Blockchain Interview Questions in Bangalore

Foundry tests are Solidity contracts; functions starting with test run as tests, and parameters make them fuzz tests. import {Test} from 'forge-std/Test.sol'; import {Vault} from '../src/Vault.sol'; contract VaultTest is Test { Vault v; function setUp() public { v = new Vault(); } function testDeposit() public { v.deposit{value: 1 ether}(); assertEq(v.balanceOf(address(this)), 1 ether); } function testFuzzDeposit(uint96 amt) public { vm.assume(amt > 0); vm.deal(address(this), amt); v.deposit{value: amt}(); assertEq(address(v).balance, amt); } } Run with forge test -vvv.

Vulnerable: the balance is cleared after sending. function withdraw() external { uint256 bal = balances[msg.sender]; (bool ok, ) = msg.sender.call{value: bal}(''); require(ok); balances[msg.sender] = 0; } Fixed: update state first and add a guard. import {ReentrancyGuard} from '@openzeppelin/contracts/utils/ReentrancyGuard.sol'; function withdraw() external nonReentrant { uint256 bal = balances[msg.sender]; require(bal > 0, 'nothing'); balances[msg.sender] = 0; (bool ok, ) = msg.sender.call{value: bal}(''); require(ok, 'send failed'); }

ethers v6 provides getFeeData, and sendTransaction fills in fields automatically, but you can set them explicitly. import { JsonRpcProvider, Wallet, parseEther } from 'ethers'; const provider = new JsonRpcProvider(process.env.RPC_URL); const wallet = new Wallet(process.env.PRIVATE_KEY, provider); const fee = await provider.getFeeData(); const tx = await wallet.sendTransaction({ to: '0xRecipient...', value: parseEther('0.01'), maxFeePerGas: fee.maxFeePerGas, maxPriorityFeePerGas: fee.maxPriorityFeePerGas }); const receipt = await tx.wait(); console.log(receipt.status);

Recompute the message hash, add the Ethereum signed message prefix, recover the signer and compare it. import {ECDSA} from '@openzeppelin/contracts/utils/cryptography/ECDSA.sol'; import {MessageHashUtils} from '@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol'; function verify(address signer, uint256 amount, uint256 nonce, bytes calldata sig) public view returns (bool) { bytes32 h = keccak256(abi.encode(address(this), block.chainid, amount, nonce)); bytes32 eth = MessageHashUtils.toEthSignedMessageHash(h); return ECDSA.recover(eth, sig) == signer; } Track used nonces to block replays.

Hash leaves, then hash pairs until one remains, duplicating the last hash when a level is odd (Bitcoin style). import hashlib def h(b): return hashlib.sha256(b).digest() def merkle_root(txs): level = [h(t.encode()) for t in txs] while len(level) > 1: if len(level) % 2: level.append(level[-1]) level = [h(level[i] + level[i+1]) for i in range(0, len(level), 2)] return level[0].hex() print(merkle_root(['tx1', 'tx2', 'tx3']))

Inherit the audited ERC20 implementation and mint the initial supply in the constructor. // SPDX-License-Identifier: MIT pragma solidity ^0.8.24; import {ERC20} from '@openzeppelin/contracts/token/ERC20/ERC20.sol'; import {Ownable} from '@openzeppelin/contracts/access/Ownable.sol'; contract CampusToken is ERC20, Ownable { constructor() ERC20('Campus Token', 'CAMP') Ownable(msg.sender) { _mint(msg.sender, 1_000_000 * 10 ** decimals()); } function mint(address to, uint256 amount) external onlyOwner { _mint(to, amount); } }

curl -L https://foundry.paradigm.xyz | bash && foundryup forge init my-dapp # new project with src, test, script forge install OpenZeppelin/openzeppelin-contracts forge build # compile forge test -vvv # run tests with traces forge coverage # coverage report forge snapshot # gas snapshot anvil # local node cast call ADDR 'count()(uint256)' --rpc-url $RPC Foundry tests are written in Solidity and run fast; Hardhat is the JavaScript or TypeScript alternative with a large plugin ecosystem.

Use contract.on for live events and queryFilter for history. const abi = ['event Transfer(address indexed from, address indexed to, uint256 value)']; const token = new Contract(TOKEN, abi, provider); token.on('Transfer', (from, to, value, event) => { console.log(from, to, value.toString(), event.log.blockNumber); }); const filter = token.filters.Transfer(null, MY_ADDRESS); const past = await token.queryFilter(filter, -5000); // last 5000 blocks console.log(past.length); Use a WebSocket provider for live events, and page large ranges because providers limit block spans.

Each block stores the previous hash, so changing any earlier data breaks the chain. import hashlib, json def block_hash(block): data = json.dumps(block, sort_keys=True).encode() return hashlib.sha256(data).hexdigest() chain = [{'index': 0, 'data': 'genesis', 'prev': '0'}] for i, tx in enumerate(['A pays B 5', 'B pays C 2'], 1): chain.append({'index': i, 'data': tx, 'prev': block_hash(chain[-1])}) valid = all(chain[i]['prev'] == block_hash(chain[i-1]) for i in range(1, len(chain))) print(valid)

Pass the block tag to getBlock. The finalized tag returns the latest block that Proof of Stake has finalised, which cannot be reverted without slashing a third of stake. import { JsonRpcProvider } from 'ethers'; const provider = new JsonRpcProvider(process.env.RPC_URL); const latest = await provider.getBlock('latest'); const safe = await provider.getBlock('safe'); const finalized = await provider.getBlock('finalized'); console.log(latest.number - finalized.number); // usually about 64-96 Use finalized for deposits and accounting; use latest for UI updates.

Use cast storage with the contract address and slot number. For mappings, compute the slot as keccak256(key . slot). # Read slot 0 (often the first state variable) cast storage 0xContractAddress 0 --rpc-url $RPC_URL # balanceOf mapping stored at slot 2, key = user address cast index address 0xUserAddress 2 cast storage 0xContractAddress <slot-from-above> --rpc-url $RPC_URL This shows that private variables are not secret: anyone can read storage.