Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About PwC hiring for Blockchain roles
PwC is one of the Big Four professional services networks, offering assurance, tax, consulting and deals services. In India, PwC member firms and acceleration centres support global clients with technology consulting, data analytics, cyber, risk and process work. It hires for associate and consultant roles in analytics, BI, testing, ERP and risk assurance.
For Blockchain roles, this PwC practice set focuses most on DeFi, Tokens and NFTs (7), Solidity Programming (5), Smart Contract Security (4), Ethereum and the EVM (4). It has 10 easy, 14 medium, 6 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
London, United Kingdom
Main India offices
Kolkata, Bengaluru, Mumbai, Hyderabad, Gurugram
PwC Blockchain interview process
Online assessment (aptitude + technical)
Group discussion or case round
Technical interview
Partner or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for PwCStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between receive and fallback functions?
receive() external payable runs when a contract receives plain ETH with empty calldata, for example a transfer from a wallet. fallback() runs when calldata matches no function, or when ETH arrives with data and no receive exists; it must be payable to accept ETH. Proxies use fallback to delegatecall all unknown calls to the implementation. Keep both simple, since a reverting or gas-heavy receive can break senders that use transfer with its 2300 gas stipend.
02
How does inheritance work in Solidity, including virtual and override?
A contract inherits with is, for example contract Token is ERC20, Ownable. Parent functions that may be changed must be marked virtual, and the child must use override; with several parents you list them, as in override(A, B). Solidity uses C3 linearisation, so the order of the parent list matters, from most base to most derived, and super calls the next contract in that order. Constructors of parents run first in linearised order.
It is an ordering rule for functions. First do checks: validate inputs, permissions and balances with require. Then apply effects: update all state variables, such as reducing the user's balance. Only then do interactions: external calls, token transfers or ETH sends. Because state is already updated, a re-entering call sees the new state and cannot repeat the action. Combine it with a nonReentrant modifier for defence in depth, especially in functions calling unknown contracts.
04
Your exchange credited a deposit, but the block was later dropped in a reorg and the funds vanished. How do you prevent this?
Credit deposits only after enough confirmations for the chain's risk profile, and on Ethereum prefer waiting for finalized or at least safe block tags rather than the latest block. Make the deposit indexer reorg-aware: track block hashes, detect when a parent hash changes, roll back credits from orphaned blocks and reprocess. Scale required confirmations with deposit size, and alert on unusually deep reorgs on smaller chains, which can signal a 51 percent attack.
05
How does a constant product automated market maker work, and what is impermanent loss?
A constant product AMM holds two tokens with reserves x and y and keeps x times y equal to k. A trader adds one token and removes the other so that k stays constant after fees, which makes price equal to the reserve ratio and rise with trade size. Liquidity providers earn fees, but when prices move, arbitrage rebalances the pool, leaving them worse off than simply holding; that gap is impermanent loss.
06
How do you connect a browser wallet to a dApp using ethers.js?
Browser wallets inject an EIP-1193 provider at window.ethereum. Wrap it with BrowserProvider and request accounts.
import { BrowserProvider } from 'ethers';
async function connect() {
if (!window.ethereum) throw new Error('Install a wallet');
const provider = new BrowserProvider(window.ethereum);
const signer = await provider.getSigner(); // prompts the user
const address = await signer.getAddress();
const { chainId } = await provider.getNetwork();
return { signer, address, chainId };
}
In production, use EIP-6963 discovery or a connector library so users with several wallets can choose.
07
How did integer overflow bugs happen before Solidity 0.8?
Before 0.8, arithmetic wrapped silently: a uint8 at 255 plus 1 became 0, and 0 minus 1 became the maximum value. Attackers exploited this, for example by making a balance underflow to a huge number or an overflowed multiplication pass a check, as in the 2018 batchOverflow token bug. Developers used the SafeMath library to revert on overflow. Since 0.8 the compiler checks automatically, except inside unchecked blocks and in inline assembly.
08
Users complain they must pay gas to approve tokens before every trade. How can signatures help?
Use off-chain signed approvals. With EIP-2612 permit, the user signs a typed EIP-712 message granting an allowance, and the dApp submits it with the trade in one transaction, so no separate approve call is needed. For tokens without permit, Permit2-style contracts give the same experience after one approval. EIP-712 shows readable fields in the wallet, reducing phishing risk. Always include a nonce, deadline, chain ID and verifying contract to prevent replays.
09
What happens, step by step, when you send an Ethereum transaction?
The wallet builds the transaction with nonce, to, value, data, gas limit and fee fields, signs it with the private key, and sends it to a node via eth_sendRawTransaction. The node validates and gossips it to other mempools. A block builder includes it, and the proposer publishes the block. Every node executes it in the EVM, updating state and producing a receipt with status, gas used and logs. After about two epochs the block is finalised.
10
Write a basic voting contract using a struct, mapping and event.
public functions can be called externally and internally, and public state variables get an automatic getter. external functions can only be called from outside, or via this.f(), and read arguments directly from calldata. internal functions and variables are available to the contract and contracts that inherit it. private is limited to the defining contract only. Note that private only restricts other contracts; the data is still fully visible on the blockchain to anyone.
12
Describe a time you disagreed with a teammate about architecture.
Situation: a teammate wanted our indexer to read every event directly from the node at request time. Task: I believed it would not scale. Action: instead of arguing, I proposed a one-day spike, measured both approaches with realistic data, and shared numbers showing the database-backed indexer answered queries 40 times faster. Result: the team chose the indexer, my teammate led its reorg handling, and we agreed to settle future debates with quick experiments.
DeFi, decentralised finance, means financial services such as trading, lending, borrowing, stablecoins and derivatives built as smart contracts on public blockchains. Anyone with a wallet can use them without a bank account or approval, contracts are transparent, and protocols can be combined like building blocks. Examples are automated market maker exchanges, overcollateralised lending markets and liquid staking. The risks are smart contract bugs, oracle failures, volatile collateral and unclear regulation.
14
How should NFT metadata and tokenURI be structured?
tokenURI(id) returns a URI, usually ipfs://<CID>/<id>.json, pointing to JSON that marketplaces read:
{
"name": "Course Certificate #12",
"description": "Completed Blockchain Developer course",
"image": "ipfs://bafy.../12.png",
"attributes": [
{ "trait_type": "Grade", "value": "A" },
{ "trait_type": "Year", "value": 2026 }
]
}
Store images and JSON on IPFS or Arweave rather than a normal server, so metadata cannot silently change or disappear.
15
What are Delegated Proof of Stake and Proof of Authority?
In Delegated Proof of Stake, token holders vote for a small set of block producers who validate on their behalf, giving high throughput but more centralisation. In Proof of Authority, a fixed set of known, reputable validators sign blocks; their identity, not stake, is at risk. PoA, often via Clique, IBFT or QBFT, suits private and consortium EVM networks and some testnets, where participants are known and fast, predictable block times matter more than open participation.
16
Your team is preparing a contract for an external audit. What do you do beforehand?
Freeze the code at a commit and stop adding features. Write clear documentation: architecture, roles, trust assumptions, invariants and known risks. Reach high test coverage including fuzz and invariant tests, and run Slither and fix its findings. Remove dead code, add NatSpec comments, and make the build reproducible. Share a scope list and a walkthrough call. A clean, well-documented codebase lets auditors spend their limited time on deep logic bugs.
17
What is the difference between a soft fork and a hard fork?
A soft fork tightens the rules so that new blocks are still valid for old nodes; it is backward compatible, like Bitcoin's SegWit upgrade. A hard fork changes the rules so that old nodes reject new blocks, so every node must upgrade or the chain splits, as with Ethereum and Ethereum Classic in 2016. Planned network upgrades on Ethereum, such as Dencun and Pectra, are coordinated hard forks that all clients adopt together.
18
A developer accidentally pushed a private key to a public GitHub repo. What do you do?
Treat the key as compromised immediately, because bots scan GitHub within seconds. Move all funds and tokens to a new secure wallet, revoke token approvals, and if the key owns contracts, transfer ownership or roles to a new multisig. Removing the commit is not enough since history and forks keep it. Then rotate any related API keys, add secret scanning and pre-commit hooks, and load keys from environment variables or a secrets manager.
19
What is the difference between CREATE and CREATE2?
CREATE computes a new contract's address from the deployer's address and nonce, so the address depends on deployment order. CREATE2 computes it from the deployer address, a chosen 32-byte salt and the hash of the init code, so the address is known before deployment and is the same wherever those inputs match. CREATE2 enables counterfactual wallets, deterministic factory deployments and same-address deployments across chains, but redeploying at the same address needs care.
20
A stablecoin used as collateral in your protocol loses its peg. How do you respond?
Activate the risk plan: pause new borrowing against that asset and freeze its use as new collateral through governance or the guardian. Switch its oracle to a market price rather than a hard-coded one dollar, so positions are valued honestly, which may trigger liquidations. Reduce its loan-to-value and supply caps. Communicate clearly with users. Longer term, cap exposure per stablecoin, diversify collateral and model depeg scenarios in risk dashboards.
21
Why should you not use tx.origin for authorisation?
tx.origin is the EOA that started the transaction, while msg.sender is the immediate caller. If a contract checks require(tx.origin == owner), a phishing contract can trick the owner into calling it, and that contract then calls the victim; tx.origin is still the owner, so the check passes and funds can be stolen. Always use msg.sender for access control. tx.origin also breaks with smart contract wallets and account abstraction.
22
What does a block contain and what is inside a block header?
A block has a header and a body. The body holds the list of transactions. The header holds metadata: the previous block hash, a timestamp, the Merkle root (or state and transaction roots in Ethereum) summarising the transactions, and consensus fields such as the difficulty target and nonce in Bitcoin. Because the header commits to all transactions through the root hash, nodes can verify a block's integrity by hashing just the header.
23
How do you build a tokenised vault using ERC-4626?
ERC-4626 standardises yield vaults: users deposit an asset and receive shares, and share price rises as the vault earns yield.
import {ERC4626} from '@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol';
import {ERC20} from '@openzeppelin/contracts/token/ERC20/ERC20.sol';
import {IERC20} from '@openzeppelin/contracts/token/ERC20/IERC20.sol';
contract YieldVault is ERC4626 {
constructor(IERC20 asset_) ERC20('Vault Share', 'vSHR') ERC4626(asset_) {}
function totalAssets() public view override returns (uint256) {
return IERC20(asset()).balanceOf(address(this)); // plus deployed funds
}
}
OpenZeppelin uses virtual shares to defend against the first-depositor inflation attack.
Type 0 is the legacy transaction with a single gasPrice. Type 1, from EIP-2930, adds an access list. Type 2, from EIP-1559, uses maxFeePerGas and maxPriorityFeePerGas and is the default in wallets. Type 3, from EIP-4844, carries blobs for rollup data. Type 4, from EIP-7702 in the Pectra upgrade of May 2025, lets an EOA set code delegation through a signed authorisation list, enabling batching and sponsored gas for normal wallets.
25
Tell me about working with product, legal or compliance teams on a blockchain feature.
Situation: we planned a token reward feature for Indian users, and legal raised VDA tax and securities concerns. Task: as tech lead I had to find a compliant design. Action: I ran workshops to understand their constraints, proposed non-transferable points that convert to vouchers, and documented the data flow for compliance. Result: we launched a month later than planned but with sign-off from all teams, and avoided a costly redesign after launch.
26
Tell me about yourself for a blockchain developer role.
Keep it to about a minute: present, past, future. For example: I am a computer science graduate who has spent the last year building on Ethereum. I have built three projects, including an NFT certificate system and a staking contract tested with Foundry fuzz tests, and deployed them on Sepolia with React front-ends. I practise security through Ethernaut challenges. I am looking for a role where I can write secure contracts and learn from experienced auditors.
27
What is storage packing, and what are other key gas optimisations?
The EVM stores data in 32-byte slots, so consecutive small variables like uint128, uint64, address and bool can share a slot if declared next to each other, saving expensive SSTOREs. Other optimisations: use calldata for external arrays, cache storage reads in local variables, use immutable and constant, prefer custom errors over strings, avoid unbounded loops, use events instead of storing history, and use unchecked for counters that cannot overflow. Always measure with forge snapshot.
A Merkle tree hashes data items in pairs, level by level, until one root hash remains. The root summarises all items: changing any item changes the root. A Merkle proof is the list of sibling hashes on the path from one item to the root. With it, a light client can prove that a transaction is in a block using about log2(n) hashes instead of downloading all transactions. Airdrop allowlists use the same trick on-chain.
29
How do you get current fee data and send an EIP-1559 transaction with ethers.js?
Fee-on-transfer tokens deduct a percentage on every transfer, so when your contract calls transferFrom for 100 tokens it may receive only 98. If the code assumes 100 arrived, balances and reserves drift and can be exploited. Fix it by measuring the actual amount received: read the contract's balance before and after the transfer and use the difference. Also decide whether to support such tokens at all and document unsupported token behaviours like rebasing.
Tips to crack the PwC Blockchain interview
Learn about the PwC Professional framework, which covers whole leadership, business acumen, technical capabilities and relationships.
Practise case questions and guesstimates with a clear structure, especially for consulting and advisory roles.
Revise Excel, SQL and a BI tool, and be ready to describe how analysis helped a decision.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; PwC interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the PwC Blockchain interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Group discussion or case round; Technical interview; Partner or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the PwC Blockchain interview?
This practice set leans on DeFi, Tokens and NFTs (7), Solidity Programming (5), Smart Contract Security (4), Ethereum and the EVM (4). Revise those first, then practise explaining one or two of your own projects end to end, because most PwC interviewers ask you to walk through real work.
Are these the exact questions asked at PwC?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like PwC's. They are not a leaked or verified list of past questions.
Where does PwC hire Blockchain professionals in India?
PwC has large teams in Kolkata, Bengaluru, Mumbai, Hyderabad, Gurugram. Openings and locations change often, so check the PwC careers page and filter by city and experience.