Blockchain Developer interview questionsScenario — an exploit in progress round

Purpose

Makes the candidate a responder rather than a commentator, and commits the interviewer to answering actions with consequences, which keeps the scenario honest.

Purpose

Rewards precision — which market, which power, which signer — over general intent, and makes vagueness visible without the interviewer having to point at it.

Purpose

Reads the opening minutes of incident response: stop the loss before understanding it, use exactly the powers that exist, and let neither the attacker nor a helpful stranger learn more than they already know. The discriminator is scope — most candidates pause the USDC market and stop there. The first three or four minutes are the candidate reading the pack, and they count against the fifteen, as they would on the night.

Signals to score

• Declares an incident in the first minute and splits the roles, even between two people: one on chain, one on communication and the record
• Pauses borrowing on every market, not only USDC, because the flaw is the collateral price and WETH can be borrowed against it next
• Pauses supplying XYZ, so no new collateral enters at a price that can be moved
• Pauses the same markets on the rollup deployment in the same sitting, before anything happens there
• Weighs pausing liquidations in the XYZ market, since the adapter can be pushed down to liquidate honest borrowers, against bad debt if XYZ really falls
• Checks the decoded calldata of each guardian transaction on the signing device before approving it, despite the clock
• Sends the pause through a private transaction route, or says why it matters that the attacker could see it coming
• Confirms each pause by watching a borrow attempt revert, not by reading a successful receipt
• Declines to confirm the vector to the stranger, and turns down a third-party rescue while a pause is available
• Keeps a timestamped record of every action from the first minute

Follow-up questions

• You have paused USDC borrowing. What can the attacker borrow now?
• The same adapter is on the rollup. When do you pause there?
• What if someone pushes XYZ's price down instead of up — who gets hurt?
• The account offering a rescue has a real reputation. Why not let them?
• How do you know the pause worked?

Purpose

Separates candidates who know that a spot price can be manipulated from those who can say what manipulating it cost against what it unlocked — which is the calculation that should have happened when XYZ was listed.

Signals to score

• Explains that a price read from pool reserves within the same transaction can be moved and restored inside that transaction
• Says the attacker needed almost no capital, because the flash loan is repaid before the transaction ends
• Compares the cost of moving the price with what it unlocked: a pool of about $950,000 a side against $4.33 million of borrowable USDC
• Computes the loss: $1.23 million borrowed, about $165,000 of XYZ left behind, about $1.07 million of bad debt
• Proposes pricing that one transaction cannot move, and states each option's limit: an average over a thin pool still moves if the price is held across blocks, and an external feed needs staleness and deviation checks
• Caps supply of XYZ and borrowing against it in proportion to its real on-chain liquidity, and lowers its collateral factor
• Adds a circuit breaker that halts borrowing when two independent price sources disagree beyond a bound
• Explains why the tests passed — a mocked price nobody could move — and why the audit could not have caught an adapter added after it
• Makes listing a collateral asset a reviewed process with a manipulation-cost check, not a parameter change one person approves

Follow-up questions

• How much of their own capital did the attacker need?
• Switch the adapter to a thirty-minute average price. Is XYZ now safe to borrow against?
• The pool held $950,000 a side and $4.33 million was borrowable. What should that ratio have told someone at listing?
• The adapter's unit tests all pass. What were they testing?
• One reviewer approved the adapter. What would you change about that, and what would you not?

Purpose

Reads incident response once the clock slows down: public and private communication, a loss that has to land on someone, and the pressure to ship a fix at four in the morning.

Signals to score

• Publishes a short statement within the hour — what is paused, that an incident is under way, when the next update comes — without naming the vector while any deployment could still be reached through it
• Names who is told privately and why: the XYZ team, the stablecoin's issuer with the receiving addresses, exchanges the funds may reach, and a security incident response group
• Sees that withdrawals are still open, so the first suppliers to leave take full value and the last carry the loss
• Lays out the options for the bad debt — the treasury covers it, the loss is written down across USDC suppliers, or a mix — with the numbers for each
• Says the choice belongs to whoever governs the protocol, with legal counsel, and brings numbers rather than a decision
• Keeps borrowing against XYZ paused until a reviewed fix has passed the timelock, and argues against an emergency redeploy tonight
• Treats any message to the attacker, including an offer of a bounty for returned funds, as leadership's and counsel's decision
• Commits to a public post-mortem with a date, published after the fix is live on both deployments
• Keeps the record going: every action with its time and transaction hash

Follow-up questions

• Suppliers can still withdraw. Is that a problem tonight?
• The treasury holds $2 million. Should it cover the bad debt, and who decides?
• The XYZ team wants to announce that their token was not at fault. What do you tell them?
• Someone proposes deploying a patched adapter within the hour. What do you say?
• When does the public learn how it happened?

Purpose

Candidates who have been paged in the middle of the night talk about who gets woken and what they can do on their own; others talk about dashboards. The automation question has a defensible answer either way, and the read is whether the trade-off is priced.

Signals to score

• Pages a person for alerts that mean funds are leaving, instead of posting them in a channel, with escalation if nobody acknowledges
• Monitors the cause as well as the effect: the adapter's price against an independent source, and large price moves within a single transaction
• Keeps pause transactions for every market and both deployments drafted in advance, and rehearses signing them against the clock
• Makes sure enough guardian signers to meet the threshold are reachable at every hour, across time zones
• Weighs an automated pauser with a narrow role — it can pause, cannot unpause, cannot move funds or change parameters — against the cost of a false alarm
• Says what an attacker who steals the automated pauser's key could do, and judges whether that is acceptable
• Measures the response as time from the first malicious transaction to an effective pause, and sets a target
• Includes the rollup deployment in the next drill

Follow-up questions

• The alert fired at 03:03 and nobody saw it. What should have happened instead?
• What would a monitor on the cause, rather than on borrowing volume, have watched?
• An automated pauser's key is stolen. What is the worst the thief can do?
• How many signers should be reachable at three in the morning, and how would you know they are?

Purpose

Someone who has worked an incident asks about keys, response times and drills; someone who has not asks about the size of the bug bounty. Naming the areas keeps what they choose meaningful.

Purpose

Ends with a specific gap the team has: what the right candidate wants to hear and what the wrong one needs to. Only say it if it is still true.