40 questions with answers for candidates with Freshers — 27 easy, 13 medium.
What interviewers expect: freshers
Interviews focus on fundamentals: how blockchains work, hashing, signatures, Proof of Stake, gas and basic Solidity. Expect to write a simple contract like an ERC-20 or voting contract, explain reentrancy, and walk through your projects in detail. Interviewers check whether you understand concepts rather than memorised answers, and whether you have tested and deployed something real on a testnet.
This set is weighted towards Blockchain Fundamentals (8), Solidity Programming (6), Ethereum and the EVM (6), dApp Development (5).
Blockchain and cryptography basics Solidity syntax and simple contracts Basic security patterns Project walkthrough
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
IPFS, the InterPlanetary File System, is a peer-to-peer network for storing and sharing files. Instead of locating files by server address, it identifies them by a content identifier (CID) derived from the file's hash, which is content addressing. The same content always has the same CID, and any change gives a new CID, so data cannot be swapped silently. Files must be pinned by a node or pinning service, otherwise they may disappear.
02
Users report their USDC balance shows as a tiny fraction in your dApp. What is wrong?
USDC uses 6 decimals, but the front-end probably formats every token with 18 decimals, so 100 USDC (100,000,000 base units) displays as 0.0000000001. Read decimals() from each token contract, or from a trusted token list, and use formatUnits and parseUnits with that value. Use bigint for amounts, never JavaScript floats, to avoid precision errors. Add tests with tokens of 6, 8 and 18 decimals.
03
What does a block contain and what is inside a block header?
A block has a header and a body. The body holds the list of transactions. The header holds metadata: the previous block hash, a timestamp, the Merkle root (or state and transaction roots in Ethereum) summarising the transactions, and consensus fields such as the difficulty target and nonce in Bitcoin. Because the header commits to all transactions through the root hash, nodes can verify a block's integrity by hashing just the header.
04
What is double spending and how does a blockchain prevent it?
Double spending is trying to spend the same digital money twice, for example sending the same coins to two merchants. A blockchain prevents it by keeping one shared ordering of transactions agreed through consensus. Once a transaction is included in a block, any conflicting transaction that spends the same funds is rejected as invalid. Merchants wait for several confirmations so that the chance of the block being replaced in a reorg becomes negligible.
A Merkle tree hashes data items in pairs, level by level, until one root hash remains. The root summarises all items: changing any item changes the root. A Merkle proof is the list of sibling hashes on the path from one item to the root. With it, a light client can prove that a transaction is in a block using about log2(n) hashes instead of downloading all transactions. Airdrop allowlists use the same trick on-chain.
06
How are mappings stored, and why can you not iterate over them?
A mapping does not store keys. The value for key k in a mapping declared at slot p lives at storage slot keccak256(k . p). Every possible key implicitly exists with a default zero value, so the contract cannot know which keys were set or how many. To iterate, keep a separate array of keys or use OpenZeppelin EnumerableSet or EnumerableMap, accepting extra gas, or rebuild the list off-chain from emitted events.
07
How do you call read and write functions of a contract with ethers v6?
Pick one project and explain it with STAR. Situation: in my final year I wanted to learn Solidity end to end. Task: build a crowdfunding dApp. Action: I wrote the contract with goal and deadline logic and refunds, tested it with Foundry including fuzz tests, built a Next.js front-end with wagmi, and deployed to Sepolia. Result: 30 friends tested it, I fixed a refund bug they found, and the repo now has docs and a demo video.
09
Why should you not use tx.origin for authorisation?
tx.origin is the EOA that started the transaction, while msg.sender is the immediate caller. If a contract checks require(tx.origin == owner), a phishing contract can trick the owner into calling it, and that contract then calls the victim; tx.origin is still the owner, so the check passes and funds can be stolen. Always use msg.sender for access control. tx.origin also breaks with smart contract wallets and account abstraction.
10
Why do you want to work in DeFi, given its risks and volatility?
I am drawn to DeFi because it turns financial products into open, auditable code, and that combination of finance and engineering motivates me. I understand the risks: hacks, market crashes and regulatory change. That is why I have focused on security, testing and risk thinking, not just writing contracts. I see volatility as a reason to build carefully. I want to work on a team that values audits, monitoring and user protection.
11
What is the difference between constant and immutable?
constant variables must be assigned a compile-time value and are inlined into the bytecode, for example uint256 constant MAX = 1000. immutable variables are assigned once in the constructor and then embedded in the deployed code, for example an owner address or token address chosen at deployment. Neither uses a storage slot, so reading them is far cheaper than reading normal state. Use them for anything that never changes after deployment.
12
A transaction keeps failing with an out of gas error. How do you fix it?
First see whether the gas limit was too low or the function is genuinely unbounded. Run eth_estimateGas or simulate with cast run or Tenderly to see actual gas used and where it fails. If estimation is fine, raise the limit with a buffer of 10 to 20 percent. If the function loops over a growing array, redesign it with pagination or pull-based patterns, because the block gas limit will eventually make it impossible to call.
The mempool is each node's waiting area for valid transactions that have been broadcast but not yet included in a block. Block producers usually pick transactions paying the highest fees or priority tips. Every node has its own mempool, so contents can differ slightly. Because pending transactions are public, bots can watch the mempool and front-run trades, which is why private transaction relays and order-flow auctions are used for sensitive transactions.
14
What is the difference between an externally owned account and a contract account?
An externally owned account (EOA) is controlled by a private key, has a balance and nonce but no code, and is the only type that can start a transaction. A contract account has code and storage, is controlled by its code, and acts only when called. Since the Pectra upgrade's EIP-7702, an EOA can also delegate to contract code, so the line is blurring as smart accounts become common.
15
How do you connect a browser wallet to a dApp using ethers.js?
Browser wallets inject an EIP-1193 provider at window.ethereum. Wrap it with BrowserProvider and request accounts.
import { BrowserProvider } from 'ethers';
async function connect() {
if (!window.ethereum) throw new Error('Install a wallet');
const provider = new BrowserProvider(window.ethereum);
const signer = await provider.getSigner(); // prompts the user
const address = await signer.getAddress();
const { chainId } = await provider.getNetwork();
return { signer, address, chainId };
}
In production, use EIP-6963 discovery or a connector library so users with several wallets can choose.
16
A developer accidentally pushed a private key to a public GitHub repo. What do you do?
Treat the key as compromised immediately, because bots scan GitHub within seconds. Move all funds and tokens to a new secure wallet, revoke token approvals, and if the key owns contracts, transfer ownership or roles to a new multisig. Removing the commit is not enough since history and forks keep it. Then rotate any related API keys, add secret scanning and pre-commit hooks, and load keys from environment variables or a secrets manager.
17
How do you get current fee data and send an EIP-1559 transaction with ethers.js?
A hash function maps any input to a fixed-size output, such as 256 bits. For blockchain it must be deterministic, fast to compute, pre-image resistant (you cannot find the input from the hash), second pre-image resistant, and collision resistant (finding two inputs with the same hash is infeasible). It should also show the avalanche effect, where a one-bit change gives a completely different hash. Blocks, addresses, Merkle trees and proof of work all depend on these properties.
A 51 percent attack happens when one party controls a majority of mining power or stake. It can then reorder or exclude transactions, censor users and double spend by building a longer private chain that replaces recent blocks. It cannot steal coins from other addresses or forge signatures. Large chains like Bitcoin and Ethereum make it extremely expensive, but small PoW chains have suffered such attacks, which is why exchanges require many confirmations on them.
20
What is the difference between view, pure and payable functions?
A view function reads state but does not modify it, so it is free when called off-chain via eth_call. A pure function neither reads nor modifies state and works only on its inputs, for example a math helper. A payable function can receive ETH along with the call; non-payable functions revert if ETH is sent. View and pure functions still cost gas when called inside a state-changing transaction.
21
How do you verify a deployed contract's source code on a block explorer?
Verification uploads source and compiler settings so the explorer can recompile and match the bytecode, letting users read the code.
# Foundry, using an explorer API key
forge verify-contract 0xDeployedAddr src/Counter.sol:Counter \
--chain sepolia --etherscan-api-key $KEY --watch
# With constructor arguments
--constructor-args $(cast abi-encode 'constructor(address)' 0xOwner)
# Hardhat
npx hardhat verify --network sepolia 0xDeployedAddr 0xOwner
Compiler version, optimiser runs and via-IR settings must match exactly.
22
How would you set up a local blockchain for development and testing?
For EVM work, run a local node with Anvil from Foundry or the Hardhat network. Each gives about ten pre-funded test accounts, instant mining and console logging. You can fork mainnet at a given block to test against real contracts and balances without spending money. For integration tests, deploy to a public testnet such as Sepolia, using faucet ETH. Keep deploy scripts and RPC URLs in config so the same code targets local, testnet and mainnet.
23
How do you keep up with security and cryptography developments in Web3?
I follow a routine. Weekly I read new audit reports and post-mortems of exploits, and I try to reproduce one in Foundry. I track Ethereum Improvement Proposals and upgrade notes, read Solidity release notes, and practise on capture-the-flag platforms such as Ethernaut and Damn Vulnerable DeFi. I also keep a personal notes file of attack patterns. This keeps my knowledge practical rather than just theoretical, and I share summaries with my team.
24
Write a basic voting contract using a struct, mapping and event.
The EVM is the sandboxed, deterministic runtime that executes smart contract bytecode on every Ethereum node. It is a stack-based machine with 256-bit words, and each opcode has a gas cost, so every computation is metered and infinite loops are impossible. Because every node must get the same result, contracts cannot access the internet or randomness directly. Many chains and rollups are EVM-compatible, so the same Solidity contracts and tools work across them.
26
Tell me about a time you explained blockchain to a non-technical stakeholder.
Situation: a business head wanted 'blockchain' in a vendor portal because competitors mentioned it. Task: help him decide. Action: I compared it to a shared online spreadsheet that nobody can secretly edit, then showed cost, speed and privacy trade-offs against a normal database with audit logs. Result: we agreed to keep the portal on a database and anchor monthly hashes of invoices on a chain for proof, saving months of work while meeting the trust goal.
27
How is a blockchain different from a traditional database?
A traditional database is controlled by one administrator who can create, update and delete rows, and trust comes from that owner. A blockchain is shared by many parties, is append-only, and trust comes from cryptography and consensus. The trade-off is performance: a database handles thousands of writes per second with low latency, while a public chain is slower and costlier. Use a blockchain only when several parties who do not fully trust each other must share one record.
Typical bugs include missing onlyOwner or role checks on sensitive functions such as mint, withdraw or setOracle, initialiser functions in upgradeable contracts that anyone can call, misconfigured roles, and a single EOA owning critical powers. Use OpenZeppelin Ownable2Step or AccessControl, give each role the minimum rights, protect admin actions with a multisig and timelock, and write tests confirming that every privileged function reverts for unauthorised callers.
It is an ordering rule for functions. First do checks: validate inputs, permissions and balances with require. Then apply effects: update all state variables, such as reducing the user's balance. Only then do interactions: external calls, token transfers or ETH sends. Because state is already updated, a re-entering call sees the new state and cannot repeat the action. Combine it with a nonReentrant modifier for defence in depth, especially in functions calling unknown contracts.
30
How should NFT metadata and tokenURI be structured?
tokenURI(id) returns a URI, usually ipfs://<CID>/<id>.json, pointing to JSON that marketplaces read:
{
"name": "Course Certificate #12",
"description": "Completed Blockchain Developer course",
"image": "ipfs://bafy.../12.png",
"attributes": [
{ "trait_type": "Grade", "value": "A" },
{ "trait_type": "Year", "value": 2026 }
]
}
Store images and JSON on IPFS or Arweave rather than a normal server, so metadata cannot silently change or disappear.
Modifiers are reusable pieces of code that run before or after a function body, placed where the underscore symbol appears. They are mainly used for checks such as onlyOwner, whenNotPaused or nonReentrant. For example, modifier onlyOwner() { require(msg.sender == owner, 'not owner'); _; } blocks everyone except the owner. Keep modifiers short and check-only; complex logic inside modifiers hides behaviour and increases bytecode size because the code is inlined into every function that uses it.
DeFi, decentralised finance, means financial services such as trading, lending, borrowing, stablecoins and derivatives built as smart contracts on public blockchains. Anyone with a wallet can use them without a bank account or approval, contracts are transparent, and protocols can be combined like building blocks. Examples are automated market maker exchanges, overcollateralised lending markets and liquid staking. The risks are smart contract bugs, oracle failures, volatile collateral and unclear regulation.
33
What does a smart contract audit process look like?
It starts with scoping: fixed commit, documentation, threat model and test coverage. Auditors run automated tools like Slither and fuzzers, then do manual line-by-line review, checking business logic, access control, economic attacks and integrations. They write findings rated critical, high, medium, low and informational with fixes. The team fixes issues, auditors review the fixes, and a final report is published. Audits reduce risk but do not guarantee safety, so add bug bounties and monitoring.
34
What is a signature replay attack and how do you prevent it?
If a contract accepts a signed message to perform an action, an attacker can resubmit the same signature to repeat it, or replay it on another chain or another contract using the same code. Prevent it by including a per-user nonce that increments on use, a deadline, the chain ID and the verifying contract address in the signed data. EIP-712 typed data with a domain separator gives a standard way to include these fields.
35
You open a transaction on a block explorer. Which fields do you check and what do they mean?
Check the status (success or failed), the block number and confirmations, from and to addresses, and the value transferred. For contract calls, check the decoded input data and emitted event logs, which show token transfers. Check the gas limit, gas used and effective gas price, which together give the fee paid, plus the nonce. If the status failed, the revert reason tells you why, while fees are still charged for gas used.
36
How do you read a contract's storage slot directly with Foundry's cast?
Use cast storage with the contract address and slot number. For mappings, compute the slot as keccak256(key . slot).
# Read slot 0 (often the first state variable)
cast storage 0xContractAddress 0 --rpc-url $RPC_URL
# balanceOf mapping stored at slot 2, key = user address
cast index address 0xUserAddress 2
cast storage 0xContractAddress <slot-from-above> --rpc-url $RPC_URL
This shows that private variables are not secret: anyone can read storage.
Solidity is a statically typed, contract-oriented, curly-brace language for writing smart contracts on Ethereum and other EVM chains. Its syntax resembles JavaScript and C++, and it compiles to EVM bytecode plus an ABI. It supports inheritance, libraries, user-defined types, custom errors and events. Version 0.8.x is current, with checked arithmetic by default. Developers usually write it with Foundry or Hardhat and reuse audited building blocks from OpenZeppelin Contracts.
A blockchain is a distributed, append-only ledger where records are grouped into blocks and each block stores the hash of the previous block, forming a chain. Many independent nodes keep a copy and agree on new blocks through a consensus protocol, so no single party controls the data. Changing an old block would change its hash and break every later link, which makes tampering easy to detect. Bitcoin and Ethereum are the best known public examples.
Proof of Work secures the chain with electricity and mining hardware; it is battle-tested and simple but energy-hungry and tends to centralise in mining pools. Proof of Stake secures it with locked capital that can be slashed; it uses over 99 percent less energy, gives faster economic finality and lowers hardware needs. Its critics point to stake concentration in large staking providers and more complex protocol design. Ethereum moved from PoW to PoS in the Merge of September 2022.
40
Users complain they received far fewer tokens than expected on large swaps. What is happening and how do you help?
Large trades in shallow pools suffer price impact, and wide slippage settings let sandwich bots extract extra value. Show the expected output, price impact and minimum received before confirming. Set sensible default slippage, such as 0.5 percent for major pairs, and warn when impact is high. Use a router or aggregator that splits trades across pools, and offer private transaction submission so bots cannot see the swap in the public mempool.
Frequently asked questions
What is asked in Blockchain interviews for Freshers?
Interviews focus on fundamentals: how blockchains work, hashing, signatures, Proof of Stake, gas and basic Solidity. Expect to write a simple contract like an ERC-20 or voting contract, explain reentrancy, and walk through your projects in detail. Interviewers check whether you understand concepts rather than memorised answers, and whether you have tested and deployed something real on a testnet.
How many questions should I practise before a Blockchain interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for Freshers?
Focus first on Blockchain and cryptography basics, Solidity syntax and simple contracts, Basic security patterns, Project walkthrough.