Blockchain Interview Questions for 1 Year Experience
40 questions with answers for candidates with 1 year of experience — 15 easy, 22 medium, 3 hard.
What interviewers expect: 1 year experience
With one year of experience, you are expected to write production-quality contracts with tests, use Foundry or Hardhat confidently, and integrate contracts with a front-end or back-end. Questions cover gas optimisation, events, error handling, OpenZeppelin usage, deployment and verification. You should explain bugs you have fixed and how you reviewed code, and show familiarity with common vulnerabilities.
This set is weighted towards Smart Contract Security (8), Solidity Programming (6), Consensus and Scaling (6), DeFi, Tokens and NFTs (5).
Testing with Foundry ethers.js or viem integration Gas optimisation Common vulnerabilities
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
In the UTXO model used by Bitcoin, coins exist as unspent transaction outputs; a transaction consumes some outputs and creates new ones, which makes parallel validation and privacy easier. In the account model used by Ethereum, the state stores a balance and nonce per account, which is simpler for smart contracts and wallets. The trade-off: UTXO avoids replay issues and scales verification well, while accounts make complex stateful logic far easier to write.
02
A function that distributes rewards loops over all users and is getting too expensive. How do you fix it?
Unbounded loops eventually exceed the block gas limit. Switch to a pull-based accounting model: maintain a global reward-per-token accumulator that grows when rewards are added, and store each user's last checkpoint. Users claim with reward equals balance times (current accumulator minus their checkpoint). This makes distribution O(1) for any number of users. Alternatively, use a Merkle distributor where rewards are computed off-chain and users claim with proofs.
03
A user approved unlimited token spending to a scam site. What should they do?
Revoke the approval immediately using a token approval checker or by calling approve(spender, 0) from the wallet, because the malicious contract can pull tokens any time. If a drain has started, move remaining assets to a fresh wallet. Check for other suspicious approvals and NFT setApprovalForAll permissions. Going forward, approve exact amounts, read wallet prompts carefully, use a separate hot wallet for new dApps, and prefer wallets that simulate transactions before signing.
04
How do you read a Chainlink price feed in Solidity safely?
curl -L https://foundry.paradigm.xyz | bash && foundryup
forge init my-dapp # new project with src, test, script
forge install OpenZeppelin/openzeppelin-contracts
forge build # compile
forge test -vvv # run tests with traces
forge coverage # coverage report
forge snapshot # gas snapshot
anvil # local node
cast call ADDR 'count()(uint256)' --rpc-url $RPC
Foundry tests are written in Solidity and run fast; Hardhat is the JavaScript or TypeScript alternative with a large plugin ecosystem.
06
You need to send ETH to hundreds of winners. Should you push payments or let them pull?
Prefer pull payments. If a contract pushes ETH in a loop, one recipient that reverts, perhaps a contract without receive, can block everyone, and the loop may exceed the gas limit. With pull payments, the contract records each winner's amount in a mapping and winners call withdraw, which zeroes their balance before sending. This isolates failures and limits reentrancy risk. Push only for small fixed lists using call with a checked result.
07
An auditor flags that a single owner key can mint tokens and change fees. How do you address it?
This is centralisation risk: if the key is compromised or misused, users lose funds. Move ownership to a multisig with signers on separate devices, add a timelock so users can see and react to changes, set hard-coded bounds such as a maximum fee, and remove powers that are not needed, like unlimited minting. Use role-based access instead of one all-powerful owner, and document the remaining admin powers publicly.
08
Four organisations are building a private EVM network. Which consensus would you pick: Raft or QBFT?
Raft is crash fault tolerant: fast and simple, but it assumes no node lies, so it fits when all members trust each other's infrastructure. QBFT is Byzantine fault tolerant and tolerates f malicious nodes out of 3f+1, so with four validators it survives one bad actor and gives immediate finality. Since the organisations are separate businesses that may not fully trust each other, I would choose QBFT and run at least four validators, ideally more.
09
Explain public, external, internal and private visibility.
public functions can be called externally and internally, and public state variables get an automatic getter. external functions can only be called from outside, or via this.f(), and read arguments directly from calldata. internal functions and variables are available to the contract and contracts that inherit it. private is limited to the defining contract only. Note that private only restricts other contracts; the data is still fully visible on the blockchain to anyone.
Reentrancy happens when a contract makes an external call, such as sending ETH, before updating its own state, and the receiver calls back into the contract to repeat the action. For example, a withdraw that sends funds and then sets the balance to zero can be re-entered to withdraw many times. The 2016 DAO hack drained millions this way. Prevent it with checks-effects-interactions, reentrancy guards, and pull payments.
11
What is Ethereum and how is it different from Bitcoin?
Ethereum is a programmable blockchain: besides transferring its native currency ETH, it runs smart contracts, which are programs stored on-chain that execute exactly as written. Bitcoin focuses on being secure, scarce digital money with a deliberately limited scripting language and the UTXO model. Ethereum uses an account model, Proof of Stake since 2022, about 12-second blocks, and a large ecosystem of tokens, DeFi, NFTs and Layer 2 rollups built on top.
12
How are mappings stored, and why can you not iterate over them?
A mapping does not store keys. The value for key k in a mapping declared at slot p lives at storage slot keccak256(k . p). Every possible key implicitly exists with a default zero value, so the contract cannot know which keys were set or how many. To iterate, keep a separate array of keys or use OpenZeppelin EnumerableSet or EnumerableMap, accepting extra gas, or rebuild the list off-chain from emitted events.
It is an ordering rule for functions. First do checks: validate inputs, permissions and balances with require. Then apply effects: update all state variables, such as reducing the user's balance. Only then do interactions: external calls, token transfers or ETH sends. Because state is already updated, a re-entering call sees the new state and cannot repeat the action. Combine it with a nonReentrant modifier for defence in depth, especially in functions calling unknown contracts.
14
Your RPC provider starts rate-limiting and the dApp breaks during peak traffic. What do you do?
Short term, add a fallback transport with multiple providers so requests fail over automatically, and use retries with backoff. Reduce load: batch calls with multicall, cache read results, use WebSockets instead of tight polling, and move history queries to an indexer. Long term, upgrade the plan, spread traffic across providers or run your own node for critical paths, and monitor error rates and latency with alerts so you learn of issues before users do.
15
Describe a time you disagreed with a teammate about architecture.
Situation: a teammate wanted our indexer to read every event directly from the node at request time. Task: I believed it would not scale. Action: instead of arguing, I proposed a one-day spike, measured both approaches with realistic data, and shared numbers showing the database-backed indexer answered queries 40 times faster. Result: the team chose the indexer, my teammate led its reorg handling, and we agreed to settle future debates with quick experiments.
A 51 percent attack happens when one party controls a majority of mining power or stake. It can then reorder or exclude transactions, censor users and double spend by building a longer private chain that replaces recent blocks. It cannot steal coins from other addresses or forge signatures. Large chains like Bitcoin and Ethereum make it extremely expensive, but small PoW chains have suffered such attacks, which is why exchanges require many confirmations on them.
DeFi, decentralised finance, means financial services such as trading, lending, borrowing, stablecoins and derivatives built as smart contracts on public blockchains. Anyone with a wallet can use them without a bank account or approval, contracts are transparent, and protocols can be combined like building blocks. Examples are automated market maker exchanges, overcollateralised lending markets and liquid staking. The risks are smart contract bugs, oracle failures, volatile collateral and unclear regulation.
18
Write a basic voting contract using a struct, mapping and event.
Recompute the message hash, add the Ethereum signed message prefix, recover the signer and compare it.
import {ECDSA} from '@openzeppelin/contracts/utils/cryptography/ECDSA.sol';
import {MessageHashUtils} from '@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol';
function verify(address signer, uint256 amount, uint256 nonce, bytes calldata sig) public view returns (bool) {
bytes32 h = keccak256(abi.encode(address(this), block.chainid, amount, nonce));
bytes32 eth = MessageHashUtils.toEthSignedMessageHash(h);
return ECDSA.recover(eth, sig) == signer;
}
Track used nonces to block replays.
20
What is the difference between SHA-256 and Keccak-256?
SHA-256 is from the SHA-2 family and uses a Merkle-Damgard construction; Bitcoin uses double SHA-256 for block hashes and transaction IDs. Keccak-256 is based on the sponge construction and is what Ethereum uses for addresses, function selectors, event topics and storage slots. Ethereum's Keccak-256 is the original Keccak submission and differs from the final NIST SHA3-256 in padding, so the two give different outputs for the same input.
21
What is the difference between optimistic rollups and zk-rollups?
Optimistic rollups assume batches are valid and allow a challenge window, typically about seven days, during which anyone can submit a fraud proof; this makes them EVM-compatible and simpler but slows native withdrawals. Zk-rollups submit a validity proof with each batch, so L1 verifies correctness mathematically and withdrawals finalise once the proof is accepted. Zk proving is computationally heavy and EVM equivalence was harder, though zkEVMs have matured a lot by 2026.
22
Explain public, private and consortium blockchains.
A public blockchain such as Bitcoin or Ethereum lets anyone read, transact and run a validator. A private blockchain is run by one organisation that controls who joins, useful for internal audit trails. A consortium (permissioned) blockchain is governed by a group of organisations, for example several banks sharing trade-finance data on Hyperledger Fabric. Public chains give maximum decentralisation; permissioned chains give privacy, known identities and higher throughput.
23
A transaction keeps failing with an out of gas error. How do you fix it?
First see whether the gas limit was too low or the function is genuinely unbounded. Run eth_estimateGas or simulate with cast run or Tenderly to see actual gas used and where it fails. If estimation is fine, raise the limit with a buffer of 10 to 20 percent. If the function loops over a growing array, redesign it with pagination or pull-based patterns, because the block gas limit will eventually make it impossible to call.
24
What is the difference between an execution client and a consensus client, and why does client diversity matter?
Since the Merge, an Ethereum node runs two pieces of software. The execution client, such as Geth, Nethermind, Besu, Erigon or Reth, runs the EVM, holds state and handles transactions. The consensus client, such as Lighthouse, Prysm, Teku, Nimbus or Lodestar, runs Proof of Stake. They talk over the Engine API. Client diversity matters because a bug in a client used by over two-thirds of validators could finalise an invalid chain and cause mass slashing.
25
What is the difference between a full node, a light node and an archive node?
A full node downloads and validates every block and keeps the current state, so it can verify everything independently. A light node stores only block headers and asks full nodes for Merkle proofs of the data it needs, which suits mobile wallets. An archive node keeps all historical states, so you can query a balance at any past block; indexers and block explorers need it, but it requires many terabytes of storage.
26
You need the same contract at the same address on five chains. How do you do it?
Use CREATE2 through a deterministic deployment factory that already exists at the same address on all those chains. Keep the init code identical: same compiler version, optimiser settings, constructor arguments and metadata. Pick a salt, compute the expected address off-chain, then deploy on each chain. Foundry scripts support this by passing a salt. Avoid constructor arguments that differ per chain, or move chain-specific settings into an initialiser restricted to the deployer.
27
How do you get current fee data and send an EIP-1559 transaction with ethers.js?
Verification uploads source and compiler settings so the explorer can recompile and match the bytecode, letting users read the code.
# Foundry, using an explorer API key
forge verify-contract 0xDeployedAddr src/Counter.sol:Counter \
--chain sepolia --etherscan-api-key $KEY --watch
# With constructor arguments
--constructor-args $(cast abi-encode 'constructor(address)' 0xOwner)
# Hardhat
npx hardhat verify --network sepolia 0xDeployedAddr 0xOwner
Compiler version, optimiser runs and via-IR settings must match exactly.
Fiat-backed stablecoins hold cash and short-term government bonds off-chain, one dollar per token, and depend on the issuer's audits and redemptions. Crypto-collateralised stablecoins are minted against overcollateralised crypto in smart contracts, such as vaults requiring 150 percent collateral. Algorithmic stablecoins try to hold the peg with supply rules and incentives; several have collapsed, the most famous in 2022. Choose based on trust model, liquidity, transparency and regulatory status.
30
Calculate the output of a swap in a constant product pool with a 0.3 percent fee.
Formula: amountOut = (amountIn x 997 x reserveOut) / (reserveIn x 1000 + amountIn x 997).
Example: reserves 1,000 ETH and 3,000,000 USDC, swap 10 ETH.
amountInWithFee = 10 x 997 = 9,970
numerator = 9,970 x 3,000,000 = 29,910,000,000
denominator = 1,000 x 1000 + 9,970 = 1,009,970
amountOut = 29,615 USDC (approx)
The spot price is 3,000, but the trader gets about 2,961.5 per ETH because of fee and price impact.
31
What are the main components of Hyperledger Fabric?
Hyperledger Fabric is a permissioned enterprise framework. Peers hold the ledger and run chaincode (smart contracts written in Go, Java or JavaScript). Orderers, usually using Raft, sequence transactions into blocks. A Membership Service Provider issues identities through certificate authorities. Channels give separate private ledgers to subsets of members, and private data collections hide data inside a channel. Fabric uses an execute-order-validate flow with endorsement policies instead of mining.
32
What is the difference between view, pure and payable functions?
A view function reads state but does not modify it, so it is free when called off-chain via eth_call. A pure function neither reads nor modifies state and works only on its inputs, for example a math helper. A payable function can receive ETH along with the call; non-payable functions revert if ETH is sent. View and pure functions still cost gas when called inside a state-changing transaction.
The EVM is the sandboxed, deterministic runtime that executes smart contract bytecode on every Ethereum node. It is a stack-based machine with 256-bit words, and each opcode has a gas cost, so every computation is metered and infinite loops are impossible. Because every node must get the same result, contracts cannot access the internet or randomness directly. Many chains and rollups are EVM-compatible, so the same Solidity contracts and tools work across them.
Cross-function reentrancy happens when an attacker re-enters a different function that shares state with the one making the external call, so a guard on only one function does not help. Read-only reentrancy happens when a view function, such as a pool's price getter, returns inconsistent state mid-execution, and another protocol reads it during the callback and misprices assets. Mitigate by guarding all state-sharing functions, updating state before calls, and checking a reentrancy lock in view functions other protocols rely on.
35
How is public-key cryptography used in blockchain?
Each user has a private key, kept secret, and a public key derived from it. The private key signs transactions, and anyone can verify the signature with the public key, proving the owner authorised the transfer without revealing the private key. Addresses are derived from public keys. Because control of funds equals control of the private key, losing it means losing access, and leaking it means anyone can spend the funds.
36
Which tools do you use for static analysis and fuzzing of smart contracts?
Slither performs static analysis and quickly flags reentrancy, unchecked calls, shadowing and more. Aderyn is another fast static analyser. Foundry provides fuzz and invariant testing, where random sequences of calls try to break properties you define. Echidna and Medusa are property-based fuzzers. Mythril and Halmos use symbolic execution, and Certora offers formal verification. Combining them with manual review and high test coverage catches far more than any single tool.
37
How do you calculate a borrower's health factor in a lending protocol?
Health factor = (sum of collateral value x liquidation threshold) / total debt value. Below 1, the position can be liquidated.
Example: collateral 10 ETH at 3,000 dollars = 30,000 dollars, liquidation threshold 80 percent, debt 18,000 dollars of stablecoins.
HF = (30,000 x 0.80) / 18,000 = 1.33.
If ETH falls to 2,250, collateral is 22,500, so HF = 18,000 / 18,000 = 1.0 and liquidation begins. Users raise HF by repaying debt or adding collateral.
38
What is a signature replay attack and how do you prevent it?
If a contract accepts a signed message to perform an action, an attacker can resubmit the same signature to repeat it, or replay it on another chain or another contract using the same code. Prevent it by including a per-user nonce that increments on use, a deadline, the chain ID and the verifying contract address in the signed data. EIP-712 typed data with a domain separator gives a standard way to include these fields.
39
Your team is preparing a contract for an external audit. What do you do beforehand?
Freeze the code at a commit and stop adding features. Write clear documentation: architecture, roles, trust assumptions, invariants and known risks. Reach high test coverage including fuzz and invariant tests, and run Slither and fix its findings. Remove dead code, add NatSpec comments, and make the build reproducible. Share a scope list and a walkthrough call. A clean, well-documented codebase lets auditors spend their limited time on deep logic bugs.
40
What is Bitcoin halving and difficulty adjustment?
Halving cuts the Bitcoin block reward in half every 210,000 blocks, roughly every four years, which caps total supply at 21 million BTC. After the April 2024 halving the reward is 3.125 BTC per block. Difficulty adjustment happens every 2016 blocks: if blocks came faster than ten minutes on average, difficulty rises, and if slower, it falls. Together they make issuance predictable regardless of how much mining power joins or leaves.
Frequently asked questions
What is asked in Blockchain interviews for 1 year of experience?
With one year of experience, you are expected to write production-quality contracts with tests, use Foundry or Hardhat confidently, and integrate contracts with a front-end or back-end. Questions cover gas optimisation, events, error handling, OpenZeppelin usage, deployment and verification. You should explain bugs you have fixed and how you reviewed code, and show familiarity with common vulnerabilities.
How many questions should I practise before a Blockchain interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 1 year of experience?
Focus first on Testing with Foundry, ethers.js or viem integration, Gas optimisation, Common vulnerabilities.