Blockchain Interview Questions in Hyderabad

Show answer

The ABI (Application Binary Interface) is the JSON description of a contract's functions, events and errors, and it defines how arguments are encoded. A function selector is the first four bytes of the Keccak-256 hash of the function signature, for example transfer(address,uint256) gives 0xa9059cbb. Calldata is the selector followed by ABI-encoded arguments in 32-byte words. Wallets, ethers.js and explorers use the ABI to encode calls and decode results and events.

How do you test against real mainnet contracts using a fork?

dApp DevelopmentMedium

Show answer

Anvil or Foundry tests can fork a live chain at a block, so you interact with real tokens and protocols locally. # Start a local fork anvil --fork-url $MAINNET_RPC --fork-block-number 21000000 # Or fork inside a test function setUp() public { vm.createSelectFork(vm.envString('MAINNET_RPC'), 21000000); } # Give yourself tokens or impersonate a whale deal(address(usdc), alice, 1_000e6); vm.prank(whale); Pinning the block number keeps results reproducible and makes RPC caching effective.

What is the difference between an execution client and a consensus client, and why does client diversity matter?

Show answer

Since the Merge, an Ethereum node runs two pieces of software. The execution client, such as Geth, Nethermind, Besu, Erigon or Reth, runs the EVM, holds state and handles transactions. The consensus client, such as Lighthouse, Prysm, Teku, Nimbus or Lodestar, runs Proof of Stake. They talk over the Engine API. Client diversity matters because a bug in a client used by over two-thirds of validators could finalise an invalid chain and cause mass slashing.

What is IPFS and what is content addressing?

dApp DevelopmentEasy

Show answer

IPFS, the InterPlanetary File System, is a peer-to-peer network for storing and sharing files. Instead of locating files by server address, it identifies them by a content identifier (CID) derived from the file's hash, which is content addressing. The same content always has the same CID, and any change gives a new CID, so data cannot be swapped silently. Files must be pinned by a node or pinning service, otherwise they may disappear.

What is the difference between constant and immutable?

Solidity ProgrammingEasy

Show answer

constant variables must be assigned a compile-time value and are inlined into the bytecode, for example uint256 constant MAX = 1000. immutable variables are assigned once in the constructor and then embedded in the deployed code, for example an owner address or token address chosen at deployment. Neither uses a storage slot, so reading them is far cheaper than reading normal state. Use them for anything that never changes after deployment.

Design token vesting for team members and early investors.

DeFi, Tokens and NFTsMedium

Show answer

Use a vesting contract that holds allocated tokens and releases them on a schedule, typically a one-year cliff followed by monthly or linear vesting over two to four years. OpenZeppelin VestingWallet gives linear vesting per beneficiary; add a cliff and an owner-controlled revoke for employees who leave, returning unvested tokens. Make schedules public on-chain for transparency, and avoid admin functions that could release tokens early, as that erodes investor trust.

How do you calculate a borrower's health factor in a lending protocol?

DeFi, Tokens and NFTsMedium

Show answer

Health factor = (sum of collateral value x liquidation threshold) / total debt value. Below 1, the position can be liquidated. Example: collateral 10 ETH at 3,000 dollars = 30,000 dollars, liquidation threshold 80 percent, debt 18,000 dollars of stablecoins. HF = (30,000 x 0.80) / 18,000 = 1.33. If ETH falls to 2,250, collateral is 22,500, so HF = 18,000 / 18,000 = 1.0 and liquidation begins. Users raise HF by repaying debt or adding collateral.

What are seed phrases and HD wallets (BIP-39, BIP-32, BIP-44)?

Show answer

BIP-39 encodes random entropy as a 12 or 24 word mnemonic, which is turned into a binary seed. BIP-32 defines hierarchical deterministic wallets that derive a tree of key pairs from that seed. BIP-44 standardises the derivation path, for example m/44'/60'/0'/0/0 for the first Ethereum account. So one backed-up seed phrase can restore unlimited addresses across chains. Whoever knows the phrase controls every derived account, so it must never be stored online.

How do you store an NFT image on IPFS and use it in your contract?

dApp DevelopmentMedium

Show answer

Upload the image to IPFS using a node or a pinning service, which returns a CID. Create a metadata JSON file whose image field is ipfs://<imageCID>, then upload the metadata folder to get a folder CID. Set the contract's base URI to ipfs://<folderCID>/ so tokenURI(5) resolves to the file for token 5. Pin the content with more than one provider, and use a gateway URL only for display in the front-end.

How do you compute a function selector and decode calldata with cast?

Show answer

cast handles ABI work from the command line. # Function selector cast sig 'transfer(address,uint256)' # 0xa9059cbb # Encode calldata cast calldata 'transfer(address,uint256)' 0xAbc... 1000000 # Decode calldata from a transaction cast 4byte-decode 0xa9059cbb000000... # Decode with a known signature cast decode-calldata 'transfer(address,uint256)' 0xa9059cbb... This is useful when checking what a wallet is really asking you to sign.

Your team is preparing a contract for an external audit. What do you do beforehand?

Show answer

Freeze the code at a commit and stop adding features. Write clear documentation: architecture, roles, trust assumptions, invariants and known risks. Reach high test coverage including fuzz and invariant tests, and run Slither and fix its findings. Remove dead code, add NatSpec comments, and make the build reproducible. Share a scope list and a walkthrough call. A clean, well-documented codebase lets auditors spend their limited time on deep logic bugs.

Your fantasy sports contract needs live match scores. How do you get that data on-chain?

dApp DevelopmentMedium

Show answer

Smart contracts cannot call web APIs, so use an oracle. Options include a decentralised oracle network such as Chainlink Functions to fetch from several sports APIs and aggregate, or an optimistic oracle where results are proposed and can be disputed. Settle only after the match result is final, use multiple data sources, add a dispute window for high-value pools, and handle cancelled matches. Avoid a single back-end key posting results, which is a central point of failure.

What is MEV and what is proposer-builder separation?

Consensus and ScalingHard

Show answer

MEV, maximal extractable value, is profit a block producer or searcher earns by including, excluding or reordering transactions, for example arbitrage, liquidations and sandwich attacks on swaps. On Ethereum, most validators use MEV-Boost, where specialised builders assemble profitable blocks and bid for them through relays, separating block building from proposing. This spreads MEV revenue to validators but concentrates building power. Enshrined PBS and inclusion lists are being researched to reduce censorship risk.

You are launching a 10,000-piece NFT collection and fear gas wars and bots. How do you design the mint?

DeFi, Tokens and NFTsMedium

Show answer

Avoid a first-come public rush. Use an allowlist phase with Merkle proofs or signatures, per-wallet limits, and staggered time slots. Consider a Dutch auction or raffle so price, not gas, decides allocation. Use ERC-721A or efficient batch minting to cut gas. Reveal traits later with Chainlink VRF so bots cannot snipe rare items. Load-test the front-end and RPC, and keep pause functions ready in case something goes wrong.

How do you read the latest finalized block with ethers.js, and why use it?

Show answer

Pass the block tag to getBlock. The finalized tag returns the latest block that Proof of Stake has finalised, which cannot be reverted without slashing a third of stake. import { JsonRpcProvider } from 'ethers'; const provider = new JsonRpcProvider(process.env.RPC_URL); const latest = await provider.getBlock('latest'); const safe = await provider.getBlock('safe'); const finalized = await provider.getBlock('finalized'); console.log(latest.number - finalized.number); // usually about 64-96 Use finalized for deposits and accounting; use latest for UI updates.

Describe a time you disagreed with a teammate about architecture.

Show answer

Situation: a teammate wanted our indexer to read every event directly from the node at request time. Task: I believed it would not scale. Action: instead of arguing, I proposed a one-day spike, measured both approaches with realistic data, and shared numbers showing the database-backed indexer answered queries 40 times faster. Result: the team chose the indexer, my teammate led its reorg handling, and we agreed to settle future debates with quick experiments.

What are Delegated Proof of Stake and Proof of Authority?

Show answer

In Delegated Proof of Stake, token holders vote for a small set of block producers who validate on their behalf, giving high throughput but more centralisation. In Proof of Authority, a fixed set of known, reputable validators sign blocks; their identity, not stake, is at risk. PoA, often via Clique, IBFT or QBFT, suits private and consortium EVM networks and some testnets, where participants are known and fast, predictable block times matter more than open participation.

How can a smart contract suffer denial of service?

Show answer

Common causes: loops over arrays that grow with users until they exceed the block gas limit; push payments in a loop where one reverting recipient blocks everyone; relying on an external call that an attacker can make fail; and griefing by filling storage cheaply. For example, an auction that refunds the previous bidder will freeze if that bidder is a contract that reverts. Use pull payments, bounded loops, pagination and failure isolation.

Management wants to launch before the audit is complete. How do you handle it?

Smart Contract SecurityHard

Show answer

Situation: marketing had fixed a launch date, but the audit had two open high-severity findings. Task: protect users without blocking the business. Action: I explained the risk in money terms, proposed a guarded launch with a low deposit cap, pausable contracts and only the audited modules enabled, and shared a timeline for the fixes. Result: leadership accepted, we launched on time with caps, and raised limits two weeks later after fixes were verified.

What is a signature replay attack and how do you prevent it?

Show answer

If a contract accepts a signed message to perform an action, an attacker can resubmit the same signature to repeat it, or replay it on another chain or another contract using the same code. Prevent it by including a per-user nonce that increments on use, a deadline, the chain ID and the verifying contract address in the signed data. EIP-712 typed data with a domain separator gives a standard way to include these fields.

Show a contract vulnerable to reentrancy and a fixed version.

Show answer

Vulnerable: the balance is cleared after sending. function withdraw() external { uint256 bal = balances[msg.sender]; (bool ok, ) = msg.sender.call{value: bal}(''); require(ok); balances[msg.sender] = 0; } Fixed: update state first and add a guard. import {ReentrancyGuard} from '@openzeppelin/contracts/utils/ReentrancyGuard.sol'; function withdraw() external nonReentrant { uint256 bal = balances[msg.sender]; require(bal > 0, 'nothing'); balances[msg.sender] = 0; (bool ok, ) = msg.sender.call{value: bal}(''); require(ok, 'send failed'); }

What are function modifiers in Solidity?

Solidity ProgrammingEasy

Show answer

Modifiers are reusable pieces of code that run before or after a function body, placed where the underscore symbol appears. They are mainly used for checks such as onlyOwner, whenNotPaused or nonReentrant. For example, modifier onlyOwner() { require(msg.sender == owner, 'not owner'); _; } blocks everyone except the owner. Keep modifiers short and check-only; complex logic inside modifiers hides behaviour and increases bytecode size because the code is inlined into every function that uses it.

What is the difference between CREATE and CREATE2?

Show answer

CREATE computes a new contract's address from the deployer's address and nonce, so the address depends on deployment order. CREATE2 computes it from the deployer address, a chosen 32-byte salt and the hash of the init code, so the address is known before deployment and is the same wherever those inputs match. CREATE2 enables counterfactual wallets, deterministic factory deployments and same-address deployments across chains, but redeploying at the same address needs care.

How should NFT metadata and tokenURI be structured?

DeFi, Tokens and NFTsEasy

Show answer

tokenURI(id) returns a URI, usually ipfs://<CID>/<id>.json, pointing to JSON that marketplaces read: { "name": "Course Certificate #12", "description": "Completed Blockchain Developer course", "image": "ipfs://bafy.../12.png", "attributes": [ { "trait_type": "Grade", "value": "A" }, { "trait_type": "Year", "value": 2026 } ] } Store images and JSON on IPFS or Arweave rather than a normal server, so metadata cannot silently change or disappear.

What is a Merkle tree and what is a Merkle proof?

Show answer

A Merkle tree hashes data items in pairs, level by level, until one root hash remains. The root summarises all items: changing any item changes the root. A Merkle proof is the list of sibling hashes on the path from one item to the root. With it, a light client can prove that a transaction is in a block using about log2(n) hashes instead of downloading all transactions. Airdrop allowlists use the same trick on-chain.

What is the difference between call, delegatecall and staticcall?

Ethereum and the EVMHard

Show answer

call runs the target contract's code in the target's own context, with its own storage, and msg.sender becomes the caller contract. delegatecall runs the target's code in the caller's context, using the caller's storage, balance and original msg.sender; this is how proxies and libraries work, and storage layouts must match. staticcall is like call but reverts on any state change, used for view functions. Delegatecall to untrusted code is extremely dangerous.

Users report their USDC balance shows as a tiny fraction in your dApp. What is wrong?

dApp DevelopmentEasy

Show answer

USDC uses 6 decimals, but the front-end probably formats every token with 18 decimals, so 100 USDC (100,000,000 base units) displays as 0.0000000001. Read decimals() from each token contract, or from a trusted token list, and use formatUnits and parseUnits with that value. Use bigint for amounts, never JavaScript floats, to avoid precision errors. Add tests with tokens of 6, 8 and 18 decimals.

Your dApp needs a full history of user transactions and fast queries. Reading events from the node is too slow. What do you do?

Show answer

Build or use an indexer. An indexer listens to contract events from a start block, transforms them and stores them in a database like PostgreSQL, so the front-end runs normal fast queries. Options are a subgraph on The Graph, hosted indexing services, or a custom service with ethers and a queue. It must handle reorgs by tracking block hashes, support backfilling, and expose an API. Design events up front with indexed fields that queries need.

What is the difference between a soft fork and a hard fork?

Blockchain FundamentalsMedium

Show answer

A soft fork tightens the rules so that new blocks are still valid for old nodes; it is backward compatible, like Bitcoin's SegWit upgrade. A hard fork changes the rules so that old nodes reject new blocks, so every node must upgrade or the chain splits, as with Ethereum and Ethereum Classic in 2016. Planned network upgrades on Ethereum, such as Dencun and Pectra, are coordinated hard forks that all clients adopt together.

What is Bitcoin halving and difficulty adjustment?

Consensus and ScalingEasy

Show answer

Halving cuts the Bitcoin block reward in half every 210,000 blocks, roughly every four years, which caps total supply at 21 million BTC. After the April 2024 halving the reward is 3.125 BTC per block. Difficulty adjustment happens every 2016 blocks: if blocks came faster than ten minutes on average, difficulty rises, and if slower, it falls. Together they make issuance predictable regardless of how much mining power joins or leaves.

What are state channels, such as the Lightning Network?

Show answer

A state channel locks funds in an on-chain contract or multisig between parties, who then exchange many signed off-chain updates and settle only the final state on-chain. Lightning on Bitcoin links channels into a network so payments route through intermediaries using hashed timelock contracts. Channels give instant, nearly free payments but need participants to be online or use watchtowers, and they lock liquidity, so they suit repeated payments between known parties rather than general smart contracts.

How did integer overflow bugs happen before Solidity 0.8?

Smart Contract SecurityEasy

Show answer

Before 0.8, arithmetic wrapped silently: a uint8 at 255 plus 1 became 0, and 0 minus 1 became the maximum value. Attackers exploited this, for example by making a balance underflow to a huge number or an overflowed multiplication pass a check, as in the 2018 batchOverflow token bug. Developers used the SafeMath library to revert on overflow. Since 0.8 the compiler checks automatically, except inside unchecked blocks and in inline assembly.

Describe a time you found a security problem in code and how you handled it.

Show answer

Situation: while reviewing a teammate's staking contract, I saw it sent tokens before updating the user's balance. Task: confirm the risk without blaming anyone. Action: I wrote a Foundry test with a malicious receiver that re-entered withdraw and drained extra funds, then shared it privately with a suggested fix using checks-effects-interactions and a reentrancy guard. Result: the fix merged before the audit, and we added reentrancy tests to our standard checklist.

Show how to sign and verify a message with ethers.js.

Show answer

With ethers v6, a wallet signs using EIP-191 personal sign, and verifyMessage recovers the address. import { Wallet, verifyMessage } from 'ethers'; const wallet = Wallet.createRandom(); const message = 'Login nonce: 48213'; const signature = await wallet.signMessage(message); const recovered = verifyMessage(message, signature); console.log(recovered === wallet.address); // true This pattern powers Sign-In with Ethereum; the server issues a fresh nonce each time to stop replay.

A user's transaction has been pending for an hour. How do you troubleshoot it?

Blockchain FundamentalsMedium

Show answer

First check it on a block explorer: if it is not found, it was never broadcast. If pending, the fee is probably below current market rates, or an earlier transaction with a lower nonce is stuck and blocking it. On Ethereum you fix it by sending a replacement with the same nonce and a higher max fee and priority fee, or cancel by sending zero ETH to yourself with that nonce. Then make the wallet estimate fees dynamically.

How is a sidechain different from a rollup?