Blockchain Developer interview questionsSystem Design Interview round

Purpose

Frames the round as redesigning something that already carries money, so the candidate has to find what is wrong before proposing what is right.

Purpose

Leaves every problem unnamed. A candidate who asks how the team would even know if something had gone wrong has already started.

Purpose

The load-bearing question. It reads whether the candidate knows how a chain changes its mind — reorganisations, finality, a node that answers with less than it was asked for — and whether their design makes the ledger follow the chain rather than the first thing the chain said.

Signals to score

• Says crediting at `latest` credits blocks that can still be replaced, and sets a confirmation policy per chain
• Uses the node's finalized or safe block, or a stated depth, and says what each choice costs the customer in waiting
• Distinguishes the rollup's heads — the sequencer's, the one whose batch is posted to Ethereum, and the one final on Ethereum — and does not confuse crediting with the seven-day window for bridge withdrawals
• Stores block hashes with the cursor, detects a reorganisation when a new block's parent hash does not match, and rewinds and re-reads
• Refuses to advance the cursor past a failed or partial RPC response, and names provider limits on block range and result size
• Changes the deduplication key to chain id, transaction hash and log index, and gives the batch transfer the old key silently drops
• Shows a deposit as pending until it is final, and says what a customer may and may not do with a pending balance
• Adds a reconciliation job that compares the ledger with the chain — transfers received at each deposit address, and total on-chain holdings against total customer balances — and alerts on any difference
• Cross-checks the watcher against a second provider, since a single node that lags is otherwise invisible
• Leaves what is right alone — polling with a cursor, filtering on the contract address, integers in base units — or says briefly why it is fine

Follow-up questions

• A block containing a deposit is replaced by one that does not contain it. What does the ledger show now?
• The RPC call timed out and the cursor moved on. How would anyone find out?
• An exchange pays two of your customers in one transaction. What happens to the second credit?
• On the rollup, when is a deposit final enough to credit — and is the seven-day window part of that answer?
• Would you move the watcher to a websocket subscription?

Purpose

Reads whether the candidate treats the nonce as the thing that makes a payment happen once. Candidates who have run a sender know that a retry which builds a new transaction is a second payment waiting to land.

Signals to score

• Sees that four workers asking for the `pending` nonce at once get the same value, and assigns nonces from one serialised allocator per sending address
• Stores the nonce and the signed transaction against the payout before sending, so a retry rebroadcasts identical bytes
• Explains that a timeout says nothing about whether a node accepted the transaction, and that signing a new one with a new nonce can pay twice
• Replaces a stuck transaction with the same nonce and higher fees, and knows nodes refuse a replacement that does not raise them by a minimum margin
• Says a fee cap of twice today's base fee is overtaken after a handful of full blocks, and that every later nonce then waits behind the stuck one
• Marks a payout paid only when its transaction is final, and returns a dropped or reorganised-out transaction to the queue under the same nonce
• Watches the hot wallet as state — confirmed nonce against allocated nonce, balance against queued payouts — and alerts on a gap
• Keeps fee increases inside a stated budget and pages a person beyond it
• Says what happens when a payout already holding a nonce turns out to be unsendable, such as a transfer the token would reject, and fills that nonce rather than stalling everything behind it

Follow-up questions

• Two workers ask the node for the nonce at the same moment. What do they get?
• The send call timed out. Was the payout sent?
• The base fee doubles in the next minute. What happens to the forty payouts queued behind this one?
• How do you replace a stuck transaction, and how do you know which version landed?
• As far as the customer's balance is concerned, when is a payout paid?

Purpose

Resets the frame from bugs to authority, which is the shift this section scores.

Purpose

Tests whether the candidate designs custody as limits on what a key can do rather than as a safer place to keep it, and whether they look as hard at an admin key someone else holds. The issuer half is where candidates who have held tokens but never run a product on them tend to go quiet.

Signals to score

• Takes the key out of the environment and off the shared host, into a signing service backed by a hardware module, a cloud key service or multi-party signing
• Makes the signing service enforce policy itself — per-payout and daily limits, allowed destinations — so a compromised caller cannot exceed them
• Splits hot from cold: a hot float sized to a stated number of hours of payouts, refilled from cold storage that needs several people
• Requires a second approval above a threshold, and a delay before a newly added payout destination can be paid
• Separates the power to change the signer's policy from the power to deploy the payout service, held by different people
• Names the issuer's powers — pausing the token, blocking an address, upgrading the contract — and what each does to a customer's balance
• Plans for a blocked deposit or treasury address: how it is detected, what the ledger shows, and how customers hear about it
• Monitors the token contract for upgrades and role changes as part of normal operations
• Says which of these dependencies the product carries on its customers' behalf and should state in its terms

Follow-up questions

• The key is in a hardware module now, and an attacker has a shell on the payout host. What can they do?
• How large should the hot wallet be, and what decides that number?
• The issuer blocks one of your customers' deposit addresses. What does the ledger show?
• The token contract is upgraded on a Tuesday. How do you find out, and what do you check?
• Who at your company can change the signing service's limits?