Blockchain Interview Questions in Kolkata

Show answer

Check that both execution and consensus clients are synced and peering well, since low peer count or a lagging execution client causes missed duties. Look at system clock sync through NTP, CPU, memory and disk I/O, as slow disks often cause delays. Review client logs and metrics in Grafana, check for pending client upgrades before a fork, and verify network ports are open. Never start a second copy of the same validator key as a fix, because that causes slashing.

Show how to sign and verify a message with ethers.js.

Show answer

With ethers v6, a wallet signs using EIP-191 personal sign, and verifyMessage recovers the address. import { Wallet, verifyMessage } from 'ethers'; const wallet = Wallet.createRandom(); const message = 'Login nonce: 48213'; const signature = await wallet.signMessage(message); const recovered = verifyMessage(message, signature); console.log(recovered === wallet.address); // true This pattern powers Sign-In with Ethereum; the server issues a fresh nonce each time to stop replay.

Which tools do you use for static analysis and fuzzing of smart contracts?

Smart Contract SecurityMedium

Show answer

Slither performs static analysis and quickly flags reentrancy, unchecked calls, shadowing and more. Aderyn is another fast static analyser. Foundry provides fuzz and invariant testing, where random sequences of calls try to break properties you define. Echidna and Medusa are property-based fuzzers. Mythril and Halmos use symbolic execution, and Certora offers formal verification. Combining them with manual review and high test coverage catches far more than any single tool.

How do you read a Chainlink price feed in Solidity safely?

DeFi, Tokens and NFTsMedium

Show answer

import {AggregatorV3Interface} from '@chainlink/contracts/src/v0.8/shared/interfaces/AggregatorV3Interface.sol'; AggregatorV3Interface public feed; uint256 constant MAX_DELAY = 1 hours; function getPrice() public view returns (uint256) { (, int256 answer, , uint256 updatedAt, ) = feed.latestRoundData(); require(answer > 0, 'bad price'); require(block.timestamp - updatedAt <= MAX_DELAY, 'stale price'); return uint256(answer); // scale using feed.decimals(), often 8 } Always check staleness, sign and decimals; on L2s also check the sequencer uptime feed.

How do you read a contract and send a transaction with viem?

dApp DevelopmentMedium

Show answer

viem is a typed, lightweight alternative to ethers, and wagmi builds React hooks on it. import { createPublicClient, createWalletClient, http, custom } from 'viem'; import { sepolia } from 'viem/chains'; const pub = createPublicClient({ chain: sepolia, transport: http() }); const count = await pub.readContract({ address: ADDR, abi, functionName: 'count' }); const wallet = createWalletClient({ chain: sepolia, transport: custom(window.ethereum) }); const [account] = await wallet.requestAddresses(); const hash = await wallet.writeContract({ address: ADDR, abi, functionName: 'increment', account }); await pub.waitForTransactionReceipt({ hash });

How is an Ethereum address derived from a private key?

Show answer

Start with a random 256-bit private key. Multiply it by the secp256k1 generator point to get a 64-byte uncompressed public key. Take the Keccak-256 hash of that public key and keep the last 20 bytes; that is the address, shown as 0x plus 40 hex characters. EIP-55 adds a mixed-case checksum so typos can be detected. The process is one-way: you cannot get the private key back from the address or public key.

Write a Python function that computes a Merkle root from a list of transactions.

Show answer

Hash leaves, then hash pairs until one remains, duplicating the last hash when a level is odd (Bitcoin style). import hashlib def h(b): return hashlib.sha256(b).digest() def merkle_root(txs): level = [h(t.encode()) for t in txs] while len(level) > 1: if len(level) % 2: level.append(level[-1]) level = [h(level[i] + level[i+1]) for i in range(0, len(level), 2)] return level[0].hex() print(merkle_root(['tx1', 'tx2', 'tx3']))

How do you test against real mainnet contracts using a fork?

dApp DevelopmentMedium

Show answer

Anvil or Foundry tests can fork a live chain at a block, so you interact with real tokens and protocols locally. # Start a local fork anvil --fork-url $MAINNET_RPC --fork-block-number 21000000 # Or fork inside a test function setUp() public { vm.createSelectFork(vm.envString('MAINNET_RPC'), 21000000); } # Give yourself tokens or impersonate a whale deal(address(usdc), alice, 1_000e6); vm.prank(whale); Pinning the block number keeps results reproducible and makes RPC caching effective.

Why should you not use tx.origin for authorisation?

Smart Contract SecurityEasy

Show answer

tx.origin is the EOA that started the transaction, while msg.sender is the immediate caller. If a contract checks require(tx.origin == owner), a phishing contract can trick the owner into calling it, and that contract then calls the victim; tx.origin is still the owner, so the check passes and funds can be stolen. Always use msg.sender for access control. tx.origin also breaks with smart contract wallets and account abstraction.

An auditor flags that a single owner key can mint tokens and change fees. How do you address it?

Smart Contract SecurityMedium

Show answer

This is centralisation risk: if the key is compromised or misused, users lose funds. Move ownership to a multisig with signers on separate devices, add a timelock so users can see and react to changes, set hard-coded bounds such as a maximum fee, and remove powers that are not needed, like unlimited minting. Use role-based access instead of one all-powerful owner, and document the remaining admin powers publicly.

Describe a time you disagreed with a teammate about architecture.

Show answer

Situation: a teammate wanted our indexer to read every event directly from the node at request time. Task: I believed it would not scale. Action: instead of arguing, I proposed a one-day spike, measured both approaches with realistic data, and shared numbers showing the database-backed indexer answered queries 40 times faster. Result: the team chose the indexer, my teammate led its reorg handling, and we agreed to settle future debates with quick experiments.

How do you read the latest finalized block with ethers.js, and why use it?

Show answer

Pass the block tag to getBlock. The finalized tag returns the latest block that Proof of Stake has finalised, which cannot be reverted without slashing a third of stake. import { JsonRpcProvider } from 'ethers'; const provider = new JsonRpcProvider(process.env.RPC_URL); const latest = await provider.getBlock('latest'); const safe = await provider.getBlock('safe'); const finalized = await provider.getBlock('finalized'); console.log(latest.number - finalized.number); // usually about 64-96 Use finalized for deposits and accounting; use latest for UI updates.

How would you check on-chain whether a user is in a 10,000-address allowlist without storing all addresses?

Show answer

Build a Merkle tree off-chain from the allowlisted addresses (hashing each leaf, ideally double-hashed with amounts if needed) and store only the 32-byte root in the contract. Each user submits a proof of about 14 hashes for 10,000 leaves. The contract recomputes the root with OpenZeppelin MerkleProof.verify and compares it. This costs one storage slot instead of 10,000, and you can update the list by changing the root.

Compare ERC-20, ERC-721 and ERC-1155 tokens.

DeFi, Tokens and NFTsEasy

Show answer

ERC-20 defines fungible tokens where every unit is identical, with functions like transfer, approve, transferFrom and balanceOf; used for currencies, stablecoins and governance tokens. ERC-721 defines non-fungible tokens where each tokenId is unique, used for NFTs like art, tickets or certificates. ERC-1155 is a multi-token standard where one contract manages many token types, fungible or not, with batch transfers; it is popular in games where items have quantities.

A transaction keeps failing with an out of gas error. How do you fix it?

Ethereum and the EVMMedium

Show answer

First see whether the gas limit was too low or the function is genuinely unbounded. Run eth_estimateGas or simulate with cast run or Tenderly to see actual gas used and where it fails. If estimation is fine, raise the limit with a buffer of 10 to 20 percent. If the function loops over a growing array, redesign it with pagination or pull-based patterns, because the block gas limit will eventually make it impossible to call.

What is the Ethereum Virtual Machine (EVM)?

Ethereum and the EVMEasy

Show answer

The EVM is the sandboxed, deterministic runtime that executes smart contract bytecode on every Ethereum node. It is a stack-based machine with 256-bit words, and each opcode has a gas cost, so every computation is metered and infinite loops are impossible. Because every node must get the same result, contracts cannot access the internet or randomness directly. Many chains and rollups are EVM-compatible, so the same Solidity contracts and tools work across them.

How does inheritance work in Solidity, including virtual and override?

Show answer

A contract inherits with is, for example contract Token is ERC20, Ownable. Parent functions that may be changed must be marked virtual, and the child must use override; with several parents you list them, as in override(A, B). Solidity uses C3 linearisation, so the order of the parent list matters, from most base to most derived, and super calls the next contract in that order. Constructors of parents run first in linearised order.

What are value types and reference types in Solidity, and what are data locations?

Solidity ProgrammingEasy

Show answer

Value types such as uint, int, bool, address, bytes32 and enums are copied when assigned or passed. Reference types such as arrays, structs, strings and mappings point to data, so you must state a data location: storage for persistent contract state, memory for temporary data inside a function, or calldata for read-only external inputs. Assigning storage to a local storage pointer modifies state, while copying to memory creates an independent copy.

What is the difference between SHA-256 and Keccak-256?

Show answer

SHA-256 is from the SHA-2 family and uses a Merkle-Damgard construction; Bitcoin uses double SHA-256 for block hashes and transaction IDs. Keccak-256 is based on the sponge construction and is what Ethereum uses for addresses, function selectors, event topics and storage slots. Ethereum's Keccak-256 is the original Keccak submission and differs from the final NIST SHA3-256 in padding, so the two give different outputs for the same input.

Explain storage, memory, stack and calldata in the EVM.

Ethereum and the EVMMedium

Show answer

Storage is persistent key-value data of 32-byte slots per contract; it is the most expensive, and writes to new slots cost about 20,000 gas. Memory is a temporary byte array cleared after each call, cheap but growing in cost quadratically. The stack holds up to 1024 words for opcode operands. Calldata is the read-only input data of the transaction, the cheapest place to read external function arguments from. Choosing the right location is a key gas optimisation.

Compare multisig wallets and MPC wallets.

Show answer

A multisig wallet is a smart contract, such as a Safe, that needs M of N owner signatures to execute a transaction; rules are visible on-chain and easy to audit, but every action costs extra gas and works per chain. An MPC wallet splits one private key into shares held by different parties who jointly produce a normal signature; it looks like a regular address, works on any chain and allows key rotation, but the security depends on the off-chain implementation.

What is the difference between constant and immutable?

Solidity ProgrammingEasy

Show answer

constant variables must be assigned a compile-time value and are inlined into the bytecode, for example uint256 constant MAX = 1000. immutable variables are assigned once in the constructor and then embedded in the deployed code, for example an owner address or token address chosen at deployment. Neither uses a storage slot, so reading them is far cheaper than reading normal state. Use them for anything that never changes after deployment.

How should NFT metadata and tokenURI be structured?

DeFi, Tokens and NFTsEasy

Show answer

tokenURI(id) returns a URI, usually ipfs://<CID>/<id>.json, pointing to JSON that marketplaces read: { "name": "Course Certificate #12", "description": "Completed Blockchain Developer course", "image": "ipfs://bafy.../12.png", "attributes": [ { "trait_type": "Grade", "value": "A" }, { "trait_type": "Year", "value": 2026 } ] } Store images and JSON on IPFS or Arweave rather than a normal server, so metadata cannot silently change or disappear.

How did you handle a time you received critical code review feedback?

Show answer

Situation: a senior reviewer rejected my pull request for a staking feature, saying the storage layout would break future upgrades. Task: fix it and learn. Action: I thanked him, asked him to explain the risk, read about EIP-1967 and storage gaps, rewrote the contract with namespaced storage, and added a storage-layout check to CI. Result: the PR merged, and that check later caught a teammate's layout change before an upgrade.

A function that distributes rewards loops over all users and is getting too expensive. How do you fix it?

Show answer

Unbounded loops eventually exceed the block gas limit. Switch to a pull-based accounting model: maintain a global reward-per-token accumulator that grows when rewards are added, and store each user's last checkpoint. Users claim with reward equals balance times (current accumulator minus their checkpoint). This makes distribution O(1) for any number of users. Alternatively, use a Merkle distributor where rewards are computed off-chain and users claim with proofs.

What are the main components of Hyperledger Fabric?

Blockchain FundamentalsMedium

Show answer

Hyperledger Fabric is a permissioned enterprise framework. Peers hold the ledger and run chaincode (smart contracts written in Go, Java or JavaScript). Orderers, usually using Raft, sequence transactions into blocks. A Membership Service Provider issues identities through certificate authorities. Channels give separate private ledgers to subsets of members, and private data collections hide data inside a channel. Fabric uses an execute-order-validate flow with endorsement policies instead of mining.

Users complain they received far fewer tokens than expected on large swaps. What is happening and how do you help?

DeFi, Tokens and NFTsMedium

Show answer

Large trades in shallow pools suffer price impact, and wide slippage settings let sandwich bots extract extra value. Show the expected output, price impact and minimum received before confirming. Set sensible default slippage, such as 0.5 percent for major pairs, and warn when impact is high. Use a router or aggregator that splits trades across pools, and offer private transaction submission so bots cannot see the swap in the public mempool.

Why do you want to build a career in blockchain?

Blockchain FundamentalsEasy

Show answer

Use a specific, sincere answer. For example: I first got interested when I built a small token contract in college and saw that code could hold and move value without a middleman. Since then I have completed Solidity projects, learnt Foundry testing and read audit reports. I like that the field mixes cryptography, distributed systems and finance. I want to grow as a smart contract developer and help build secure, real-world applications such as payments, tokenisation or supply chain.

Your dApp's users are paying high gas fees on Ethereum mainnet. How would you choose a Layer 2?

Show answer

I would compare candidate rollups on security (proof system live, stage of decentralisation, upgrade keys), EVM compatibility so our Solidity code deploys unchanged, ecosystem fit (wallets, oracles, liquidity, bridges our users already use), fees and throughput, and withdrawal experience. I would deploy to testnets first, measure real costs and latency, and check that our dependencies such as Chainlink feeds exist there. Then migrate gradually, keeping L1 contracts for high-value settlement if needed.

What are seed phrases and HD wallets (BIP-39, BIP-32, BIP-44)?

Show answer

BIP-39 encodes random entropy as a 12 or 24 word mnemonic, which is turned into a binary seed. BIP-32 defines hierarchical deterministic wallets that derive a tree of key pairs from that seed. BIP-44 standardises the derivation path, for example m/44'/60'/0'/0/0 for the first Ethereum account. So one backed-up seed phrase can restore unlimited addresses across chains. Whoever knows the phrase controls every derived account, so it must never be stored online.

How do you read a contract's storage slot directly with Foundry's cast?

Ethereum and the EVMMedium

Show answer

Use cast storage with the contract address and slot number. For mappings, compute the slot as keccak256(key . slot). # Read slot 0 (often the first state variable) cast storage 0xContractAddress 0 --rpc-url $RPC_URL # balanceOf mapping stored at slot 2, key = user address cast index address 0xUserAddress 2 cast storage 0xContractAddress <slot-from-above> --rpc-url $RPC_URL This shows that private variables are not secret: anyone can read storage.

How does Ethereum's Proof of Stake work?

Show answer

Validators deposit 32 ETH (after the Pectra upgrade a validator can hold up to 2048 ETH) to join. Time is divided into 12-second slots and 32-slot epochs. In each slot a randomly chosen validator proposes a block and committees attest to it. The fork-choice rule LMD-GHOST picks the head, and Casper FFG finalises checkpoints when two-thirds of stake agrees. Honest validators earn rewards; offline ones lose small amounts, and provably malicious ones are slashed.

You are launching a 10,000-piece NFT collection and fear gas wars and bots. How do you design the mint?

DeFi, Tokens and NFTsMedium

Show answer

Avoid a first-come public rush. Use an allowlist phase with Merkle proofs or signatures, per-wallet limits, and staggered time slots. Consider a Dutch auction or raffle so price, not gas, decides allocation. Use ERC-721A or efficient batch minting to cut gas. Reveal traits later with Chainlink VRF so bots cannot snipe rare items. Load-test the front-end and RPC, and keep pause functions ready in case something goes wrong.

How would you set up a local blockchain for development and testing?

Blockchain FundamentalsEasy

Show answer

For EVM work, run a local node with Anvil from Foundry or the Hardhat network. Each gives about ten pre-funded test accounts, instant mining and console logging. You can fork mainnet at a given block to test against real contracts and balances without spending money. For integration tests, deploy to a public testnet such as Sepolia, using faucet ETH. Keep deploy scripts and RPC URLs in config so the same code targets local, testnet and mainnet.

How are mappings stored, and why can you not iterate over them?