Blockchain Developer
Smart contract security questions
118 questions on Smart contract security for blockchain developers, easiest first.
Easy 31
- What msg.sender iseasy
- Private variables are public dataeasy
- Verifying a contract on Etherscaneasy
- Sharing a seed phraseeasy
- Why use OpenZeppelineasy
- The checks-effects-interactions ordereasy
- What nonReentrant doeseasy
- What front-running iseasy
- Anyone can minteasy
- Why old contracts used SafeMatheasy
- What an audit meanseasy
- Protecting the admin keyeasy
- Why add a timelockeasy
- An emergency stopeasy
- A suspicious NFT approvaleasy
- A key pushed to GitHubeasy
- Using a DEX price directlyeasy
- What a flash loan iseasy
- What a sandwich attack iseasy
- Calling renounceOwnership by mistakeeasy
- Setting the treasury to zeroeasy
- A key inside the web appeasy
- Signing a message you cannot readeasy
- Protecting a deployer keyeasy
- A sale that ends a second lateeasy
- Why run a bug bountyeasy
- 100% test coverageeasy
- Contracts are fine but users lost fundseasy
- Old unlimited approvalseasy
- Red flags in a new tokeneasy
- Admin changes with no traceeasy
Medium 45
- Spot the reentrancy bugmedium
- Using tx.origin for authmedium
- Refunding outbid biddersmedium
- Safer ownership transfermedium
- Fee-on-transfer token depositsmedium
- EIP-712 domain separatormedium
- Unchecked ecrecovermedium
- What Slither is good formedium
- Unlimited token approvalsmedium
- Random winners on chainmedium
- Roles instead of one ownermedium
- An implementation nobody initialisedmedium
- Reordering variables in an upgrademedium
- A signed voucher used twicemedium
- Lowering an allowance Bob can seemedium
- A swap with no minimum outputmedium
- A swap that executes much latermedium
- USDC payout loop revertsmedium
- Rebasing tokens in a vaultmedium
- Assuming 18 decimalsmedium
- Casting uint256 to uint96medium
- An unchecked subtractionmedium
- Hiding a trade from botsmedium
- Mixing oracle and token decimalsmedium
- approve reverts for USDTmedium
- Adding a variable to a base contractmedium
- Two arrays of different lengthsmedium
- Hiding a 4-digit code with a hashmedium
- A signature that leaves out a fieldmedium
- How much to trust block.timestampmedium
- Finding out about an attackmedium
- An initialize function without a guardmedium
- Signatures from smart walletsmedium
- What formal verification provesmedium
- An exploit is happening nowmedium
- Anyone can grow a listmedium
- A signed order with no expirymedium
- Who holds DEFAULT_ADMIN_ROLEmedium
- Checking an upgrade before it shipsmedium
- Casting a negative pricemedium
- A token you can buy but not sellmedium
- Address poisoningmedium
- An NFT stuck in a contractmedium
- A deposit of a token that does not existmedium
- A burn function with a from parametermedium
Hard 42
- Reentrancy through a view functionhard
- Reentrancy through safeMinthard
- EIP-7702 and "only EOAs" checkshard
- Using a signature as a noncehard
- Domain separator after a chain splithard
- Hash collision with encodePackedhard
- msg.value inside a multicallhard
- Which way to round in a vaulthard
- Trade-offs of a TWAP oraclehard
- Checking a Chainlink pricehard
- Flash-loaned voting powerhard
- Return data gas griefinghard
- Relayer forwards too little gashard
- Trusting a cross-chain messagehard
- A fee that rounds to zerohard
- Commit-reveal that can be copiedhard
- Missing account checks on Solanahard
- Reentrancy through token hookshard
- Guarding only one functionhard
- Reentrancy across two contractshard
- The first depositor attackhard
- Reward rate from the token balancehard
- A router that calls anythinghard
- Pulling tokens from any addresshard
- Merkle leaves that look like nodeshard
- A permit that someone uses firsthard
- Oracle prices after an L2 outagehard
- Transferring tokens to yourselfhard
- Trusted forwarder plus multicallhard
- How far one swap moves a pool pricehard
- Deploy then initialise in two transactionshard
- One signature, two meaningshard
- A permit call that silently succeedshard
- A harmless-looking proposalhard
- Claiming someone's future wallethard
- A flash loan callback anyone can triggerhard
- Sending funds to a missing contracthard
- Rewards while nobody is stakedhard
- Trading ahead of an oracle updatehard
- Modifier order and reentrancyhard
- One signer counted twicehard
- A position that cannot be liquidatedhard