Blockchain Online Assessment Questions &amp; Answers

Show answer

A full node downloads and validates every block and keeps the current state, so it can verify everything independently. A light node stores only block headers and asks full nodes for Merkle proofs of the data it needs, which suits mobile wallets. An archive node keeps all historical states, so you can query a balance at any past block; indexers and block explorers need it, but it requires many terabytes of storage.

A developer accidentally pushed a private key to a public GitHub repo. What do you do?

Show answer

Treat the key as compromised immediately, because bots scan GitHub within seconds. Move all funds and tokens to a new secure wallet, revoke token approvals, and if the key owns contracts, transfer ownership or roles to a new multisig. Removing the commit is not enough since history and forks keep it. Then rotate any related API keys, add secret scanning and pre-commit hooks, and load keys from environment variables or a secrets manager.

Why is on-chain randomness insecure, and what should you use instead?

Show answer

Values like block.timestamp, blockhash or block.prevrandao are visible to or partly controlled by block producers, and any contract can read them in the same transaction and only proceed when the outcome is favourable. So lotteries and NFT trait reveals based on them can be gamed. Use a verifiable random function such as Chainlink VRF, which delivers randomness with a cryptographic proof in a later transaction, or a commit-reveal scheme for simpler cases.

How do you run Slither on a Foundry project and focus on important findings?

Smart Contract SecurityEasy

Show answer

Install it with pip and run it from the project root; it detects Foundry automatically. pip install slither-analyzer slither . # Only medium and high impact issues slither . --exclude-low --exclude-informational # Exclude dependencies slither . --filter-paths 'lib|test' # Print a summary of contracts and functions slither . --print human-summary Triage each finding: fix real bugs and record why false positives are safe.

What are testnets and how do you get test ETH?

Ethereum and the EVMEasy

Show answer

Testnets are public networks that run the same software as mainnet but with valueless ETH, so developers can test deployments and dApps safely. Sepolia is the main testnet for application developers, and Hoodi replaced Holesky for validator and staking testing in 2025. Test ETH comes from faucets, which often require a small mainnet balance or a login to stop abuse. Many Layer 2s run their own Sepolia-based testnets bridged from Ethereum Sepolia.

What is a reentrancy attack?

Show answer

Reentrancy happens when a contract makes an external call, such as sending ETH, before updating its own state, and the receiver calls back into the contract to repeat the action. For example, a withdraw that sends funds and then sets the balance to zero can be re-entered to withdraw many times. The 2016 DAO hack drained millions this way. Prevent it with checks-effects-interactions, reentrancy guards, and pull payments.

Your dApp needs a full history of user transactions and fast queries. Reading events from the node is too slow. What do you do?

Ethereum and the EVMMedium

Show answer

Build or use an indexer. An indexer listens to contract events from a start block, transforms them and stores them in a database like PostgreSQL, so the front-end runs normal fast queries. Options are a subgraph on The Graph, hosted indexing services, or a custom service with ethers and a queue. It must handle reorgs by tracking block hashes, support backfilling, and expose an API. Design events up front with indexed fields that queries need.

How is an Ethereum address derived from a private key?

Show answer

Start with a random 256-bit private key. Multiply it by the secp256k1 generator point to get a 64-byte uncompressed public key. Take the Keccak-256 hash of that public key and keep the last 20 bytes; that is the address, shown as 0x plus 40 hex characters. EIP-55 adds a mixed-case checksum so typos can be detected. The process is one-way: you cannot get the private key back from the address or public key.

How do you connect a browser wallet to a dApp using ethers.js?

dApp DevelopmentEasy

Show answer

Browser wallets inject an EIP-1193 provider at window.ethereum. Wrap it with BrowserProvider and request accounts. import { BrowserProvider } from 'ethers'; async function connect() { if (!window.ethereum) throw new Error('Install a wallet'); const provider = new BrowserProvider(window.ethereum); const signer = await provider.getSigner(); // prompts the user const address = await signer.getAddress(); const { chainId } = await provider.getNetwork(); return { signer, address, chainId }; } In production, use EIP-6963 discovery or a connector library so users with several wallets can choose.

A function that distributes rewards loops over all users and is getting too expensive. How do you fix it?

Solidity ProgrammingMedium

Show answer

Unbounded loops eventually exceed the block gas limit. Switch to a pull-based accounting model: maintain a global reward-per-token accumulator that grows when rewards are added, and store each user's last checkpoint. Users claim with reward equals balance times (current accumulator minus their checkpoint). This makes distribution O(1) for any number of users. Alternatively, use a Merkle distributor where rewards are computed off-chain and users claim with proofs.

You are launching a 10,000-piece NFT collection and fear gas wars and bots. How do you design the mint?

DeFi, Tokens and NFTsMedium

Show answer

Avoid a first-come public rush. Use an allowlist phase with Merkle proofs or signatures, per-wallet limits, and staggered time slots. Consider a Dutch auction or raffle so price, not gas, decides allocation. Use ERC-721A or efficient batch minting to cut gas. Reveal traits later with Chainlink VRF so bots cannot snipe rare items. Load-test the front-end and RPC, and keep pause functions ready in case something goes wrong.

A transaction keeps failing with an out of gas error. How do you fix it?

Ethereum and the EVMMedium

Show answer

First see whether the gas limit was too low or the function is genuinely unbounded. Run eth_estimateGas or simulate with cast run or Tenderly to see actual gas used and where it fails. If estimation is fine, raise the limit with a buffer of 10 to 20 percent. If the function loops over a growing array, redesign it with pagination or pull-based patterns, because the block gas limit will eventually make it impossible to call.

Write a simple ERC-20 token using OpenZeppelin.

Solidity ProgrammingEasy

Show answer

Inherit the audited ERC20 implementation and mint the initial supply in the constructor. // SPDX-License-Identifier: MIT pragma solidity ^0.8.24; import {ERC20} from '@openzeppelin/contracts/token/ERC20/ERC20.sol'; import {Ownable} from '@openzeppelin/contracts/access/Ownable.sol'; contract CampusToken is ERC20, Ownable { constructor() ERC20('Campus Token', 'CAMP') Ownable(msg.sender) { _mint(msg.sender, 1_000_000 * 10 ** decimals()); } function mint(address to, uint256 amount) external onlyOwner { _mint(to, amount); } }

You open a transaction on a block explorer. Which fields do you check and what do they mean?

Blockchain FundamentalsEasy

Show answer

Check the status (success or failed), the block number and confirmations, from and to addresses, and the value transferred. For contract calls, check the decoded input data and emitted event logs, which show token transfers. Check the gas limit, gas used and effective gas price, which together give the fee paid, plus the nonce. If the status failed, the revert reason tells you why, while fees are still charged for gas used.

How did integer overflow bugs happen before Solidity 0.8?

Smart Contract SecurityEasy

Show answer

Before 0.8, arithmetic wrapped silently: a uint8 at 255 plus 1 became 0, and 0 minus 1 became the maximum value. Attackers exploited this, for example by making a balance underflow to a huge number or an overflowed multiplication pass a check, as in the 2018 batchOverflow token bug. Developers used the SafeMath library to revert on overflow. Since 0.8 the compiler checks automatically, except inside unchecked blocks and in inline assembly.

Users complain they must pay gas to approve tokens before every trade. How can signatures help?

Show answer

Use off-chain signed approvals. With EIP-2612 permit, the user signs a typed EIP-712 message granting an allowance, and the dApp submits it with the trade in one transaction, so no separate approve call is needed. For tokens without permit, Permit2-style contracts give the same experience after one approval. EIP-712 shows readable fields in the wallet, reducing phishing risk. Always include a nonce, deadline, chain ID and verifying contract to prevent replays.

Show a contract vulnerable to reentrancy and a fixed version.

Show answer

Vulnerable: the balance is cleared after sending. function withdraw() external { uint256 bal = balances[msg.sender]; (bool ok, ) = msg.sender.call{value: bal}(''); require(ok); balances[msg.sender] = 0; } Fixed: update state first and add a guard. import {ReentrancyGuard} from '@openzeppelin/contracts/utils/ReentrancyGuard.sol'; function withdraw() external nonReentrant { uint256 bal = balances[msg.sender]; require(bal > 0, 'nothing'); balances[msg.sender] = 0; (bool ok, ) = msg.sender.call{value: bal}(''); require(ok, 'send failed'); }

How is a sidechain different from a rollup?

Consensus and ScalingMedium

Show answer

A sidechain is an independent blockchain with its own validators and consensus, connected to the main chain by a bridge. Its security depends on its own validator set, so if they collude, funds can be stolen. A rollup posts its transaction data and state roots to Ethereum and relies on fraud or validity proofs, so it inherits Layer 1 security for correctness. Sidechains are usually cheaper and more flexible, but rollups give stronger guarantees.

You need to send ETH to hundreds of winners. Should you push payments or let them pull?

Solidity ProgrammingMedium

Show answer

Prefer pull payments. If a contract pushes ETH in a loop, one recipient that reverts, perhaps a contract without receive, can block everyone, and the loop may exceed the gas limit. With pull payments, the contract records each winner's amount in a mapping and winners call withdraw, which zeroes their balance before sending. This isolates failures and limits reentrancy risk. Push only for small fixed lists using call with a checked result.

How does Ethereum's Proof of Stake work?

Consensus and ScalingMedium

Show answer

Validators deposit 32 ETH (after the Pectra upgrade a validator can hold up to 2048 ETH) to join. Time is divided into 12-second slots and 32-slot epochs. In each slot a randomly chosen validator proposes a block and committees attest to it. The fork-choice rule LMD-GHOST picks the head, and Casper FFG finalises checkpoints when two-thirds of stake agrees. Honest validators earn rewards; offline ones lose small amounts, and provably malicious ones are slashed.

Which tools do you use for static analysis and fuzzing of smart contracts?

Show answer

Slither performs static analysis and quickly flags reentrancy, unchecked calls, shadowing and more. Aderyn is another fast static analyser. Foundry provides fuzz and invariant testing, where random sequences of calls try to break properties you define. Echidna and Medusa are property-based fuzzers. Mythril and Halmos use symbolic execution, and Certora offers formal verification. Combining them with manual review and high test coverage catches far more than any single tool.

What are function modifiers in Solidity?

Solidity ProgrammingEasy

Show answer

Modifiers are reusable pieces of code that run before or after a function body, placed where the underscore symbol appears. They are mainly used for checks such as onlyOwner, whenNotPaused or nonReentrant. For example, modifier onlyOwner() { require(msg.sender == owner, 'not owner'); _; } blocks everyone except the owner. Keep modifiers short and check-only; complex logic inside modifiers hides behaviour and increases bytecode size because the code is inlined into every function that uses it.

What is a consensus mechanism and why does a blockchain need one?

Consensus and ScalingEasy

Show answer

A consensus mechanism is the set of rules that lets thousands of independent nodes agree on one order of transactions and one current state, even when some nodes are faulty or malicious. Without it, two nodes could accept conflicting transactions and double spending would be possible. Common mechanisms are Proof of Work, Proof of Stake, Proof of Authority and BFT protocols like PBFT, Tendermint and Raft, each trading off decentralisation, speed and fault tolerance.

How do you get the latest block number from an Ethereum node using JSON-RPC?

Show answer

Send a JSON-RPC POST request to the node or provider URL. The result is a hex string that you convert to decimal. curl -s -X POST https://rpc.example.org \ -H 'Content-Type: application/json' \ -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}' # Response: {"jsonrpc":"2.0","id":1,"result":"0x15d3a1c"} # In Python: int('0x15d3a1c', 16) Other common methods are eth_getBalance, eth_call and eth_getTransactionReceipt.

What is a Merkle tree and what is a Merkle proof?

Show answer

A Merkle tree hashes data items in pairs, level by level, until one root hash remains. The root summarises all items: changing any item changes the root. A Merkle proof is the list of sibling hashes on the path from one item to the root. With it, a light client can prove that a transaction is in a block using about log2(n) hashes instead of downloading all transactions. Airdrop allowlists use the same trick on-chain.

Write a basic ERC-721 NFT contract using OpenZeppelin.

DeFi, Tokens and NFTsEasy

Show answer

// SPDX-License-Identifier: MIT pragma solidity ^0.8.24; import {ERC721} from '@openzeppelin/contracts/token/ERC721/ERC721.sol'; import {Ownable} from '@openzeppelin/contracts/access/Ownable.sol'; contract CertificateNFT is ERC721, Ownable { uint256 public nextId; string private baseURI; constructor(string memory uri) ERC721('Course Cert', 'CERT') Ownable(msg.sender) { baseURI = uri; } function mint(address to) external onlyOwner { _safeMint(to, nextId++); } function _baseURI() internal view override returns (string memory) { return baseURI; } }

What is the difference between receive and fallback functions?

Solidity ProgrammingMedium

Show answer

receive() external payable runs when a contract receives plain ETH with empty calldata, for example a transfer from a wallet. fallback() runs when calldata matches no function, or when ETH arrives with data and no receive exists; it must be payable to accept ETH. Proxies use fallback to delegatecall all unknown calls to the implementation. Keep both simple, since a reverting or gas-heavy receive can break senders that use transfer with its 2300 gas stipend.

What are seed phrases and HD wallets (BIP-39, BIP-32, BIP-44)?

Show answer

BIP-39 encodes random entropy as a 12 or 24 word mnemonic, which is turned into a binary seed. BIP-32 defines hierarchical deterministic wallets that derive a tree of key pairs from that seed. BIP-44 standardises the derivation path, for example m/44'/60'/0'/0/0 for the first Ethereum account. So one backed-up seed phrase can restore unlimited addresses across chains. Whoever knows the phrase controls every derived account, so it must never be stored online.

How would you set up a local blockchain for development and testing?

Blockchain FundamentalsEasy

Show answer

For EVM work, run a local node with Anvil from Foundry or the Hardhat network. Each gives about ten pre-funded test accounts, instant mining and console logging. You can fork mainnet at a given block to test against real contracts and balances without spending money. For integration tests, deploy to a public testnet such as Sepolia, using faucet ETH. Keep deploy scripts and RPC URLs in config so the same code targets local, testnet and mainnet.

What is a mempool?

Show answer

The mempool is each node's waiting area for valid transactions that have been broadcast but not yet included in a block. Block producers usually pick transactions paying the highest fees or priority tips. Every node has its own mempool, so contents can differ slightly. Because pending transactions are public, bots can watch the mempool and front-run trades, which is why private transaction relays and order-flow auctions are used for sensitive transactions.

What is a digital signature and what does it guarantee?

Cryptography for BlockchainEasy

Show answer

A digital signature is a value produced by signing a message hash with a private key. Anyone with the public key can verify it. It guarantees authentication (the holder of the key signed it), integrity (the message was not changed, since any change breaks verification) and non-repudiation (the signer cannot later deny it). In blockchain, every transaction is signed, so nodes accept a transfer only if the signature matches the sending account.

How do you read a contract's storage slot directly with Foundry's cast?

Ethereum and the EVMMedium

Show answer

Use cast storage with the contract address and slot number. For mappings, compute the slot as keccak256(key . slot). # Read slot 0 (often the first state variable) cast storage 0xContractAddress 0 --rpc-url $RPC_URL # balanceOf mapping stored at slot 2, key = user address cast index address 0xUserAddress 2 cast storage 0xContractAddress <slot-from-above> --rpc-url $RPC_URL This shows that private variables are not secret: anyone can read storage.

What is a hash collision and why does it matter for blockchains?

Cryptography for BlockchainEasy

Show answer

A collision is when two different inputs produce the same hash. If attackers could find collisions, they could swap one transaction or block for another with the same hash and break integrity, Merkle proofs and address uniqueness. For SHA-256 and Keccak-256, finding a collision needs about 2^128 work, which is infeasible. This is why older broken hashes such as MD5 and SHA-1 must never be used in blockchain systems.

After a transaction is confirmed, your front-end still shows old data. How do you fix it?

dApp DevelopmentMedium

Show answer

The UI is probably reading cached results or a lagging RPC node. After tx.wait() resolves, explicitly refetch or invalidate the relevant queries, for example with wagmi or TanStack Query invalidation. Show optimistic updates while pending. If you use an indexer, it may lag by a few blocks, so poll until it reaches the receipt's block number. Use the same RPC endpoint for writes and immediate reads, and avoid long caching for balances.

What is double spending and how does a blockchain prevent it?