36 practice questions with answers for Blockchain interviews in Mumbai.
Blockchain jobs in Mumbai
Mumbai is India's financial capital, so banks, fintechs, insurers, media and consulting firms drive much of the hiring. Data and QA interviews often include domain questions on payments, risk, trading or customer analytics.
Below are 36 questions that match the mix of service, product and domain employers hiring blockchain developers in Mumbai.
Solved for MumbaiStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Which tools do you use for static analysis and fuzzing of smart contracts?
Slither performs static analysis and quickly flags reentrancy, unchecked calls, shadowing and more. Aderyn is another fast static analyser. Foundry provides fuzz and invariant testing, where random sequences of calls try to break properties you define. Echidna and Medusa are property-based fuzzers. Mythril and Halmos use symbolic execution, and Certora offers formal verification. Combining them with manual review and high test coverage catches far more than any single tool.
A multisig wallet is a smart contract, such as a Safe, that needs M of N owner signatures to execute a transaction; rules are visible on-chain and easy to audit, but every action costs extra gas and works per chain. An MPC wallet splits one private key into shares held by different parties who jointly produce a normal signature; it looks like a regular address, works on any chain and allows key rotation, but the security depends on the off-chain implementation.
03
How does a constant product automated market maker work, and what is impermanent loss?
A constant product AMM holds two tokens with reserves x and y and keeps x times y equal to k. A trader adds one token and removes the other so that k stays constant after fees, which makes price equal to the reserve ratio and rise with trade size. Liquidity providers earn fees, but when prices move, arbitrage rebalances the pool, leaving them worse off than simply holding; that gap is impermanent loss.
04
What is the difference between an execution client and a consensus client, and why does client diversity matter?
Since the Merge, an Ethereum node runs two pieces of software. The execution client, such as Geth, Nethermind, Besu, Erigon or Reth, runs the EVM, holds state and handles transactions. The consensus client, such as Lighthouse, Prysm, Teku, Nimbus or Lodestar, runs Proof of Stake. They talk over the Engine API. Client diversity matters because a bug in a client used by over two-thirds of validators could finalise an invalid chain and cause mass slashing.
05
What is the difference between receive and fallback functions?
receive() external payable runs when a contract receives plain ETH with empty calldata, for example a transfer from a wallet. fallback() runs when calldata matches no function, or when ETH arrives with data and no receive exists; it must be payable to accept ETH. Proxies use fallback to delegatecall all unknown calls to the implementation. Keep both simple, since a reverting or gas-heavy receive can break senders that use transfer with its 2300 gas stipend.
06
A group of banks wants a shared KYC ledger. Would you choose a public chain, a Layer 2 or Hyperledger Fabric?
For shared KYC among regulated banks I would lean to a permissioned framework such as Hyperledger Fabric or a private EVM network. Members are known, data is confidential, and regulators expect access control and data residency in India. Fabric channels and private data collections restrict who sees what, and Raft ordering gives fast finality without gas fees. A public chain or L2 fits only if we need open verification, and even then only hashes and attestations would go on it.
07
An HR team wants to store employee records on a blockchain. Would you recommend it?
Usually no. Employee records are owned by one organisation, change often and contain personal data that must be correctable and deletable under the DPDP Act 2023. A normal database with role-based access and audit logs is cheaper, faster and compliant. I would ask who else needs to trust the data. If several employers or background-check agencies must verify certificates, I would store only hashes of credentials on a permissioned chain and keep the actual data off-chain.
08
Write a Python function that computes a Merkle root from a list of transactions.
Hash leaves, then hash pairs until one remains, duplicating the last hash when a level is odd (Bitcoin style).
import hashlib
def h(b):
return hashlib.sha256(b).digest()
def merkle_root(txs):
level = [h(t.encode()) for t in txs]
while len(level) > 1:
if len(level) % 2:
level.append(level[-1])
level = [h(level[i] + level[i+1]) for i in range(0, len(level), 2)]
return level[0].hex()
print(merkle_root(['tx1', 'tx2', 'tx3']))
09
Design token vesting for team members and early investors.
Use a vesting contract that holds allocated tokens and releases them on a schedule, typically a one-year cliff followed by monthly or linear vesting over two to four years. OpenZeppelin VestingWallet gives linear vesting per beneficiary; add a cliff and an owner-controlled revoke for employees who leave, returning unvested tokens. Make schedules public on-chain for transparency, and avoid admin functions that could release tokens early, as that erodes investor trust.
10
A user lost funds on our DeFi app due to their own mistake and is angry. How would you handle it?
Situation: a user sent tokens to the contract address directly instead of using deposit, and they were stuck. Task: support him honestly. Action: I listened, explained calmly what happened without blaming him, checked whether a recovery function existed, and escalated to the team. We had a rescue function for stray tokens behind the multisig, so after verification we returned them. Result: he thanked us publicly, and we added a front-end warning.
11
Your staking validator is missing attestations and losing rewards. How do you investigate?
Check that both execution and consensus clients are synced and peering well, since low peer count or a lagging execution client causes missed duties. Look at system clock sync through NTP, CPU, memory and disk I/O, as slow disks often cause delays. Review client logs and metrics in Grafana, check for pending client upgrades before a fork, and verify network ports are open. Never start a second copy of the same validator key as a fix, because that causes slashing.
12
What are front-running and sandwich attacks, and how do you mitigate them?
Pending transactions are public, so bots can copy or outbid them. Front-running is placing a transaction ahead of a victim's, for example buying before a large purchase. A sandwich attack buys before the victim's swap and sells right after, profiting from the price impact. Mitigations include slippage limits and deadlines, commit-reveal schemes, batch auctions, private transaction relays, and design that does not reward ordering, such as using time-weighted prices.
13
Tell me about a blockchain project you have built.
Pick one project and explain it with STAR. Situation: in my final year I wanted to learn Solidity end to end. Task: build a crowdfunding dApp. Action: I wrote the contract with goal and deadline logic and refunds, tested it with Foundry including fuzz tests, built a Next.js front-end with wagmi, and deployed to Sepolia. Result: 30 friends tested it, I fixed a refund bug they found, and the repo now has docs and a demo video.
14
What is a Merkle Patricia Trie and why does Ethereum use it?
A Merkle Patricia Trie combines a Patricia (compressed prefix) trie with Merkle hashing. Ethereum uses it to store world state, account storage, transactions and receipts, with each root stored in the block header. It allows efficient insert, update and lookup by key, and any value can be proven against the root with a proof. Its weakness is large proof size, which is why Ethereum researchers plan to move to Verkle or binary hash trees for stateless clients.
15
How do you keep up with security and cryptography developments in Web3?
I follow a routine. Weekly I read new audit reports and post-mortems of exploits, and I try to reproduce one in Foundry. I track Ethereum Improvement Proposals and upgrade notes, read Solidity release notes, and practise on capture-the-flag platforms such as Ethernaut and Damn Vulnerable DeFi. I also keep a personal notes file of attack patterns. This keeps my knowledge practical rather than just theoretical, and I share summaries with my team.
16
What does a smart contract audit process look like?
It starts with scoping: fixed commit, documentation, threat model and test coverage. Auditors run automated tools like Slither and fuzzers, then do manual line-by-line review, checking business logic, access control, economic attacks and integrations. They write findings rated critical, high, medium, low and informational with fixes. The team fixes issues, auditors review the fixes, and a final report is published. Audits reduce risk but do not guarantee safety, so add bug bounties and monitoring.
The Merge, completed in September 2022, switched Ethereum from Proof of Work to Proof of Stake by joining the original execution chain with the Beacon Chain, which had been running PoS since December 2020. Mining ended, energy use fell by more than 99.9 percent, and new ETH issuance dropped sharply. Block times became a fixed 12 seconds. Staked ETH withdrawals were enabled later in the Shapella upgrade of April 2023.
18
How do you get the latest block number from an Ethereum node using JSON-RPC?
Send a JSON-RPC POST request to the node or provider URL. The result is a hex string that you convert to decimal.
curl -s -X POST https://rpc.example.org \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
# Response: {"jsonrpc":"2.0","id":1,"result":"0x15d3a1c"}
# In Python: int('0x15d3a1c', 16)
Other common methods are eth_getBalance, eth_call and eth_getTransactionReceipt.
19
Users complain they must pay gas to approve tokens before every trade. How can signatures help?
Use off-chain signed approvals. With EIP-2612 permit, the user signs a typed EIP-712 message granting an allowance, and the dApp submits it with the trade in one transaction, so no separate approve call is needed. For tokens without permit, Permit2-style contracts give the same experience after one approval. EIP-712 shows readable fields in the wallet, reducing phishing risk. Always include a nonce, deadline, chain ID and verifying contract to prevent replays.
20
How do you get current fee data and send an EIP-1559 transaction with ethers.js?
A dApp usually has smart contracts on a chain holding core logic and assets; a front-end, often React or Next.js, that connects to the user's wallet; a library such as ethers.js, viem or wagmi to read and write contracts through an RPC provider; an indexer or subgraph for fast queries of history; decentralised storage such as IPFS for files and metadata; and optional back-end services for notifications, relaying or off-chain computation, with oracles bringing external data on-chain.
23
Your RPC provider starts rate-limiting and the dApp breaks during peak traffic. What do you do?
Short term, add a fallback transport with multiple providers so requests fail over automatically, and use retries with backoff. Reduce load: batch calls with multicall, cache read results, use WebSockets instead of tight polling, and move history queries to an indexer. Long term, upgrade the plan, spread traffic across providers or run your own node for critical paths, and monitor error rates and latency with alerts so you learn of issues before users do.
24
How did you handle a time you received critical code review feedback?
Situation: a senior reviewer rejected my pull request for a staking feature, saying the storage layout would break future upgrades. Task: fix it and learn. Action: I thanked him, asked him to explain the risk, read about EIP-1967 and storage gaps, rewrote the contract with namespaced storage, and added a storage-layout check to CI. Result: the PR merged, and that check later caught a teammate's layout change before an upgrade.
EIP-1559 splits the fee into a base fee and a priority fee. The protocol sets the base fee per block from demand: if the previous block was more than half full, it rises up to 12.5 percent, otherwise it falls. The base fee is burned. Users add a priority fee (tip) for the proposer and set maxFeePerGas as their cap. They pay base fee plus tip, never more than the cap, which makes fees more predictable.
26
What is a signature replay attack and how do you prevent it?
If a contract accepts a signed message to perform an action, an attacker can resubmit the same signature to repeat it, or replay it on another chain or another contract using the same code. Prevent it by including a per-user nonce that increments on use, a deadline, the chain ID and the verifying contract address in the signed data. EIP-712 typed data with a domain separator gives a standard way to include these fields.
27
What are seed phrases and HD wallets (BIP-39, BIP-32, BIP-44)?
BIP-39 encodes random entropy as a 12 or 24 word mnemonic, which is turned into a binary seed. BIP-32 defines hierarchical deterministic wallets that derive a tree of key pairs from that seed. BIP-44 standardises the derivation path, for example m/44'/60'/0'/0/0 for the first Ethereum account. So one backed-up seed phrase can restore unlimited addresses across chains. Whoever knows the phrase controls every derived account, so it must never be stored online.
The trilemma says a blockchain finds it hard to maximise decentralisation, security and scalability at the same time on a single layer. Raising block size or using few validators increases throughput but reduces decentralisation. Ethereum's answer is a rollup-centric roadmap: keep the base layer decentralised and secure, and move execution to Layer 2 rollups that post data back to Layer 1. Many high-throughput chains instead accept fewer, more powerful validators.
29
How does arithmetic overflow work in Solidity 0.8, and when do you use unchecked?
Since 0.8.0, arithmetic is checked by default: overflow or underflow reverts with a Panic, so SafeMath is no longer needed. Checks cost a little gas. Wrapping code in an unchecked block disables them, which is safe when you have proven the value cannot overflow, such as a loop counter bounded by an array length, or subtracting after a require that a is at least b. Using unchecked carelessly reintroduces the old overflow bugs.
The ABI (Application Binary Interface) is the JSON description of a contract's functions, events and errors, and it defines how arguments are encoded. A function selector is the first four bytes of the Keccak-256 hash of the function signature, for example transfer(address,uint256) gives 0xa9059cbb. Calldata is the selector followed by ABI-encoded arguments in 32-byte words. Wallets, ethers.js and explorers use the ABI to encode calls and decode results and events.
31
What is a cryptographic hash function and what properties must it have?
A hash function maps any input to a fixed-size output, such as 256 bits. For blockchain it must be deterministic, fast to compute, pre-image resistant (you cannot find the input from the hash), second pre-image resistant, and collision resistant (finding two inputs with the same hash is infeasible). It should also show the avalanche effect, where a one-bit change gives a completely different hash. Blocks, addresses, Merkle trees and proof of work all depend on these properties.
32
How do you deploy a contract to a Layer 2 testnet with Foundry?
Set the RPC URL and a deployer key, then use forge create or a script, and verify the source on the explorer.
export RPC_URL=https://sepolia.l2-example.org
export PRIVATE_KEY=0x... # testnet key only
forge create src/Counter.sol:Counter \
--rpc-url $RPC_URL --private-key $PRIVATE_KEY --broadcast
# Scripted deploy with verification
forge script script/Deploy.s.sol --rpc-url $RPC_URL \
--broadcast --verify
Use a keystore via cast wallet import instead of raw keys for anything real.
Type 0 is the legacy transaction with a single gasPrice. Type 1, from EIP-2930, adds an access list. Type 2, from EIP-1559, uses maxFeePerGas and maxPriorityFeePerGas and is the default in wallets. Type 3, from EIP-4844, carries blobs for rollup data. Type 4, from EIP-7702 in the Pectra upgrade of May 2025, lets an EOA set code delegation through a signed authorisation list, enabling batching and sponsored gas for normal wallets.
34
An auditor flags that a single owner key can mint tokens and change fees. How do you address it?
This is centralisation risk: if the key is compromised or misused, users lose funds. Move ownership to a multisig with signers on separate devices, add a timelock so users can see and react to changes, set hard-coded bounds such as a maximum fee, and remove powers that are not needed, like unlimited minting. Use role-based access instead of one all-powerful owner, and document the remaining admin powers publicly.
35
Your dApp's users are paying high gas fees on Ethereum mainnet. How would you choose a Layer 2?
I would compare candidate rollups on security (proof system live, stage of decentralisation, upgrade keys), EVM compatibility so our Solidity code deploys unchanged, ecosystem fit (wallets, oracles, liquidity, bridges our users already use), fees and throughput, and withdrawal experience. I would deploy to testnets first, measure real costs and latency, and check that our dependencies such as Chainlink feeds exist there. Then migrate gradually, keeping L1 contracts for high-value settlement if needed.
Events are declared in Solidity and emitted with emit; the EVM writes them as logs in the transaction receipt. Each log has the contract address, up to three indexed topics plus the event signature hash, and non-indexed data. Logs are much cheaper than storage but contracts cannot read them. Front-ends and indexers subscribe to events to update the UI, track token transfers and build history, so emitting clear events for every state change is good practice.
Which companies hire Blockchain professionals in Mumbai?
Companies with large offices in Mumbai include TCS, Accenture, Deloitte, KPMG, PwC, Capgemini, LTIMindtree, JP Morgan Chase, Visa, Mastercard. Use their company pages below to practise employer-specific sets.
Are Blockchain interviews in Mumbai different from other cities?
The questions depend more on the company than the city. Mumbai's mix of employers decides the style: Data and QA interviews often include domain questions on payments, risk, trading or customer analytics
How do I find Blockchain jobs in Mumbai?
Shortlist companies with Mumbai offices, keep your CV focused on Blockchain projects, apply on company career pages and job portals with the Mumbai filter, and practise the questions on this page before each interview.