Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About IBM hiring for Blockchain roles
IBM is a global technology company offering hybrid cloud, AI through watsonx, software such as Red Hat, infrastructure and IBM Consulting services. Its India Software Labs and IBM Consulting teams form one of its largest workforces outside the US. It hires in India for software developers, test engineers, data engineers, data scientists and consultants.
For Blockchain roles, this IBM practice set focuses most on Consensus and Scaling (6), Ethereum and the EVM (5), dApp Development (5), DeFi, Tokens and NFTs (5). It has 12 easy, 17 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Armonk, New York, USA
Main India offices
Bengaluru, Pune, Hyderabad, Kolkata, Gurugram
IBM Blockchain interview process
Online assessment (cognitive games + coding)
English language test
Technical interview
Managerial or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for IBMStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Explain storage, memory, stack and calldata in the EVM.
Storage is persistent key-value data of 32-byte slots per contract; it is the most expensive, and writes to new slots cost about 20,000 gas. Memory is a temporary byte array cleared after each call, cheap but growing in cost quadratically. The stack holds up to 1024 words for opcode operands. Calldata is the read-only input data of the transaction, the cheapest place to read external function arguments from. Choosing the right location is a key gas optimisation.
02
What is a digital signature and what does it guarantee?
A digital signature is a value produced by signing a message hash with a private key. Anyone with the public key can verify it. It guarantees authentication (the holder of the key signed it), integrity (the message was not changed, since any change breaks verification) and non-repudiation (the signer cannot later deny it). In blockchain, every transaction is signed, so nodes accept a transfer only if the signature matches the sending account.
03
How do you store an NFT image on IPFS and use it in your contract?
Upload the image to IPFS using a node or a pinning service, which returns a CID. Create a metadata JSON file whose image field is ipfs://<imageCID>, then upload the metadata folder to get a folder CID. Set the contract's base URI to ipfs://<folderCID>/ so tokenURI(5) resolves to the file for token 5. Pin the content with more than one provider, and use a gateway URL only for display in the front-end.
04
How do you read the latest finalized block with ethers.js, and why use it?
Pass the block tag to getBlock. The finalized tag returns the latest block that Proof of Stake has finalised, which cannot be reverted without slashing a third of stake.
import { JsonRpcProvider } from 'ethers';
const provider = new JsonRpcProvider(process.env.RPC_URL);
const latest = await provider.getBlock('latest');
const safe = await provider.getBlock('safe');
const finalized = await provider.getBlock('finalized');
console.log(latest.number - finalized.number); // usually about 64-96
Use finalized for deposits and accounting; use latest for UI updates.
05
A retail brand wants to give customers loyalty points as blockchain tokens. How would you design it?
Keep it simple for non-crypto users. Use a low-fee Layer 2 or a permissioned chain, and create wallets automatically with account abstraction or embedded wallets linked to phone login, so customers never handle seed phrases. Sponsor gas through a paymaster. Make points a non-transferable or restricted ERC-20 if resale is not intended, to avoid VDA tax and securities issues. Keep customer data off-chain and show points in the brand's normal app.
06
How do you compute a function selector and decode calldata with cast?
cast handles ABI work from the command line.
# Function selector
cast sig 'transfer(address,uint256)'
# 0xa9059cbb
# Encode calldata
cast calldata 'transfer(address,uint256)' 0xAbc... 1000000
# Decode calldata from a transaction
cast 4byte-decode 0xa9059cbb000000...
# Decode with a known signature
cast decode-calldata 'transfer(address,uint256)' 0xa9059cbb...
This is useful when checking what a wallet is really asking you to sign.
I see myself as a senior smart contract engineer, owning the design and security of production protocols and mentoring juniors. In the next two years I want to master Solidity, testing and audit techniques, and contribute to open source. Later I would like to specialise in security or Layer 2 infrastructure. I hope to grow inside a team like this one, where the work is real and the standards are high.
Validators deposit 32 ETH (after the Pectra upgrade a validator can hold up to 2048 ETH) to join. Time is divided into 12-second slots and 32-slot epochs. In each slot a randomly chosen validator proposes a block and committees attest to it. The fork-choice rule LMD-GHOST picks the head, and Casper FFG finalises checkpoints when two-thirds of stake agrees. Honest validators earn rewards; offline ones lose small amounts, and provably malicious ones are slashed.
A sidechain is an independent blockchain with its own validators and consensus, connected to the main chain by a bridge. Its security depends on its own validator set, so if they collude, funds can be stolen. A rollup posts its transaction data and state roots to Ethereum and relies on fraud or validity proofs, so it inherits Layer 1 security for correctness. Sidechains are usually cheaper and more flexible, but rollups give stronger guarantees.
10
A user is angry that withdrawing from an optimistic rollup to Ethereum takes seven days. How do you explain and solve it?
Explain that the seven-day window lets anyone challenge a fraudulent batch; it protects their funds. For faster exits, offer third-party fast bridges or intent-based bridges where a liquidity provider pays them on L1 within minutes for a small fee and later claims the slow withdrawal. Also show the expected timeline clearly in the UI and send a notification when funds are claimable, because most anger comes from uncertainty, not the delay itself.
11
Why is on-chain randomness insecure, and what should you use instead?
Values like block.timestamp, blockhash or block.prevrandao are visible to or partly controlled by block producers, and any contract can read them in the same transaction and only proceed when the outcome is favourable. So lotteries and NFT trait reveals based on them can be gamed. Use a verifiable random function such as Chainlink VRF, which delivers randomness with a cryptographic proof in a later transaction, or a commit-reveal scheme for simpler cases.
12
How do you read a contract's storage slot directly with Foundry's cast?
Use cast storage with the contract address and slot number. For mappings, compute the slot as keccak256(key . slot).
# Read slot 0 (often the first state variable)
cast storage 0xContractAddress 0 --rpc-url $RPC_URL
# balanceOf mapping stored at slot 2, key = user address
cast index address 0xUserAddress 2
cast storage 0xContractAddress <slot-from-above> --rpc-url $RPC_URL
This shows that private variables are not secret: anyone can read storage.
13
Your exchange credited a deposit, but the block was later dropped in a reorg and the funds vanished. How do you prevent this?
Credit deposits only after enough confirmations for the chain's risk profile, and on Ethereum prefer waiting for finalized or at least safe block tags rather than the latest block. Make the deposit indexer reorg-aware: track block hashes, detect when a parent hash changes, roll back credits from orphaned blocks and reprocess. Scale required confirmations with deposit size, and alert on unusually deep reorgs on smaller chains, which can signal a 51 percent attack.
14
An auditor flags that a single owner key can mint tokens and change fees. How do you address it?
This is centralisation risk: if the key is compromised or misused, users lose funds. Move ownership to a multisig with signers on separate devices, add a timelock so users can see and react to changes, set hard-coded bounds such as a maximum fee, and remove powers that are not needed, like unlimited minting. Use role-based access instead of one all-powerful owner, and document the remaining admin powers publicly.
DeFi, decentralised finance, means financial services such as trading, lending, borrowing, stablecoins and derivatives built as smart contracts on public blockchains. Anyone with a wallet can use them without a bank account or approval, contracts are transparent, and protocols can be combined like building blocks. Examples are automated market maker exchanges, overcollateralised lending markets and liquid staking. The risks are smart contract bugs, oracle failures, volatile collateral and unclear regulation.
16
Why should you check return values of low-level calls and use SafeERC20?
Low-level call, send and delegatecall return false instead of reverting on failure, so ignoring the result means the contract continues as if the transfer succeeded. Similarly, some ERC-20 tokens do not return a bool from transfer, and others return false instead of reverting. OpenZeppelin's SafeERC20 wraps transfer, transferFrom and approve to handle both cases and revert on failure. Always write (bool ok, ) = to.call{value: x}(''); require(ok).
// script/Deploy.s.sol
pragma solidity ^0.8.24;
import {Script, console} from 'forge-std/Script.sol';
import {Counter} from '../src/Counter.sol';
contract Deploy is Script {
function run() external returns (Counter c) {
vm.startBroadcast();
c = new Counter();
vm.stopBroadcast();
console.log('Counter deployed at', address(c));
}
}
# Run it with an encrypted keystore account
forge script script/Deploy.s.sol --rpc-url $RPC_URL \
--account deployer --broadcast --verify
Broadcast output in the broadcast folder records addresses for later scripts.
18
Write a simple escrow contract where a buyer deposits and releases payment to a seller.
The EVM is the sandboxed, deterministic runtime that executes smart contract bytecode on every Ethereum node. It is a stack-based machine with 256-bit words, and each opcode has a gas cost, so every computation is metered and infinite loops are impossible. Because every node must get the same result, contracts cannot access the internet or randomness directly. Many chains and rollups are EVM-compatible, so the same Solidity contracts and tools work across them.
20
How do you approve and transfer ERC-20 tokens from a script with ethers.js?
ERC-20 defines fungible tokens where every unit is identical, with functions like transfer, approve, transferFrom and balanceOf; used for currencies, stablecoins and governance tokens. ERC-721 defines non-fungible tokens where each tokenId is unique, used for NFTs like art, tickets or certificates. ERC-1155 is a multi-token standard where one contract manages many token types, fungible or not, with batch transfers; it is popular in games where items have quantities.
22
How do you call read and write functions of a contract with ethers v6?
Proof of Work secures the chain with electricity and mining hardware; it is battle-tested and simple but energy-hungry and tends to centralise in mining pools. Proof of Stake secures it with locked capital that can be slashed; it uses over 99 percent less energy, gives faster economic finality and lowers hardware needs. Its critics point to stake concentration in large staking providers and more complex protocol design. Ethereum moved from PoW to PoS in the Merge of September 2022.
24
Users complain they received far fewer tokens than expected on large swaps. What is happening and how do you help?
Large trades in shallow pools suffer price impact, and wide slippage settings let sandwich bots extract extra value. Show the expected output, price impact and minimum received before confirming. Set sensible default slippage, such as 0.5 percent for major pairs, and warn when impact is high. Use a router or aggregator that splits trades across pools, and offer private transaction submission so bots cannot see the swap in the public mempool.
Gas measures the computational work an operation needs; for example a simple ETH transfer uses 21,000 gas, and writing a new storage slot costs about 20,000. The gas limit is the maximum gas the sender allows a transaction to consume. The gas price, per unit, is what the sender pays. The fee equals gas used times the effective gas price. If execution exceeds the limit, it reverts but the used gas is still charged.
26
What are state channels, such as the Lightning Network?
A state channel locks funds in an on-chain contract or multisig between parties, who then exchange many signed off-chain updates and settle only the final state on-chain. Lightning on Bitcoin links channels into a network so payments route through intermediaries using hashed timelock contracts. Channels give instant, nearly free payments but need participants to be online or use watchtowers, and they lock liquidity, so they suit repeated payments between known parties rather than general smart contracts.
A multisig wallet is a smart contract, such as a Safe, that needs M of N owner signatures to execute a transaction; rules are visible on-chain and easy to audit, but every action costs extra gas and works per chain. An MPC wallet splits one private key into shares held by different parties who jointly produce a normal signature; it looks like a regular address, works on any chain and allows key rotation, but the security depends on the off-chain implementation.
Reentrancy happens when a contract makes an external call, such as sending ETH, before updating its own state, and the receiver calls back into the contract to repeat the action. For example, a withdraw that sends funds and then sets the balance to zero can be re-entered to withdraw many times. The 2016 DAO hack drained millions this way. Prevent it with checks-effects-interactions, reentrancy guards, and pull payments.
A dApp usually has smart contracts on a chain holding core logic and assets; a front-end, often React or Next.js, that connects to the user's wallet; a library such as ethers.js, viem or wagmi to read and write contracts through an RPC provider; an indexer or subgraph for fast queries of history; decentralised storage such as IPFS for files and metadata; and optional back-end services for notifications, relaying or off-chain computation, with oracles bringing external data on-chain.
30
How do you keep up with security and cryptography developments in Web3?
I follow a routine. Weekly I read new audit reports and post-mortems of exploits, and I try to reproduce one in Foundry. I track Ethereum Improvement Proposals and upgrade notes, read Solidity release notes, and practise on capture-the-flag platforms such as Ethernaut and Damn Vulnerable DeFi. I also keep a personal notes file of attack patterns. This keeps my knowledge practical rather than just theoretical, and I share summaries with my team.
Tips to crack the IBM Blockchain interview
Practise IBM's game-based cognitive assessments, which test pattern recognition, memory and numerical reasoning quickly.
Learn basics of hybrid cloud, Red Hat OpenShift and watsonx, which IBM promotes as core strategic areas.
Revise SQL, Python or Java fundamentals and be ready to explain one project in depth.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; IBM interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the IBM Blockchain interview?
Candidates usually go through 4 stages: Online assessment (cognitive games + coding); English language test; Technical interview; Managerial or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the IBM Blockchain interview?
This practice set leans on Consensus and Scaling (6), Ethereum and the EVM (5), dApp Development (5), DeFi, Tokens and NFTs (5). Revise those first, then practise explaining one or two of your own projects end to end, because most IBM interviewers ask you to walk through real work.
Are these the exact questions asked at IBM?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like IBM's. They are not a leaked or verified list of past questions.
Where does IBM hire Blockchain professionals in India?
IBM has large teams in Bengaluru, Pune, Hyderabad, Kolkata, Gurugram. Openings and locations change often, so check the IBM careers page and filter by city and experience.