• Difficulty - Medium
    Total Plays - 16
    Allowed Time - 10 sec
    Best time - 1.252 sec

    What is the most direct risk of “unbounded loops” in on-chain code?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    Unbounded loops can make functions exceed block gas limits as state grows, permanently preventing execution—classic denial of service. This is common in airdrop distributions, iterating holders, or clearing arrays. Security interviews test this because it’s a real production failure: “worked in tests” but becomes uncallable at scale. Mitigations include batching/pagination and off-chain indexing.
  • Difficulty - Medium
    Total Plays - 14
    Allowed Time - 10 sec
    Best time - --

    Which bug class is most associated with incorrect upgradeable storage layout?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    In upgradeable contracts, the proxy holds storage while the implementation code changes. If developers reorder variables or change types, storage slots map incorrectly—corrupting balances, roles, or critical pointers. This is a high-severity issue in audits. Interviewers expect candidates to mention append-only storage layout, storage gaps, and standards like EIP-1967 for proxy slots.
  • Difficulty - Medium
    Total Plays - 12
    Allowed Time - 10 sec
    Best time - 0.778 sec

    What is the core risk of using tx.origin for authorization?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    tx.origin authorization can be bypassed if a user is tricked into calling an attacker contract, which then calls the target contract—tx.origin remains the user. This is a known insecure pattern in Ethereum security. Interviewers like it because it tests whether candidates understand call chains and why msg.sender + explicit access control is the correct boundary.
  • 1 day left
    P
    Remote · Worldwide Posted: Mar 4, 2026
    Job description
    Parity builds core blockchain infrastructure including Polkadot, Polkadot SDK, and Kusama. This contract-based, remote role sits within the Security Engineering team and focuses on strengthening security across decentralized systems and Rust-based software components. The Security Engineer will conduct deep manual and automated audits, write secure Rust code where required, and...
  • 11 days left
    Remote · Worldwide Posted: Mar 1, 2026
    Job description
    Veda builds DeFi infrastructure that enables financial platforms to launch on-chain yield products through enterprise-grade integrations. The protocol supports multiple large vault products and operates at multi-billion TVL scale with a global user base. This Smart Contract Engineer role focuses on Solidity development across vault systems, upgradeable proxy architecture, account...
  • 11 days left
    Remote · US Remote Posted: Mar 1, 2026
    Job description
    CertiK is a blockchain security company focused on audits, security research, and infrastructure protection across decentralized systems. The firm has audited thousands of Web3 projects and supports protocols securing large volumes of digital assets. This Junior Blockchain Security Engineer role sits within web3 security roles and supports smart contract audits,...
  • Difficulty - Medium
    Total Plays - 17
    Allowed Time - 10 sec
    Best time - 0.263 sec
    #A
    #B
    #C
    #D
    Explanation:
    immutable variables are assigned once (typically in the constructor) and then become read-only. They are stored in bytecode rather than regular storage slots, which can reduce gas compared to storage reads. This matters in Solidity interviews because immutables are common in optimized contracts (e.g., router addresses) and in secure configuration patterns.
  • Difficulty - Medium
    Total Plays - 12
    Allowed Time - 10 sec
    Best time - --

    Which storage type enables EIP-1167 minimal clones to be cheap?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    Minimal proxy clones (EIP-1167) keep logic in an implementation and rely on proxy bytecode forwarding calls, making deployment cheap. In practice, immutables in the implementation help keep runtime reads efficient and reduce repeated storage reads for configuration-like values. Candidates are often tested on why clones save gas and how configuration is safely handled.
  • Difficulty - Medium
    Total Plays - 14
    Allowed Time - 10 sec
    Best time - 1.736 sec

    Which pattern most directly reduces reentrancy risk on external transfers?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    The Checks-Effects-Interactions (CEI) pattern reduces reentrancy by making you validate inputs and update internal state before any external call (like ETH transfer or token transfer). If a malicious contract re-enters, state has already moved forward, limiting exploitability. Many interviewers treat CEI as a must-know Solidity security habit for production contracts
  • Difficulty - Medium
    Total Plays - 11
    Allowed Time - 10 sec
    Best time - 6.708 sec

    In EVM, which opcode can silently fail and return a boolean instead of reverting?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    Low-level CALL (and friends like DELEGATECALL) returns a success flag rather than automatically bubbling a revert. If you don’t check that boolean (or decode return data properly), your contract may continue in a “success-looking” state while the external call actually failed. This is a classic Solidity audit finding tied to unsafe external interactions.
  • Difficulty - Medium
    Total Plays - 32
    Allowed Time - 10 sec
    Best time - --

    Which audit signal indicates poor threat modeling?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    A happy-path-only focus is a strong signal of poor threat modeling in blockchain security because it ignores attacker behavior, edge cases, and abuse scenarios. Strong smart contract audit readiness requires adversarial thinking, not just normal-flow testing.
  • Difficulty - Medium
    Total Plays - 22
    Allowed Time - 10 sec
    Best time - --

    Which audit issue is most often downgraded incorrectly?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    Front-running is often downgraded incorrectly in smart contract audits because teams underestimate MEV and mempool-based exploitability. In DeFi security, transaction ordering attacks can cause repeated economic loss even without a classic code exploit.
  • Difficulty - Medium
    Total Plays - 19
    Allowed Time - 10 sec
    Best time - --

    Which finding has highest real-world exploit probability?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    Access control bugs often have the highest real-world exploit probability in smart contracts because attackers can directly call privileged functions when role checks fail. In blockchain security audits, broken authorization logic is a common cause of fund loss and protocol takeover.
  • 11 days left
    Remote · New York Posted: Feb 22, 2026
    Job description
    Category Labs (formerly Monad Labs) is building high-performance infrastructure around an optimized EVM client designed to improve blockchain throughput without sacrificing portability. This position sits within web3 smart contract roles focused on application-layer engineering over a next-generation EVM implementation. As a Smart Contract Engineer, you will design and implement Solidity...
  • 3 days left
    L

    Mid / Senior Smart Contract Engineer

    LI.FIFull TimeNA

    Remote · Remote EMEA, Remote APAC Posted: Jan 3, 2026
    Job description
    LI.FI - Bridge & DEX Aggregation Protocol builds infrastructure that enables unified access to on-chain liquidity across multiple blockchains through a single API, supporting same-chain and cross-chain swaps. This role sits within the Smart Contract API Expansion team, which focuses on integrating new chains, bridges, and protocol functionality across EVM...
  • Difficulty - Medium
    Total Plays - 5
    Allowed Time - 10 sec
    Best time - 10

    What default value does an uninitialized storage pointer hold?

    Tip: Click "Play" to reveal options and start playing.

    #A
    #B
    #C
    #D
    Explanation:
    An uninitialized storage pointer defaults to storage slot zero. This can overwrite critical state variables such as ownership or balances, making it a high-severity audit issue.