Hard Blockchain Interview Questions

Show answer

Finality is the guarantee that a confirmed transaction will not be reversed. In proof of work, finality is probabilistic: each new block on top makes reversal exponentially less likely, so exchanges wait for several confirmations. In BFT-style and Ethereum proof of stake, finality is economic and deterministic: once two-thirds of stake attests to a checkpoint, reverting it would require burning at least one-third of all staked ETH. Ethereum finalises in about two epochs, roughly 13 minutes.

A product team wants to store user documents and personal details directly on a public chain. What do you advise?

Show answer

Do not put personal data on a public chain. Data there is permanent, public and replicated globally, which conflicts with the right to erasure under India's DPDP Act and GDPR, and storage is extremely expensive. Store documents encrypted in off-chain storage, keep only a salted hash or commitment on-chain for integrity, and control access through the application. If the data must be deleted, delete the off-chain copy and the encryption key; the hash alone reveals nothing.

A group of banks wants a shared KYC ledger. Would you choose a public chain, a Layer 2 or Hyperledger Fabric?

Show answer

For shared KYC among regulated banks I would lean to a permissioned framework such as Hyperledger Fabric or a private EVM network. Members are known, data is confidential, and regulators expect access control and data residency in India. Fabric channels and private data collections restrict who sees what, and Raft ordering gives fast finality without gas fees. A public chain or L2 fits only if we need open verification, and even then only hashes and attestations would go on it.

Your exchange credited a deposit, but the block was later dropped in a reorg and the funds vanished. How do you prevent this?

Show answer

Credit deposits only after enough confirmations for the chain's risk profile, and on Ethereum prefer waiting for finalized or at least safe block tags rather than the latest block. Make the deposit indexer reorg-aware: track block hashes, detect when a parent hash changes, roll back credits from orphaned blocks and reprocess. Scale required confirmations with deposit size, and alert on unusually deep reorgs on smaller chains, which can signal a 51 percent attack.

What is a Merkle Patricia Trie and why does Ethereum use it?

Show answer

A Merkle Patricia Trie combines a Patricia (compressed prefix) trie with Merkle hashing. Ethereum uses it to store world state, account storage, transactions and receipts, with each root stored in the block header. It allows efficient insert, update and lookup by key, and any value can be proven against the root with a proof. Its weakness is large proof size, which is why Ethereum researchers plan to move to Verkle or binary hash trees for stateless clients.

What are zero-knowledge proofs, and how do zk-SNARKs and zk-STARKs differ?

Show answer

A zero-knowledge proof lets a prover convince a verifier that a statement is true without revealing why, for example proving a transaction is valid without exposing the details. zk-SNARKs have very small proofs and cheap verification, but many schemes need a trusted setup and rely on elliptic curves. zk-STARKs need no trusted setup, use hash-based cryptography considered post-quantum safe, but produce larger proofs. zk-rollups use them to prove batches of transactions to Ethereum.

What is signature malleability and how is it prevented?

Show answer

For any valid ECDSA signature (r, s), the value (r, n - s) is also valid for the same message. If code uses a signature as a unique ID, for example to mark it as used, an attacker can submit the flipped version and replay it. Ethereum's EIP-2 requires s to be in the lower half of the curve order for transactions. In contracts, use a library like OpenZeppelin ECDSA that enforces low s, and track nonces instead of signatures.

Design the custody setup for an exchange's hot and cold wallets.

Show answer

Keep a small float, around a few percent of assets, in hot wallets for withdrawals, secured by HSMs or MPC with rate limits, address allowlists and automated monitoring. Keep the rest in cold storage: air-gapped or multisig/MPC with keys held by different officers in different locations, plus time delays. Refill hot wallets through a manual, multi-approver process. Add proof of reserves, regular key ceremonies, insurance, and incident runbooks for freezing withdrawals if anomalies appear.

How do you verify a signed message inside a Solidity contract?

Show answer

Recompute the message hash, add the Ethereum signed message prefix, recover the signer and compare it. import {ECDSA} from '@openzeppelin/contracts/utils/cryptography/ECDSA.sol'; import {MessageHashUtils} from '@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol'; function verify(address signer, uint256 amount, uint256 nonce, bytes calldata sig) public view returns (bool) { bytes32 h = keccak256(abi.encode(address(this), block.chainid, amount, nonce)); bytes32 eth = MessageHashUtils.toEthSignedMessageHash(h); return ECDSA.recover(eth, sig) == signer; } Track used nonces to block replays.

Explain Byzantine Fault Tolerance and the 3f+1 rule.

Show answer

Byzantine Fault Tolerance is the ability of a system to reach agreement even when some nodes lie or act arbitrarily. Classical BFT protocols such as PBFT, Tendermint and QBFT need at least 3f+1 nodes to tolerate f Byzantine nodes, because a quorum of 2f+1 votes guarantees that any two quorums overlap in at least one honest node. They give instant deterministic finality but involve heavy message passing, so they work best with tens to low hundreds of validators.

What did EIP-4844 (proto-danksharding) change?

Show answer

EIP-4844, shipped in the Dencun upgrade in March 2024, added blob-carrying transactions. Blobs are large data chunks of about 128 KB that rollups use to post batch data, priced in a separate fee market and pruned by nodes after roughly 18 days. Contracts cannot read blob contents, only their KZG commitments. This cut L2 data costs dramatically. Later upgrades raised blob capacity, and PeerDAS in the Fusaka upgrade lets nodes sample data instead of downloading every blob.

What is MEV and what is proposer-builder separation?

Show answer

MEV, maximal extractable value, is profit a block producer or searcher earns by including, excluding or reordering transactions, for example arbitrage, liquidations and sandwich attacks on swaps. On Ethereum, most validators use MEV-Boost, where specialised builders assemble profitable blocks and bid for them through relays, separating block building from proposing. This spreads MEV revenue to validators but concentrates building power. Enshrined PBS and inclusion lists are being researched to reduce censorship risk.

You are asked to design a cross-chain bridge. What are the main risks and design choices?

Show answer

Bridges hold large pooled funds, so they are top hacking targets. Main risks are compromised validator or multisig keys, faulty message verification, and replay of messages across chains. Prefer verification based on light clients or zk proofs over a small trusted multisig. Use rate limits, per-transfer caps, pausing, monitoring of mint-versus-lock balances, and a delay for large transfers. Get multiple audits, run a bug bounty, and consider established messaging protocols instead of building from scratch.

Four organisations are building a private EVM network. Which consensus would you pick: Raft or QBFT?

Show answer

Raft is crash fault tolerant: fast and simple, but it assumes no node lies, so it fits when all members trust each other's infrastructure. QBFT is Byzantine fault tolerant and tolerates f malicious nodes out of 3f+1, so with four validators it survives one bad actor and gives immediate finality. Since the organisations are separate businesses that may not fully trust each other, I would choose QBFT and run at least four validators, ideally more.

What is the difference between call, delegatecall and staticcall?

Show answer

call runs the target contract's code in the target's own context, with its own storage, and msg.sender becomes the caller contract. delegatecall runs the target's code in the caller's context, using the caller's storage, balance and original msg.sender; this is how proxies and libraries work, and storage layouts must match. staticcall is like call but reverts on any state change, used for view functions. Delegatecall to untrusted code is extremely dangerous.

What transaction types exist on Ethereum today?

Show answer

Type 0 is the legacy transaction with a single gasPrice. Type 1, from EIP-2930, adds an access list. Type 2, from EIP-1559, uses maxFeePerGas and maxPriorityFeePerGas and is the default in wallets. Type 3, from EIP-4844, carries blobs for rollup data. Type 4, from EIP-7702 in the Pectra upgrade of May 2025, lets an EOA set code delegation through a signed authorisation list, enabling batching and sponsored gas for normal wallets.

What is account abstraction, and how do ERC-4337 and EIP-7702 differ?

Show answer

Account abstraction makes accounts programmable, so wallets can support batching, gas paid in tokens or by sponsors, passkeys, spending limits and social recovery. ERC-4337 does this without protocol changes: users send UserOperations to an alternate mempool, bundlers submit them to an EntryPoint contract, and paymasters can sponsor gas. EIP-7702 is a protocol change that lets an existing EOA point to smart account code, so users keep their address while gaining these features.

A simulated eth_call succeeds but the real transaction reverts. What could cause this?

Show answer

The state can change between simulation and inclusion: price moved beyond slippage limits, a deadline passed, another user took the last item, or a bot front-ran the trade. Other causes are a different msg.sender or value in the simulation, a gas limit too low for the real path, block-dependent logic like block.timestamp, or a different block tag. Debug by tracing the failed transaction with cast run or a tracer and comparing inputs and state.

Describe a production incident you handled under pressure.

Show answer

Situation: after a release, our token-claim page started failing for some users while traffic was peaking. Task: as on-call lead I had to restore service quickly. Action: I paused the claim contract through our multisig, traced failing transactions, and found a front-end bug sending an outdated Merkle proof format. We hot-fixed the UI, tested on a fork, and unpaused. Result: downtime was 40 minutes, no funds were at risk, and we added an end-to-end check against the deployed root.

How do upgradeable contracts work, and how do Transparent and UUPS proxies differ?

Solidity ProgrammingHard

Show answer

A proxy holds the state and delegates every call to an implementation contract whose address is stored in a standard EIP-1967 slot; upgrading means pointing to a new implementation. In the Transparent pattern, upgrade logic lives in the proxy and an admin cannot call implementation functions, which avoids selector clashes. In UUPS, upgrade logic lives in the implementation, making proxies cheaper, but a faulty upgrade can brick it. Both use initialisers instead of constructors and require storage-layout compatibility.

What is storage packing, and what are other key gas optimisations?

Solidity ProgrammingHard

Show answer

The EVM stores data in 32-byte slots, so consecutive small variables like uint128, uint64, address and bool can share a slot if declared next to each other, saving expensive SSTOREs. Other optimisations: use calldata for external arrays, cache storage reads in local variables, use immutable and constant, prefer custom errors over strings, avoid unbounded loops, use events instead of storing history, and use unchecked for counters that cannot overflow. Always measure with forge snapshot.

Your contract fails to deploy because it exceeds the 24 KB size limit. What do you do?

Solidity ProgrammingHard

Show answer

The EIP-170 limit is 24,576 bytes of runtime code. First enable the optimiser and try a lower runs value or via-IR. Replace revert strings with custom errors, move repeated logic out of modifiers into internal functions, and remove unused code. If still too big, split logic into separate contracts or external libraries, or use a modular pattern like the Diamond (EIP-2535). Splitting also often improves clarity and auditability.

How do flash loans enable oracle manipulation attacks?

Show answer

A flash loan lets anyone borrow huge amounts without collateral if it is repaid in the same transaction. An attacker borrows, makes a large trade in a thin DEX pool to move its spot price, then uses a protocol that reads that pool as its price oracle, for example borrowing too much against inflated collateral, and finally reverses the trade and repays. Defend with decentralised oracles like Chainlink, TWAPs, multiple sources and sanity bounds.

What are storage collision and uninitialised implementation risks in proxies?

Show answer

With delegatecall, the implementation's code writes to the proxy's storage. If the proxy stores its admin or implementation address in a normal slot, implementation variables can overwrite it, so EIP-1967 uses pseudo-random slots. New implementation versions must only append variables, or use namespaced storage (ERC-7201). Implementations must also disable initialisers in their constructor; otherwise an attacker can initialise the implementation directly, take ownership and, in UUPS, potentially destroy or hijack it.

What are cross-function and read-only reentrancy?

Show answer

Cross-function reentrancy happens when an attacker re-enters a different function that shares state with the one making the external call, so a guard on only one function does not help. Read-only reentrancy happens when a view function, such as a pool's price getter, returns inconsistent state mid-execution, and another protocol reads it during the callback and misprices assets. Mitigate by guarding all state-sharing functions, updating state before calls, and checking a reentrancy lock in view functions other protocols rely on.

Your protocol is being exploited right now. What do you do?

Show answer

Act fast with a prepared runbook. Pause affected contracts through the guardian or multisig, and disable front-end actions. Gather the core team and security partners in a war room. Trace the attack transactions to understand the bug and estimate losses, and check whether a white-hat rescue of remaining funds is needed. Communicate publicly with facts and no speculation, contact exchanges and bridges to flag stolen funds, then fix, audit the fix and publish a post-mortem.

A lending protocol reads collateral prices from one DEX pool's current reserves. What is the risk and fix?

Show answer

Spot prices from a single pool can be moved within one transaction by a flash-loaned swap, letting an attacker inflate collateral value and borrow far more than it is worth, or trigger unfair liquidations. Replace it with a robust oracle such as Chainlink price feeds, or a long-window TWAP from deep pools, check staleness and deviation between sources, cap borrow amounts per block, and add circuit breakers for extreme price moves.

Write a Foundry invariant test for a token's total supply.

Show answer

Invariant tests call random functions on target contracts and check a property after every call. import {Test} from 'forge-std/Test.sol'; import {MyToken} from '../src/MyToken.sol'; import {Handler} from './Handler.sol'; contract SupplyInvariant is Test { MyToken token; Handler handler; function setUp() public { token = new MyToken(); handler = new Handler(token); targetContract(address(handler)); } function invariant_supplyMatchesBalances() public view { assertEq(token.totalSupply(), handler.sumOfBalances()); } } The handler bounds inputs and tracks actors so calls stay realistic.

Management wants to launch before the audit is complete. How do you handle it?

Show answer

Situation: marketing had fixed a launch date, but the audit had two open high-severity findings. Task: protect users without blocking the business. Action: I explained the risk in money terms, proposed a guarded launch with a low deposit cap, pausable contracts and only the audited modules enabled, and shared a timeline for the fixes. Result: leadership accepted, we launched on time with caps, and raised limits two weeks later after fixes were verified.

Write the core reward-per-token logic for a staking rewards contract.

Show answer

uint256 public rewardRate; // tokens per second uint256 public rewardPerTokenStored; uint256 public lastUpdate; uint256 public totalStaked; mapping(address => uint256) public paid; mapping(address => uint256) public rewards; mapping(address => uint256) public staked; function rewardPerToken() public view returns (uint256) { if (totalStaked == 0) return rewardPerTokenStored; return rewardPerTokenStored + (block.timestamp - lastUpdate) * rewardRate * 1e18 / totalStaked; } modifier updateReward(address a) { rewardPerTokenStored = rewardPerToken(); lastUpdate = block.timestamp; rewards[a] += staked[a] * (rewardPerTokenStored - paid[a]) / 1e18; paid[a] = rewardPerTokenStored; _; }

How do you build a tokenised vault using ERC-4626?

Show answer

ERC-4626 standardises yield vaults: users deposit an asset and receive shares, and share price rises as the vault earns yield. import {ERC4626} from '@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol'; import {ERC20} from '@openzeppelin/contracts/token/ERC20/ERC20.sol'; import {IERC20} from '@openzeppelin/contracts/token/ERC20/IERC20.sol'; contract YieldVault is ERC4626 { constructor(IERC20 asset_) ERC20('Vault Share', 'vSHR') ERC4626(asset_) {} function totalAssets() public view override returns (uint256) { return IERC20(asset()).balanceOf(address(this)); // plus deployed funds } } OpenZeppelin uses virtual shares to defend against the first-depositor inflation attack.

Calculate impermanent loss when one token's price doubles.

Show answer

Formula: IL = 2 x sqrt(r) / (1 + r) - 1, where r is the price ratio change. For r = 2: sqrt(2) = 1.414, so IL = 2 x 1.414 / 3 - 1 = -0.057, about 5.7 percent. Example: deposit 1 ETH plus 3,000 USDC when ETH is 3,000 (6,000 dollars). ETH goes to 6,000. Holding would be 9,000 dollars; the pool position is worth about 8,485. Fees earned must exceed the 515 dollar gap for providing liquidity to beat holding.

A stablecoin used as collateral in your protocol loses its peg. How do you respond?

Show answer

Activate the risk plan: pause new borrowing against that asset and freeze its use as new collateral through governance or the guardian. Switch its oracle to a market price rather than a hard-coded one dollar, so positions are valued honestly, which may trigger liquidations. Reduce its loan-to-value and supply caps. Communicate clearly with users. Longer term, cap exposure per stablecoin, diversify collateral and model depeg scenarios in risk dashboards.

A sharp market fall causes cascading liquidations in your lending protocol and bad debt. How do you design against it?

Show answer

Set conservative loan-to-value ratios and liquidation thresholds per asset based on volatility and on-chain liquidity. Use supply and borrow caps for illiquid tokens, isolation mode for risky assets, and a liquidation bonus that attracts liquidators without over-penalising users. Allow partial liquidations so positions shrink gradually. Keep reliable oracles, an insurance or reserve fund to absorb bad debt, and run stress tests simulating 30 to 50 percent price drops.

A client in India wants to tokenise real estate for fractional ownership. What do you consider?

Show answer

Regulation comes first: fractional real estate is likely a security or collective investment, so SEBI rules, including those for fractional ownership platforms, apply, and crypto-like tokens are taxed as virtual digital assets at 30 percent with 1 percent TDS. Use a permissioned token with KYC-gated transfers, such as ERC-3643, and a legal SPV that holds the property. Keep title documents off-chain, put hashes on-chain, and plan for rent distribution, transfer restrictions and recovery.

A fee-on-transfer token breaks your DEX's accounting. What happened and how do you fix it?

Show answer

Fee-on-transfer tokens deduct a percentage on every transfer, so when your contract calls transferFrom for 100 tokens it may receive only 98. If the code assumes 100 arrived, balances and reserves drift and can be exploited. Fix it by measuring the actual amount received: read the contract's balance before and after the transfer and use the difference. Also decide whether to support such tokens at all and document unsupported token behaviours like rebasing.

An attacker borrows governance tokens with a flash loan to pass a malicious DAO proposal. How do you prevent it?

Show answer

Use snapshot-based voting power: count votes from token balances at a past block, as ERC20Votes does, so tokens acquired in the same transaction have no weight. Add a voting delay before voting starts, a quorum, and a timelock between approval and execution so the community can react or a guardian can veto. Require a proposal threshold, and keep critical actions such as treasury transfers behind additional safeguards like spending limits.

How would you implement Sign-In with Ethereum on a web back-end?

Show answer

Follow EIP-4361. The server generates a random nonce and stores it in the session. The front-end builds a SIWE message with domain, address, statement, URI, chain ID, nonce and issued-at time, and the wallet signs it. The server verifies the signature with a SIWE library, checks domain, nonce, expiry and chain, then issues a session cookie or JWT and deletes the nonce. For smart contract wallets, verify via ERC-1271 isValidSignature.

Design a back-end relayer so users can make transactions without holding gas.

Show answer

Users sign an EIP-712 meta-transaction or an ERC-4337 UserOperation. The relayer validates the signature, checks business rules and rate limits per user, then submits it, paying gas from a hot wallet or via a paymaster. Contracts must verify the original signer, using ERC-2771 trusted forwarders or account abstraction. Manage nonces carefully with a queue, replace stuck transactions, keep the relayer wallet funded and monitored, and cap daily sponsorship to prevent abuse.

How do you manage deployer private keys in a CI/CD pipeline?

Show answer

Never commit keys or put them in plain environment files. For testnets, use CI secret storage with restricted access. For mainnet, avoid hot keys in CI entirely: have CI produce a transaction proposal that signers approve in a multisig, or use a cloud KMS or HSM signer so the key never leaves secure hardware. Separate deployer and admin roles, transfer ownership to a multisig immediately after deployment, and log and review every deployment.

How do you monitor smart contracts in production?