
   • CIssue the tokens on a private blockchain and assume that private blockchains are exempt from securities laws.
   • DUse a public token contract with no transfer restrictions, assuming that buyers are responsible for their own compliance.
   Reveal Solution Discussion Select an answer first