Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About EY hiring for Blockchain roles
EY is one of the Big Four professional services networks, offering assurance, tax, strategy and transactions, and consulting services. In India, EY GDS and EY member firms support global clients with technology consulting, data analytics, cybersecurity and risk work. It hires for analyst and consultant roles in data analytics, BI, testing, ERP and risk.
For Blockchain roles, this EY practice set focuses most on dApp Development (7), Smart Contract Security (6), Consensus and Scaling (5), Ethereum and the EVM (4). It has 5 easy, 21 medium, 4 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
London, United Kingdom
Main India offices
Bengaluru, Kolkata, Gurugram, Hyderabad, Kochi
EY Blockchain interview process
Online assessment (aptitude + technical)
Technical interview
Managerial or case round
Partner or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for EYStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
After a transaction is confirmed, your front-end still shows old data. How do you fix it?
The UI is probably reading cached results or a lagging RPC node. After tx.wait() resolves, explicitly refetch or invalidate the relevant queries, for example with wagmi or TanStack Query invalidation. Show optimistic updates while pending. If you use an indexer, it may lag by a few blocks, so poll until it reaches the receipt's block number. Use the same RPC endpoint for writes and immediate reads, and avoid long caching for balances.
02
What are the basic Foundry commands to create, build, test and work with a project?
curl -L https://foundry.paradigm.xyz | bash && foundryup
forge init my-dapp # new project with src, test, script
forge install OpenZeppelin/openzeppelin-contracts
forge build # compile
forge test -vvv # run tests with traces
forge coverage # coverage report
forge snapshot # gas snapshot
anvil # local node
cast call ADDR 'count()(uint256)' --rpc-url $RPC
Foundry tests are written in Solidity and run fast; Hardhat is the JavaScript or TypeScript alternative with a large plugin ecosystem.
03
Explain storage, memory, stack and calldata in the EVM.
Storage is persistent key-value data of 32-byte slots per contract; it is the most expensive, and writes to new slots cost about 20,000 gas. Memory is a temporary byte array cleared after each call, cheap but growing in cost quadratically. The stack holds up to 1024 words for opcode operands. Calldata is the read-only input data of the transaction, the cheapest place to read external function arguments from. Choosing the right location is a key gas optimisation.
04
What is the difference between CREATE and CREATE2?
CREATE computes a new contract's address from the deployer's address and nonce, so the address depends on deployment order. CREATE2 computes it from the deployer address, a chosen 32-byte salt and the hash of the init code, so the address is known before deployment and is the same wherever those inputs match. CREATE2 enables counterfactual wallets, deterministic factory deployments and same-address deployments across chains, but redeploying at the same address needs care.
05
Your team is preparing a contract for an external audit. What do you do beforehand?
Freeze the code at a commit and stop adding features. Write clear documentation: architecture, roles, trust assumptions, invariants and known risks. Reach high test coverage including fuzz and invariant tests, and run Slither and fix its findings. Remove dead code, add NatSpec comments, and make the build reproducible. Share a scope list and a walkthrough call. A clean, well-documented codebase lets auditors spend their limited time on deep logic bugs.
06
What are front-running and sandwich attacks, and how do you mitigate them?
Pending transactions are public, so bots can copy or outbid them. Front-running is placing a transaction ahead of a victim's, for example buying before a large purchase. A sandwich attack buys before the victim's swap and sells right after, profiting from the price impact. Mitigations include slippage limits and deadlines, commit-reveal schemes, batch auctions, private transaction relays, and design that does not reward ordering, such as using time-weighted prices.
07
Show a contract vulnerable to reentrancy and a fixed version.
Situation: a business head wanted 'blockchain' in a vendor portal because competitors mentioned it. Task: help him decide. Action: I compared it to a shared online spreadsheet that nobody can secretly edit, then showed cost, speed and privacy trade-offs against a normal database with audit logs. Result: we agreed to keep the portal on a database and anchor monthly hashes of invoices on a chain for proof, saving months of work while meeting the trust goal.
The ABI (Application Binary Interface) is the JSON description of a contract's functions, events and errors, and it defines how arguments are encoded. A function selector is the first four bytes of the Keccak-256 hash of the function signature, for example transfer(address,uint256) gives 0xa9059cbb. Calldata is the selector followed by ABI-encoded arguments in 32-byte words. Wallets, ethers.js and explorers use the ABI to encode calls and decode results and events.
10
How should NFT metadata and tokenURI be structured?
tokenURI(id) returns a URI, usually ipfs://<CID>/<id>.json, pointing to JSON that marketplaces read:
{
"name": "Course Certificate #12",
"description": "Completed Blockchain Developer course",
"image": "ipfs://bafy.../12.png",
"attributes": [
{ "trait_type": "Grade", "value": "A" },
{ "trait_type": "Year", "value": 2026 }
]
}
Store images and JSON on IPFS or Arweave rather than a normal server, so metadata cannot silently change or disappear.
11
What are Delegated Proof of Stake and Proof of Authority?
In Delegated Proof of Stake, token holders vote for a small set of block producers who validate on their behalf, giving high throughput but more centralisation. In Proof of Authority, a fixed set of known, reputable validators sign blocks; their identity, not stake, is at risk. PoA, often via Clique, IBFT or QBFT, suits private and consortium EVM networks and some testnets, where participants are known and fast, predictable block times matter more than open participation.
12
What is the difference between an execution client and a consensus client, and why does client diversity matter?
Since the Merge, an Ethereum node runs two pieces of software. The execution client, such as Geth, Nethermind, Besu, Erigon or Reth, runs the EVM, holds state and handles transactions. The consensus client, such as Lighthouse, Prysm, Teku, Nimbus or Lodestar, runs Proof of Stake. They talk over the Engine API. Client diversity matters because a bug in a client used by over two-thirds of validators could finalise an invalid chain and cause mass slashing.
13
How did you handle a time you received critical code review feedback?
Situation: a senior reviewer rejected my pull request for a staking feature, saying the storage layout would break future upgrades. Task: fix it and learn. Action: I thanked him, asked him to explain the risk, read about EIP-1967 and storage gaps, rewrote the contract with namespaced storage, and added a storage-layout check to CI. Result: the PR merged, and that check later caught a teammate's layout change before an upgrade.
14
How do you handle unclear or changing requirements from a client?
Situation: a client asked for a marketplace dApp but kept changing royalty and fee rules. Task: deliver without endless rework. Action: I wrote a short spec with examples and edge cases, got sign-off, and made fees configurable parameters with limits instead of hard-coded logic. Changes went through a simple change log with impact estimates. Result: we delivered in eight weeks, and later fee changes needed only a governance transaction, not a redeployment.
15
Users complain they must pay gas to approve tokens before every trade. How can signatures help?
Use off-chain signed approvals. With EIP-2612 permit, the user signs a typed EIP-712 message granting an allowance, and the dApp submits it with the trade in one transaction, so no separate approve call is needed. For tokens without permit, Permit2-style contracts give the same experience after one approval. EIP-712 shows readable fields in the wallet, reducing phishing risk. Always include a nonce, deadline, chain ID and verifying contract to prevent replays.
16
The business wants to change contract logic after launch. How do you plan for it?
Decide early whether upgradeability is needed, because it adds trust and storage risks. Options are a proxy (UUPS or Transparent) controlled by a multisig with a timelock, a parameter-driven design where only settings like fees change through governed setters, or a migration plan to a new immutable version. Whatever you choose, document it for users, protect upgrade rights, keep storage layout append-only, and test each upgrade on a fork before executing.
17
Your protocol is being exploited right now. What do you do?
Act fast with a prepared runbook. Pause affected contracts through the guardian or multisig, and disable front-end actions. Gather the core team and security partners in a war room. Trace the attack transactions to understand the bug and estimate losses, and check whether a white-hat rescue of remaining funds is needed. Communicate publicly with facts and no speculation, contact exchanges and bridges to flag stolen funds, then fix, audit the fix and publish a post-mortem.
18
How do you call read and write functions of a contract with ethers v6?
Pass the block tag to getBlock. The finalized tag returns the latest block that Proof of Stake has finalised, which cannot be reverted without slashing a third of stake.
import { JsonRpcProvider } from 'ethers';
const provider = new JsonRpcProvider(process.env.RPC_URL);
const latest = await provider.getBlock('latest');
const safe = await provider.getBlock('safe');
const finalized = await provider.getBlock('finalized');
console.log(latest.number - finalized.number); // usually about 64-96
Use finalized for deposits and accounting; use latest for UI updates.
20
Which tools do you use for static analysis and fuzzing of smart contracts?
Slither performs static analysis and quickly flags reentrancy, unchecked calls, shadowing and more. Aderyn is another fast static analyser. Foundry provides fuzz and invariant testing, where random sequences of calls try to break properties you define. Echidna and Medusa are property-based fuzzers. Mythril and Halmos use symbolic execution, and Certora offers formal verification. Combining them with manual review and high test coverage catches far more than any single tool.
21
Calculate the output of a swap in a constant product pool with a 0.3 percent fee.
Formula: amountOut = (amountIn x 997 x reserveOut) / (reserveIn x 1000 + amountIn x 997).
Example: reserves 1,000 ETH and 3,000,000 USDC, swap 10 ETH.
amountInWithFee = 10 x 997 = 9,970
numerator = 9,970 x 3,000,000 = 29,910,000,000
denominator = 1,000 x 1000 + 9,970 = 1,009,970
amountOut = 29,615 USDC (approx)
The spot price is 3,000, but the trader gets about 2,961.5 per ETH because of fee and price impact.
22
What are storage collision and uninitialised implementation risks in proxies?
With delegatecall, the implementation's code writes to the proxy's storage. If the proxy stores its admin or implementation address in a normal slot, implementation variables can overwrite it, so EIP-1967 uses pseudo-random slots. New implementation versions must only append variables, or use namespaced storage (ERC-7201). Implementations must also disable initialisers in their constructor; otherwise an attacker can initialise the implementation directly, take ownership and, in UUPS, potentially destroy or hijack it.
23
How do you compute a function selector and decode calldata with cast?
cast handles ABI work from the command line.
# Function selector
cast sig 'transfer(address,uint256)'
# 0xa9059cbb
# Encode calldata
cast calldata 'transfer(address,uint256)' 0xAbc... 1000000
# Decode calldata from a transaction
cast 4byte-decode 0xa9059cbb000000...
# Decode with a known signature
cast decode-calldata 'transfer(address,uint256)' 0xa9059cbb...
This is useful when checking what a wallet is really asking you to sign.
24
You are launching a 10,000-piece NFT collection and fear gas wars and bots. How do you design the mint?
Avoid a first-come public rush. Use an allowlist phase with Merkle proofs or signatures, per-wallet limits, and staggered time slots. Consider a Dutch auction or raffle so price, not gas, decides allocation. Use ERC-721A or efficient batch minting to cut gas. Reveal traits later with Chainlink VRF so bots cannot snipe rare items. Load-test the front-end and RPC, and keep pause functions ready in case something goes wrong.
25
How do you manage deployer private keys in a CI/CD pipeline?
Never commit keys or put them in plain environment files. For testnets, use CI secret storage with restricted access. For mainnet, avoid hot keys in CI entirely: have CI produce a transaction proposal that signers approve in a multisig, or use a cloud KMS or HSM signer so the key never leaves secure hardware. Separate deployer and admin roles, transfer ownership to a multisig immediately after deployment, and log and review every deployment.
26
What are state channels, such as the Lightning Network?
A state channel locks funds in an on-chain contract or multisig between parties, who then exchange many signed off-chain updates and settle only the final state on-chain. Lightning on Bitcoin links channels into a network so payments route through intermediaries using hashed timelock contracts. Channels give instant, nearly free payments but need participants to be online or use watchtowers, and they lock liquidity, so they suit repeated payments between known parties rather than general smart contracts.
27
A fee-on-transfer token breaks your DEX's accounting. What happened and how do you fix it?
Fee-on-transfer tokens deduct a percentage on every transfer, so when your contract calls transferFrom for 100 tokens it may receive only 98. If the code assumes 100 arrived, balances and reserves drift and can be exploited. Fix it by measuring the actual amount received: read the contract's balance before and after the transfer and use the difference. Also decide whether to support such tokens at all and document unsupported token behaviours like rebasing.
28
Your staking validator is missing attestations and losing rewards. How do you investigate?
Check that both execution and consensus clients are synced and peering well, since low peer count or a lagging execution client causes missed duties. Look at system clock sync through NTP, CPU, memory and disk I/O, as slow disks often cause delays. Review client logs and metrics in Grafana, check for pending client upgrades before a fork, and verify network ports are open. Never start a second copy of the same validator key as a fix, because that causes slashing.
29
How do you verify a deployed contract's source code on a block explorer?
Verification uploads source and compiler settings so the explorer can recompile and match the bytecode, letting users read the code.
# Foundry, using an explorer API key
forge verify-contract 0xDeployedAddr src/Counter.sol:Counter \
--chain sepolia --etherscan-api-key $KEY --watch
# With constructor arguments
--constructor-args $(cast abi-encode 'constructor(address)' 0xOwner)
# Hardhat
npx hardhat verify --network sepolia 0xDeployedAddr 0xOwner
Compiler version, optimiser runs and via-IR settings must match exactly.
30
Users report their USDC balance shows as a tiny fraction in your dApp. What is wrong?
USDC uses 6 decimals, but the front-end probably formats every token with 18 decimals, so 100 USDC (100,000,000 base units) displays as 0.0000000001. Read decimals() from each token contract, or from a trusted token list, and use formatUnits and parseUnits with that value. Use bigint for amounts, never JavaScript floats, to avoid precision errors. Add tests with tokens of 6, 8 and 18 decimals.
Tips to crack the EY Blockchain interview
Practise explaining a data project in business terms, focusing on the problem, approach and recommendation for the client.
Revise Excel, SQL and Power BI, which appear frequently in EY analytics and consulting job descriptions.
Read about EY's service lines and its focus on technology, AI and sustainability consulting for fit questions.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; EY interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the EY Blockchain interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical interview; Managerial or case round; Partner or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the EY Blockchain interview?
This practice set leans on dApp Development (7), Smart Contract Security (6), Consensus and Scaling (5), Ethereum and the EVM (4). Revise those first, then practise explaining one or two of your own projects end to end, because most EY interviewers ask you to walk through real work.
Are these the exact questions asked at EY?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like EY's. They are not a leaked or verified list of past questions.
Where does EY hire Blockchain professionals in India?
EY has large teams in Bengaluru, Kolkata, Gurugram, Hyderabad, Kochi. Openings and locations change often, so check the EY careers page and filter by city and experience.