Cryptography for Blockchain Interview Questions for Blockchain

Show answer

A hash function maps any input to a fixed-size output, such as 256 bits. For blockchain it must be deterministic, fast to compute, pre-image resistant (you cannot find the input from the hash), second pre-image resistant, and collision resistant (finding two inputs with the same hash is infeasible). It should also show the avalanche effect, where a one-bit change gives a completely different hash. Blocks, addresses, Merkle trees and proof of work all depend on these properties.

How is public-key cryptography used in blockchain?

Show answer

Each user has a private key, kept secret, and a public key derived from it. The private key signs transactions, and anyone can verify the signature with the public key, proving the owner authorised the transfer without revealing the private key. Addresses are derived from public keys. Because control of funds equals control of the private key, losing it means losing access, and leaking it means anyone can spend the funds.

What is a digital signature and what does it guarantee?

Show answer

A digital signature is a value produced by signing a message hash with a private key. Anyone with the public key can verify it. It guarantees authentication (the holder of the key signed it), integrity (the message was not changed, since any change breaks verification) and non-repudiation (the signer cannot later deny it). In blockchain, every transaction is signed, so nodes accept a transfer only if the signature matches the sending account.

What is a nonce in blockchain? Explain both common meanings.

Show answer

In proof of work, the nonce is a number miners change repeatedly in the block header until the header hash falls below the difficulty target. In Ethereum's account model, the account nonce is a counter of transactions sent from an address; each transaction must use the next nonce, which orders transactions and prevents replay. A stuck transaction with a low nonce blocks all later ones from that account until it is mined or replaced.

What is a hash collision and why does it matter for blockchains?

Show answer

A collision is when two different inputs produce the same hash. If attackers could find collisions, they could swap one transaction or block for another with the same hash and break integrity, Merkle proofs and address uniqueness. For SHA-256 and Keccak-256, finding a collision needs about 2^128 work, which is infeasible. This is why older broken hashes such as MD5 and SHA-1 must never be used in blockchain systems.

A user lost their private key and seed phrase. Can you recover their funds?

Show answer

No. In a self-custody wallet, nobody, including the developer, can recover a lost private key; deriving it from the address is computationally impossible. If they still have the seed phrase, the wallet can be restored on any compatible app. To reduce future risk, suggest a hardware wallet, a written seed phrase stored in two safe locations, or a smart contract wallet with social recovery or passkeys, where trusted guardians can rotate the signing key.

How do you compute a keccak256 hash in Solidity and in ethers.js?

Show answer

Solidity: bytes32 h1 = keccak256(abi.encodePacked('hello')); bytes32 h2 = keccak256(abi.encode(addr, amount)); ethers v6: import { keccak256, toUtf8Bytes, solidityPackedKeccak256 } from 'ethers'; const h = keccak256(toUtf8Bytes('hello')); const p = solidityPackedKeccak256(['address','uint256'], [addr, amount]); Prefer abi.encode over abi.encodePacked when hashing several dynamic values, because packed encoding can cause collisions.

How do you keep up with security and cryptography developments in Web3?

Show answer

I follow a routine. Weekly I read new audit reports and post-mortems of exploits, and I try to reproduce one in Foundry. I track Ethereum Improvement Proposals and upgrade notes, read Solidity release notes, and practise on capture-the-flag platforms such as Ethernaut and Damn Vulnerable DeFi. I also keep a personal notes file of attack patterns. This keeps my knowledge practical rather than just theoretical, and I share summaries with my team.

What is the difference between SHA-256 and Keccak-256?

Show answer

SHA-256 is from the SHA-2 family and uses a Merkle-Damgard construction; Bitcoin uses double SHA-256 for block hashes and transaction IDs. Keccak-256 is based on the sponge construction and is what Ethereum uses for addresses, function selectors, event topics and storage slots. Ethereum's Keccak-256 is the original Keccak submission and differs from the final NIST SHA3-256 in padding, so the two give different outputs for the same input.

What is ECDSA and why does Ethereum use the secp256k1 curve?

Show answer

ECDSA is the Elliptic Curve Digital Signature Algorithm. It gives strong security with short keys: a 256-bit key is roughly as strong as a 3072-bit RSA key, which keeps transactions small. Bitcoin and Ethereum use the secp256k1 curve, whose simple structure allows efficient computation. A signature has values r and s plus a recovery id v, which lets nodes recover the signer's public key from the signature, so the sender address need not be included separately.

How is an Ethereum address derived from a private key?

Show answer

Start with a random 256-bit private key. Multiply it by the secp256k1 generator point to get a 64-byte uncompressed public key. Take the Keccak-256 hash of that public key and keep the last 20 bytes; that is the address, shown as 0x plus 40 hex characters. EIP-55 adds a mixed-case checksum so typos can be detected. The process is one-way: you cannot get the private key back from the address or public key.

What is a Merkle tree and what is a Merkle proof?

Show answer

A Merkle tree hashes data items in pairs, level by level, until one root hash remains. The root summarises all items: changing any item changes the root. A Merkle proof is the list of sibling hashes on the path from one item to the root. With it, a light client can prove that a transaction is in a block using about log2(n) hashes instead of downloading all transactions. Airdrop allowlists use the same trick on-chain.

What are seed phrases and HD wallets (BIP-39, BIP-32, BIP-44)?

Show answer

BIP-39 encodes random entropy as a 12 or 24 word mnemonic, which is turned into a binary seed. BIP-32 defines hierarchical deterministic wallets that derive a tree of key pairs from that seed. BIP-44 standardises the derivation path, for example m/44'/60'/0'/0/0 for the first Ethereum account. So one backed-up seed phrase can restore unlimited addresses across chains. Whoever knows the phrase controls every derived account, so it must never be stored online.

Compare multisig wallets and MPC wallets.

Show answer

A multisig wallet is a smart contract, such as a Safe, that needs M of N owner signatures to execute a transaction; rules are visible on-chain and easy to audit, but every action costs extra gas and works per chain. An MPC wallet splits one private key into shares held by different parties who jointly produce a normal signature; it looks like a regular address, works on any chain and allows key rotation, but the security depends on the off-chain implementation.

Users complain they must pay gas to approve tokens before every trade. How can signatures help?

Show answer

Use off-chain signed approvals. With EIP-2612 permit, the user signs a typed EIP-712 message granting an allowance, and the dApp submits it with the trade in one transaction, so no separate approve call is needed. For tokens without permit, Permit2-style contracts give the same experience after one approval. EIP-712 shows readable fields in the wallet, reducing phishing risk. Always include a nonce, deadline, chain ID and verifying contract to prevent replays.

How would you check on-chain whether a user is in a 10,000-address allowlist without storing all addresses?

Show answer

Build a Merkle tree off-chain from the allowlisted addresses (hashing each leaf, ideally double-hashed with amounts if needed) and store only the 32-byte root in the contract. Each user submits a proof of about 14 hashes for 10,000 leaves. The contract recomputes the root with OpenZeppelin MerkleProof.verify and compares it. This costs one storage slot instead of 10,000, and you can update the list by changing the root.

A developer accidentally pushed a private key to a public GitHub repo. What do you do?

Show answer

Treat the key as compromised immediately, because bots scan GitHub within seconds. Move all funds and tokens to a new secure wallet, revoke token approvals, and if the key owns contracts, transfer ownership or roles to a new multisig. Removing the commit is not enough since history and forks keep it. Then rotate any related API keys, add secret scanning and pre-commit hooks, and load keys from environment variables or a secrets manager.

Show how to sign and verify a message with ethers.js.

Show answer

With ethers v6, a wallet signs using EIP-191 personal sign, and verifyMessage recovers the address. import { Wallet, verifyMessage } from 'ethers'; const wallet = Wallet.createRandom(); const message = 'Login nonce: 48213'; const signature = await wallet.signMessage(message); const recovered = verifyMessage(message, signature); console.log(recovered === wallet.address); // true This pattern powers Sign-In with Ethereum; the server issues a fresh nonce each time to stop replay.

Write a Python function that computes a Merkle root from a list of transactions.

Show answer

Hash leaves, then hash pairs until one remains, duplicating the last hash when a level is odd (Bitcoin style). import hashlib def h(b): return hashlib.sha256(b).digest() def merkle_root(txs): level = [h(t.encode()) for t in txs] while len(level) > 1: if len(level) % 2: level.append(level[-1]) level = [h(level[i] + level[i+1]) for i in range(0, len(level), 2)] return level[0].hex() print(merkle_root(['tx1', 'tx2', 'tx3']))

Describe a time you found a security problem in code and how you handled it.

Show answer

Situation: while reviewing a teammate's staking contract, I saw it sent tokens before updating the user's balance. Task: confirm the risk without blaming anyone. Action: I wrote a Foundry test with a malicious receiver that re-entered withdraw and drained extra funds, then shared it privately with a suggested fix using checks-effects-interactions and a reentrancy guard. Result: the fix merged before the audit, and we added reentrancy tests to our standard checklist.

What is a Merkle Patricia Trie and why does Ethereum use it?

Show answer

A Merkle Patricia Trie combines a Patricia (compressed prefix) trie with Merkle hashing. Ethereum uses it to store world state, account storage, transactions and receipts, with each root stored in the block header. It allows efficient insert, update and lookup by key, and any value can be proven against the root with a proof. Its weakness is large proof size, which is why Ethereum researchers plan to move to Verkle or binary hash trees for stateless clients.

What are zero-knowledge proofs, and how do zk-SNARKs and zk-STARKs differ?

Show answer

A zero-knowledge proof lets a prover convince a verifier that a statement is true without revealing why, for example proving a transaction is valid without exposing the details. zk-SNARKs have very small proofs and cheap verification, but many schemes need a trusted setup and rely on elliptic curves. zk-STARKs need no trusted setup, use hash-based cryptography considered post-quantum safe, but produce larger proofs. zk-rollups use them to prove batches of transactions to Ethereum.

What is signature malleability and how is it prevented?

Show answer

For any valid ECDSA signature (r, s), the value (r, n - s) is also valid for the same message. If code uses a signature as a unique ID, for example to mark it as used, an attacker can submit the flipped version and replay it. Ethereum's EIP-2 requires s to be in the lower half of the curve order for transactions. In contracts, use a library like OpenZeppelin ECDSA that enforces low s, and track nonces instead of signatures.

Design the custody setup for an exchange's hot and cold wallets.

Show answer

Keep a small float, around a few percent of assets, in hot wallets for withdrawals, secured by HSMs or MPC with rate limits, address allowlists and automated monitoring. Keep the rest in cold storage: air-gapped or multisig/MPC with keys held by different officers in different locations, plus time delays. Refill hot wallets through a manual, multi-approver process. Add proof of reserves, regular key ceremonies, insurance, and incident runbooks for freezing withdrawals if anomalies appear.

How do you verify a signed message inside a Solidity contract?