Standard Chartered Blockchain Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Standard Chartered hiring for Blockchain roles
Standard Chartered is a British international bank with most of its business in Asia, Africa and the Middle East. Its India global business services centres in Chennai and Bengaluru support technology, operations, analytics and risk. It hires for software engineers, testers, data analysts, data engineers and financial crime analysts.
For Blockchain roles, this Standard Chartered practice set focuses most on DeFi, Tokens and NFTs (6), dApp Development (5), Smart Contract Security (5), Consensus and Scaling (4). It has 3 easy, 20 medium, 7 hard questions, so you can start easy and work up to the harder ones.
Company type
Banking & finance
Headquarters
London, United Kingdom
Main India offices
Chennai, Bengaluru, Mumbai
Standard Chartered Blockchain interview process
Online assessment (aptitude + technical)
Technical round
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for Standard CharteredStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Slashing is a penalty that burns part of a validator's stake and forcibly exits it when it provably breaks protocol rules. On Ethereum the slashable offences are proposing two different blocks in the same slot and making conflicting or surrounding attestations. The penalty grows if many validators are slashed around the same time, which punishes coordinated attacks. Simply being offline is not slashing; it only causes small inactivity penalties. Running the same key on two machines is the most common cause.
02
Design a blockchain solution for farm-to-store supply chain traceability. What goes on-chain?
I would use a permissioned or low-cost chain where farmers, transporters, warehouses and retailers are known members. On-chain I would record batch IDs, ownership handovers, timestamps, signer identity and hashes of certificates or sensor data. Large documents, images and IoT streams stay off-chain in object storage or IPFS, referenced by hash. QR codes on packs link consumers to the trail. The main risk is bad input data, so I would add signed device readings and audits.
03
Write a Foundry unit test and a fuzz test for a contract.
Foundry tests are Solidity contracts; functions starting with test run as tests, and parameters make them fuzz tests.
import {Test} from 'forge-std/Test.sol';
import {Vault} from '../src/Vault.sol';
contract VaultTest is Test {
Vault v;
function setUp() public { v = new Vault(); }
function testDeposit() public {
v.deposit{value: 1 ether}();
assertEq(v.balanceOf(address(this)), 1 ether);
}
function testFuzzDeposit(uint96 amt) public {
vm.assume(amt > 0);
vm.deal(address(this), amt);
v.deposit{value: amt}();
assertEq(address(v).balance, amt);
}
}
Run with forge test -vvv.
Validators deposit 32 ETH (after the Pectra upgrade a validator can hold up to 2048 ETH) to join. Time is divided into 12-second slots and 32-slot epochs. In each slot a randomly chosen validator proposes a block and committees attest to it. The fork-choice rule LMD-GHOST picks the head, and Casper FFG finalises checkpoints when two-thirds of stake agrees. Honest validators earn rewards; offline ones lose small amounts, and provably malicious ones are slashed.
Events are declared in Solidity and emitted with emit; the EVM writes them as logs in the transaction receipt. Each log has the contract address, up to three indexed topics plus the event signature hash, and non-indexed data. Logs are much cheaper than storage but contracts cannot read them. Front-ends and indexers subscribe to events to update the UI, track token transfers and build history, so emitting clear events for every state change is good practice.
06
After a transaction is confirmed, your front-end still shows old data. How do you fix it?
The UI is probably reading cached results or a lagging RPC node. After tx.wait() resolves, explicitly refetch or invalidate the relevant queries, for example with wagmi or TanStack Query invalidation. Show optimistic updates while pending. If you use an indexer, it may lag by a few blocks, so poll until it reaches the receipt's block number. Use the same RPC endpoint for writes and immediate reads, and avoid long caching for balances.
07
A lending protocol reads collateral prices from one DEX pool's current reserves. What is the risk and fix?
Spot prices from a single pool can be moved within one transaction by a flash-loaned swap, letting an attacker inflate collateral value and borrow far more than it is worth, or trigger unfair liquidations. Replace it with a robust oracle such as Chainlink price feeds, or a long-window TWAP from deep pools, check staleness and deviation between sources, cap borrow amounts per block, and add circuit breakers for extreme price moves.
08
Write the core reward-per-token logic for a staking rewards contract.
I would compare candidate rollups on security (proof system live, stage of decentralisation, upgrade keys), EVM compatibility so our Solidity code deploys unchanged, ecosystem fit (wallets, oracles, liquidity, bridges our users already use), fees and throughput, and withdrawal experience. I would deploy to testnets first, measure real costs and latency, and check that our dependencies such as Chainlink feeds exist there. Then migrate gradually, keeping L1 contracts for high-value settlement if needed.
DeFi, decentralised finance, means financial services such as trading, lending, borrowing, stablecoins and derivatives built as smart contracts on public blockchains. Anyone with a wallet can use them without a bank account or approval, contracts are transparent, and protocols can be combined like building blocks. Examples are automated market maker exchanges, overcollateralised lending markets and liquid staking. The risks are smart contract bugs, oracle failures, volatile collateral and unclear regulation.
11
Write a Foundry invariant test for a token's total supply.
Invariant tests call random functions on target contracts and check a property after every call.
import {Test} from 'forge-std/Test.sol';
import {MyToken} from '../src/MyToken.sol';
import {Handler} from './Handler.sol';
contract SupplyInvariant is Test {
MyToken token;
Handler handler;
function setUp() public {
token = new MyToken();
handler = new Handler(token);
targetContract(address(handler));
}
function invariant_supplyMatchesBalances() public view {
assertEq(token.totalSupply(), handler.sumOfBalances());
}
}
The handler bounds inputs and tracks actors so calls stay realistic.
12
You are launching a 10,000-piece NFT collection and fear gas wars and bots. How do you design the mint?
Avoid a first-come public rush. Use an allowlist phase with Merkle proofs or signatures, per-wallet limits, and staggered time slots. Consider a Dutch auction or raffle so price, not gas, decides allocation. Use ERC-721A or efficient batch minting to cut gas. Reveal traits later with Chainlink VRF so bots cannot snipe rare items. Load-test the front-end and RPC, and keep pause functions ready in case something goes wrong.
13
How do you listen to contract events and query past events with ethers?
Use contract.on for live events and queryFilter for history.
const abi = ['event Transfer(address indexed from, address indexed to, uint256 value)'];
const token = new Contract(TOKEN, abi, provider);
token.on('Transfer', (from, to, value, event) => {
console.log(from, to, value.toString(), event.log.blockNumber);
});
const filter = token.filters.Transfer(null, MY_ADDRESS);
const past = await token.queryFilter(filter, -5000); // last 5000 blocks
console.log(past.length);
Use a WebSocket provider for live events, and page large ranges because providers limit block spans.
14
How do you store an NFT image on IPFS and use it in your contract?
Upload the image to IPFS using a node or a pinning service, which returns a CID. Create a metadata JSON file whose image field is ipfs://<imageCID>, then upload the metadata folder to get a folder CID. Set the contract's base URI to ipfs://<folderCID>/ so tokenURI(5) resolves to the file for token 5. Pin the content with more than one provider, and use a gateway URL only for display in the front-end.
15
What does a smart contract audit process look like?
It starts with scoping: fixed commit, documentation, threat model and test coverage. Auditors run automated tools like Slither and fuzzers, then do manual line-by-line review, checking business logic, access control, economic attacks and integrations. They write findings rated critical, high, medium, low and informational with fixes. The team fixes issues, auditors review the fixes, and a final report is published. Audits reduce risk but do not guarantee safety, so add bug bounties and monitoring.
16
How do you build a tokenised vault using ERC-4626?
ERC-4626 standardises yield vaults: users deposit an asset and receive shares, and share price rises as the vault earns yield.
import {ERC4626} from '@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol';
import {ERC20} from '@openzeppelin/contracts/token/ERC20/ERC20.sol';
import {IERC20} from '@openzeppelin/contracts/token/ERC20/IERC20.sol';
contract YieldVault is ERC4626 {
constructor(IERC20 asset_) ERC20('Vault Share', 'vSHR') ERC4626(asset_) {}
function totalAssets() public view override returns (uint256) {
return IERC20(asset()).balanceOf(address(this)); // plus deployed funds
}
}
OpenZeppelin uses virtual shares to defend against the first-depositor inflation attack.
17
How would you set up a local blockchain for development and testing?
For EVM work, run a local node with Anvil from Foundry or the Hardhat network. Each gives about ten pre-funded test accounts, instant mining and console logging. You can fork mainnet at a given block to test against real contracts and balances without spending money. For integration tests, deploy to a public testnet such as Sepolia, using faucet ETH. Keep deploy scripts and RPC URLs in config so the same code targets local, testnet and mainnet.
18
How would you check on-chain whether a user is in a 10,000-address allowlist without storing all addresses?
Build a Merkle tree off-chain from the allowlisted addresses (hashing each leaf, ideally double-hashed with amounts if needed) and store only the 32-byte root in the contract. Each user submits a proof of about 14 hashes for 10,000 leaves. The contract recomputes the root with OpenZeppelin MerkleProof.verify and compares it. This costs one storage slot instead of 10,000, and you can update the list by changing the root.
EIP-4844, shipped in the Dencun upgrade in March 2024, added blob-carrying transactions. Blobs are large data chunks of about 128 KB that rollups use to post batch data, priced in a separate fee market and pruned by nodes after roughly 18 days. Contracts cannot read blob contents, only their KZG commitments. This cut L2 data costs dramatically. Later upgrades raised blob capacity, and PeerDAS in the Fusaka upgrade lets nodes sample data instead of downloading every blob.
In the UTXO model used by Bitcoin, coins exist as unspent transaction outputs; a transaction consumes some outputs and creates new ones, which makes parallel validation and privacy easier. In the account model used by Ethereum, the state stores a balance and nonce per account, which is simpler for smart contracts and wallets. The trade-off: UTXO avoids replay issues and scales verification well, while accounts make complex stateful logic far easier to write.
21
Your target users in India have never used crypto wallets. How do you design onboarding?
Hide crypto complexity. Offer login with phone or email using embedded or smart contract wallets, so no seed phrase is needed at first. Sponsor gas with a paymaster so users need no tokens. Show amounts in rupees and plain language, support regional languages, and explain actions in simple terms. Provide account recovery via passkeys or guardians, and let advanced users export to self-custody later. Ensure KYC and tax requirements are clear where money is involved.
22
A function that distributes rewards loops over all users and is getting too expensive. How do you fix it?
Unbounded loops eventually exceed the block gas limit. Switch to a pull-based accounting model: maintain a global reward-per-token accumulator that grows when rewards are added, and store each user's last checkpoint. Users claim with reward equals balance times (current accumulator minus their checkpoint). This makes distribution O(1) for any number of users. Alternatively, use a Merkle distributor where rewards are computed off-chain and users claim with proofs.
23
Show a contract vulnerable to reentrancy and a fixed version.
Do not put personal data on a public chain. Data there is permanent, public and replicated globally, which conflicts with the right to erasure under India's DPDP Act and GDPR, and storage is extremely expensive. Store documents encrypted in off-chain storage, keep only a salted hash or commitment on-chain for integrity, and control access through the application. If the data must be deleted, delete the off-chain copy and the encryption key; the hash alone reveals nothing.
25
Design token vesting for team members and early investors.
Use a vesting contract that holds allocated tokens and releases them on a schedule, typically a one-year cliff followed by monthly or linear vesting over two to four years. OpenZeppelin VestingWallet gives linear vesting per beneficiary; add a cliff and an owner-controlled revoke for employees who leave, returning unvested tokens. Make schedules public on-chain for transparency, and avoid admin functions that could release tokens early, as that erodes investor trust.
26
What is the difference between CREATE and CREATE2?
CREATE computes a new contract's address from the deployer's address and nonce, so the address depends on deployment order. CREATE2 computes it from the deployer address, a chosen 32-byte salt and the hash of the init code, so the address is known before deployment and is the same wherever those inputs match. CREATE2 enables counterfactual wallets, deterministic factory deployments and same-address deployments across chains, but redeploying at the same address needs care.
27
How do you compute a keccak256 hash in Solidity and in ethers.js?
Solidity:
bytes32 h1 = keccak256(abi.encodePacked('hello'));
bytes32 h2 = keccak256(abi.encode(addr, amount));
ethers v6:
import { keccak256, toUtf8Bytes, solidityPackedKeccak256 } from 'ethers';
const h = keccak256(toUtf8Bytes('hello'));
const p = solidityPackedKeccak256(['address','uint256'], [addr, amount]);
Prefer abi.encode over abi.encodePacked when hashing several dynamic values, because packed encoding can cause collisions.
28
What is a signature replay attack and how do you prevent it?
If a contract accepts a signed message to perform an action, an attacker can resubmit the same signature to repeat it, or replay it on another chain or another contract using the same code. Prevent it by including a per-user nonce that increments on use, a deadline, the chain ID and the verifying contract address in the signed data. EIP-712 typed data with a domain separator gives a standard way to include these fields.
29
How do you handle unclear or changing requirements from a client?
Situation: a client asked for a marketplace dApp but kept changing royalty and fee rules. Task: deliver without endless rework. Action: I wrote a short spec with examples and edge cases, got sign-off, and made fees configurable parameters with limits instead of hard-coded logic. Changes went through a simple change log with impact estimates. Result: we delivered in eight weeks, and later fee changes needed only a governance transaction, not a redeployment.
30
A fee-on-transfer token breaks your DEX's accounting. What happened and how do you fix it?
Fee-on-transfer tokens deduct a percentage on every transfer, so when your contract calls transferFrom for 100 tokens it may receive only 98. If the code assumes 100 arrived, balances and reserves drift and can be exploited. Fix it by measuring the actual amount received: read the contract's balance before and after the transfer and use the difference. Also decide whether to support such tokens at all and document unsupported token behaviours like rebasing.
Tips to crack the Standard Chartered Blockchain interview
Learn trade finance, cash management and financial crime compliance basics, which are strong areas for the bank.
Revise SQL, Python and testing concepts for technology and analytics roles, using banking transaction examples where possible.
Read about Standard Chartered's valued behaviours, such as Do the right thing and Never settle.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Standard Chartered interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Standard Chartered Blockchain interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical round; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Standard Chartered Blockchain interview?
This practice set leans on DeFi, Tokens and NFTs (6), dApp Development (5), Smart Contract Security (5), Consensus and Scaling (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Standard Chartered interviewers ask you to walk through real work.
Are these the exact questions asked at Standard Chartered?
No. These are curated practice questions that match the skills and difficulty usually tested in banking & finance interviews like Standard Chartered's. They are not a leaked or verified list of past questions.
Where does Standard Chartered hire Blockchain professionals in India?
Standard Chartered has large teams in Chennai, Bengaluru, Mumbai. Openings and locations change often, so check the Standard Chartered careers page and filter by city and experience.