Blockchain Interview Questions for 10 Years Experience

Vulnerable: the balance is cleared after sending. function withdraw() external { uint256 bal = balances[msg.sender]; (bool ok, ) = msg.sender.call{value: bal}(''); require(ok); balances[msg.sender] = 0; } Fixed: update state first and add a guard. import {ReentrancyGuard} from '@openzeppelin/contracts/utils/ReentrancyGuard.sol'; function withdraw() external nonReentrant { uint256 bal = balances[msg.sender]; require(bal > 0, 'nothing'); balances[msg.sender] = 0; (bool ok, ) = msg.sender.call{value: bal}(''); require(ok, 'send failed'); }

Each block stores the previous hash, so changing any earlier data breaks the chain. import hashlib, json def block_hash(block): data = json.dumps(block, sort_keys=True).encode() return hashlib.sha256(data).hexdigest() chain = [{'index': 0, 'data': 'genesis', 'prev': '0'}] for i, tx in enumerate(['A pays B 5', 'B pays C 2'], 1): chain.append({'index': i, 'data': tx, 'prev': block_hash(chain[-1])}) valid = all(chain[i]['prev'] == block_hash(chain[i-1]) for i in range(1, len(chain))) print(valid)

Formula: amountOut = (amountIn x 997 x reserveOut) / (reserveIn x 1000 + amountIn x 997). Example: reserves 1,000 ETH and 3,000,000 USDC, swap 10 ETH. amountInWithFee = 10 x 997 = 9,970 numerator = 9,970 x 3,000,000 = 29,910,000,000 denominator = 1,000 x 1000 + 9,970 = 1,009,970 amountOut = 29,615 USDC (approx) The spot price is 3,000, but the trader gets about 2,961.5 per ETH because of fee and price impact.

uint256 public rewardRate; // tokens per second uint256 public rewardPerTokenStored; uint256 public lastUpdate; uint256 public totalStaked; mapping(address => uint256) public paid; mapping(address => uint256) public rewards; mapping(address => uint256) public staked; function rewardPerToken() public view returns (uint256) { if (totalStaked == 0) return rewardPerTokenStored; return rewardPerTokenStored + (block.timestamp - lastUpdate) * rewardRate * 1e18 / totalStaked; } modifier updateReward(address a) { rewardPerTokenStored = rewardPerToken(); lastUpdate = block.timestamp; rewards[a] += staked[a] * (rewardPerTokenStored - paid[a]) / 1e18; paid[a] = rewardPerTokenStored; _; }

import {AggregatorV3Interface} from '@chainlink/contracts/src/v0.8/shared/interfaces/AggregatorV3Interface.sol'; AggregatorV3Interface public feed; uint256 constant MAX_DELAY = 1 hours; function getPrice() public view returns (uint256) { (, int256 answer, , uint256 updatedAt, ) = feed.latestRoundData(); require(answer > 0, 'bad price'); require(block.timestamp - updatedAt <= MAX_DELAY, 'stale price'); return uint256(answer); // scale using feed.decimals(), often 8 } Always check staleness, sign and decimals; on L2s also check the sequencer uptime feed.

Invariant tests call random functions on target contracts and check a property after every call. import {Test} from 'forge-std/Test.sol'; import {MyToken} from '../src/MyToken.sol'; import {Handler} from './Handler.sol'; contract SupplyInvariant is Test { MyToken token; Handler handler; function setUp() public { token = new MyToken(); handler = new Handler(token); targetContract(address(handler)); } function invariant_supplyMatchesBalances() public view { assertEq(token.totalSupply(), handler.sumOfBalances()); } } The handler bounds inputs and tracks actors so calls stay realistic.

// script/Deploy.s.sol pragma solidity ^0.8.24; import {Script, console} from 'forge-std/Script.sol'; import {Counter} from '../src/Counter.sol'; contract Deploy is Script { function run() external returns (Counter c) { vm.startBroadcast(); c = new Counter(); vm.stopBroadcast(); console.log('Counter deployed at', address(c)); } } # Run it with an encrypted keystore account forge script script/Deploy.s.sol --rpc-url $RPC_URL \ --account deployer --broadcast --verify Broadcast output in the broadcast folder records addresses for later scripts.