Master these 31 carefully curated interview questions to ace your next Blockchain web3 interview.
Blockchain is a decentralized, immutable distributed ledger that records transactions across many computers securely.
Structure: chain of blocks, each containing transactions, timestamp, and hash of previous block. Decentralized: no central authority, maintained by network of nodes. Immutable: once added, data can't be altered without consensus. Consensus mechanisms: Proof of Work (Bitcoin), Proof of Stake (Ethereum 2.0). Use cases: cryptocurrency, supply chain, identity, DeFi, NFTs. Key properties: transparency, trustlessness, censorship resistance.
Smart contracts are self-executing programs on blockchain that automatically enforce agreement terms when conditions are met.
Written in Solidity (Ethereum), deployed to blockchain. Once deployed, code is immutable and runs exactly as written. Execute automatically when triggered by transactions. Gas: fee paid to execute contract operations. Use cases: token creation (ERC-20, ERC-721), DeFi protocols, DAOs, escrow. Limitations: can't access off-chain data directly (need oracles like Chainlink), gas costs, immutability (can't fix bugs easily). Testing: Hardhat, Foundry.
PoW uses computational power to validate transactions (mining); PoS uses staked cryptocurrency as collateral for validation rights.
PoW: miners solve complex puzzles, first to solve adds the block and gets reward. Secure but energy-intensive (Bitcoin uses more electricity than some countries). PoS: validators stake tokens, selected based on stake amount + randomness. Slashing: lose stake for malicious behavior. Benefits: 99.95% less energy, faster finality. Ethereum moved from PoW to PoS in 'The Merge' (2022). Other: Delegated PoS, Proof of Authority, Proof of History (Solana).
ERC-20 defines fungible tokens (cryptocurrencies); ERC-721 defines non-fungible tokens (NFTs) with unique properties.
ERC-20: standard interface for fungible tokens. Functions: totalSupply, balanceOf, transfer, approve, transferFrom. Examples: USDC, DAI, UNI. ERC-721: each token is unique with tokenId. Functions: ownerOf, safeTransferFrom, tokenURI (metadata). Examples: CryptoPunks, BAYC. ERC-1155: multi-token standard (both fungible and non-fungible in one contract). ERC-4626: tokenized vault standard for DeFi.
DeFi replaces traditional financial intermediaries with smart contracts for lending, borrowing, trading, and earning yield.
Protocols: (1) DEX: Uniswap, SushiSwap (automated market makers). (2) Lending: Aave, Compound (supply/borrow crypto). (3) Stablecoins: DAI (algorithmic), USDC (backed). (4) Yield farming: provide liquidity, earn rewards. (5) Derivatives: Synthetix, dYdX. Risks: smart contract bugs, impermanent loss, oracle manipulation, regulatory uncertainty. Total Value Locked (TVL) measures DeFi adoption. Flash loans: uncollateralized loans within single transaction.
A 51% attack occurs when an entity controls majority of network's mining/staking power, enabling double-spending and transaction censorship.
In PoW: attacker with >50% hash rate can mine faster than honest chain, create alternative chain, reverse transactions (double-spend). In PoS: need >50% of staked tokens (extremely expensive on Ethereum). Prevention: high network hash rate/stake value, checkpointing, economic penalties (slashing). Smaller chains more vulnerable. Bitcoin's security: would cost billions in hardware + electricity. Not about stealing funds directly — about reversing your own transactions.
Layer 2 solutions process transactions off the main chain for speed and cost, then settle on Layer 1 for security.
Types: (1) Rollups: bundle transactions off-chain, post compressed data on-chain. Optimistic Rollups (Arbitrum, Optimism): assume valid, fraud proofs challenge. ZK-Rollups (zkSync, StarkNet): cryptographic validity proofs, instant finality. (2) State channels: off-chain transactions between parties (Lightning Network). (3) Sidechains: separate chains with own consensus (Polygon PoS). Benefits: 10-100x cheaper, faster transactions. Tradeoff: some trust assumptions depending on type.
Review code for common vulnerabilities (reentrancy, overflow), use automated tools (Slither, Mythril), and conduct formal verification.
Process: (1) Manual code review: check for reentrancy, integer overflow, access control, front-running, oracle manipulation. (2) Automated tools: Slither (static analysis), Mythril (symbolic execution), Echidna (fuzzing). (3) Test coverage: unit tests, integration tests, invariant tests. (4) Formal verification for critical logic. (5) Economic attack modeling. (6) Check against known vulnerability databases. Common fixes: ReentrancyGuard, SafeMath (pre-Solidity 0.8), access modifiers, timelocks. Bug bounty post-launch.
Ethereum's roadmap includes: The Merge (PoS), The Surge (sharding), The Scourge, The Verge, The Purge, and The Splurge.
The Merge (completed 2022): PoW → PoS, 99.95% energy reduction. The Surge: sharding via danksharding/proto-danksharding (EIP-4844), 100k TPS goal. The Scourge: mitigate MEV centralization risks. The Verge: Verkle trees for lighter nodes, enable statelessness. The Purge: reduce node storage requirements, simplify protocol. The Splurge: miscellaneous improvements. Current focus: proto-danksharding (blobs) for cheaper L2 data, account abstraction (ERC-4337) for better UX.
A blockchain is a decentralized, immutable ledger of transactions linked by cryptographic hashes in sequential blocks.
Structure: each block contains transactions, timestamp, previous block hash, and nonce. Blocks are cryptographically linked — changing one invalidates all subsequent blocks. Decentralized: copies on thousands of nodes, no single point of failure. Consensus: nodes agree on valid state (Proof of Work, Proof of Stake). Immutability: once confirmed, transactions cannot be altered without 51% network control. Types: public (Bitcoin, Ethereum — permissionless), private (Hyperledger — permissioned), consortium (shared governance). Transactions are verified by network, not central authority.
Coins operate on their own blockchain (BTC, ETH); tokens are built on existing blockchains using smart contracts (ERC-20, ERC-721).
Coins: native to their blockchain, used for gas/fees and store of value. Bitcoin (BTC), Ether (ETH), Solana (SOL). Creating a coin requires building or forking a blockchain. Tokens: created via smart contracts on existing chains. Fungible (ERC-20): interchangeable, like currency (USDC, UNI). Non-fungible (ERC-721/ERC-1155): unique items (NFTs, game items). Token standards: ERC-20 (fungible), ERC-721 (NFT), ERC-1155 (multi-token), SPL (Solana). Tokens can represent anything: currency, governance rights, real-world assets, access credentials.
A smart contract is self-executing code deployed on blockchain that automatically enforces agreement terms when conditions are met.
Concept: if-then logic executed on-chain without intermediaries. Deployed as bytecode, immutable once deployed. Ethereum: written in Solidity, compiled to EVM bytecode. Capabilities: token creation, DeFi protocols, NFT minting, DAOs, escrow, insurance. Limitations: cannot access external data directly (need oracles), gas costs for execution, bugs are permanent (unless upgradeable proxy pattern). Security: reentrancy attacks, integer overflow, access control vulnerabilities. Testing: Hardhat, Foundry. Audit: essential before mainnet deployment.
Solidity is the primary programming language for Ethereum smart contracts — statically typed, compiled to EVM bytecode.
Features: contract-oriented (like classes), inheritance, interfaces, libraries, modifiers, events. Types: uint256, address, bytes32, mapping, struct, enum, array. Functions: public, private, internal, external. View/pure (read-only, no gas). Payable (receives ETH). Storage: storage (persistent, expensive), memory (temporary, cheaper), calldata (read-only input). Events: emit Log(msg) for frontend listening. Gas optimization: pack storage variables, use calldata over memory, minimize SSTOREs. Security patterns: checks-effects-interactions, reentrancy guard, access control (Ownable, AccessControl).
Proof of Work uses computational power; Proof of Stake uses staked tokens; others include DPoS, PoA, and PBFT.
Proof of Work (PoW): miners solve cryptographic puzzles, energy-intensive, Bitcoin. Mining difficulty adjusts. Proof of Stake (PoS): validators stake tokens as collateral, selected to propose blocks based on stake size. Ethereum (post-Merge). Energy efficient. Delegated PoS (DPoS): token holders vote for validators (EOS, Tron). Proof of Authority (PoA): known validators, fast but centralized (private chains). PBFT (Practical Byzantine Fault Tolerance): all nodes communicate, used in Hyperledger. Proof of History (Solana): cryptographic timestamps for ordering. Each trades decentralization, security, and scalability differently.
DeFi provides financial services (lending, trading, insurance) through smart contracts without intermediaries like banks.
Core protocols: (1) DEX (Decentralized Exchanges): Uniswap, SushiSwap — AMM (Automated Market Maker) model. (2) Lending: Aave, Compound — supply assets to earn yield, borrow against collateral. (3) Stablecoins: USDC (collateralized), DAI (crypto-collateralized), algorithmic. (4) Yield farming: provide liquidity for rewards. (5) Derivatives: Synthetix, dYdX. (6) Insurance: Nexus Mutual. Key concepts: TVL (Total Value Locked), APY, impermanent loss, flash loans, liquidity pools. Risks: smart contract bugs, oracle manipulation, governance attacks, regulatory uncertainty.
Web3 wallets manage private keys for signing transactions and interacting with dApps. Types: hot (software) and cold (hardware).
Key pair: private key (secret, signs transactions) + public key → address (visible, receives funds). Mnemonic: 12/24 seed phrase generates all keys (BIP-39). Hot wallets: MetaMask (browser extension), Rainbow (mobile) — convenient but connected to internet. Cold wallets: Ledger, Trezor — hardware devices, air-gapped signing. Smart contract wallets: Safe (multi-sig), social recovery. WalletConnect: protocol connecting dApps to mobile wallets. Account abstraction (ERC-4337): programmable accounts, gasless transactions, social recovery. Security: never share private key/seed phrase, use hardware wallet for large amounts.
Layer 2s process transactions off-chain and settle on Layer 1, increasing throughput while inheriting mainnet security.
Types: (1) Optimistic Rollups: assume transactions valid, fraud proofs challenge invalid ones. Arbitrum, Optimism. 7-day withdrawal period. (2) ZK-Rollups: generate cryptographic validity proofs. zkSync, StarkNet, Polygon zkEVM. Instant finality after proof. (3) State Channels: off-chain transactions between parties, settle final state. Lightning Network (Bitcoin). (4) Sidechains: independent chains bridged to mainnet (Polygon PoS — not true L2). Benefits: lower gas fees, higher TPS, same security as L1 (rollups). EIP-4844 (proto-danksharding): cheap blob data for rollups. Ecosystem: most Ethereum DeFi/NFT activity migrating to L2s.
Reentrancy, integer overflow, front-running, oracle manipulation, access control issues, and flash loan attacks.
Reentrancy: contract calls external contract before updating state — attacker re-enters (The DAO hack, $60M). Prevention: checks-effects-interactions, ReentrancyGuard. Integer overflow/underflow: Solidity <0.8 wraps around. SafeMath or Solidity 0.8+ built-in checks. Front-running: MEV bots see pending transactions, insert before/after for profit. Flashbots protect. Oracle manipulation: manipulate price feeds for profit. Use Chainlink decentralized oracles. Access control: missing onlyOwner/role checks. Use OpenZeppelin's AccessControl. Flash loan attacks: manipulate protocol in single transaction. Audit: OpenZeppelin, Trail of Bits, Certik.
ERC-4337 enables programmable smart contract accounts replacing EOAs, supporting gasless transactions, batching, and social recovery.
Problem: EOAs (Externally Owned Accounts) are limited — single key, must hold ETH for gas, no recovery options. Solution: smart contract wallets as first-class accounts. Features: (1) Gasless transactions (paymaster sponsorship). (2) Social recovery (designate guardians to recover account). (3) Transaction batching (multiple operations in one). (4) Session keys (temporary permissions for dApps). (5) Custom signature schemes (biometric, multi-sig). Components: UserOperation (instead of transaction), Bundler (submits to EntryPoint), Paymaster (sponsors gas). Adoption: Safe, ZeroDev, Biconomy, Alchemy.
Smart contract backend (Solidity), React frontend with ethers.js/wagmi, wallet connection, and IPFS for decentralized storage.
Stack: (1) Smart contracts: Solidity on Hardhat/Foundry, deploy to testnet first. (2) Frontend: React/Next.js with wagmi hooks + viem for Ethereum interaction. (3) Wallet: RainbowKit/ConnectKit for wallet connection UI. (4) Storage: IPFS/Arweave for decentralized file storage. (5) Indexing: The Graph for querying blockchain data (subgraphs). (6) Testing: Hardhat tests, forked mainnet for integration. (7) Deployment: contract to verified on Etherscan, frontend to Vercel. (8) Monitoring: Tenderly for transaction monitoring. Security: audit before mainnet, start with upgradeable proxy pattern.
Use Hardhat/Foundry for unit tests, coverage tools, fuzzing, forked mainnet testing, and debugging with traces.
Hardhat: JavaScript/TypeScript tests, console.log in Solidity, error messages, gas reporting. Foundry: Solidity-native tests (forge test), faster, built-in fuzzing. Test types: unit (individual functions), integration (contract interactions), fork (test against mainnet state). Fuzzing: random inputs find edge cases — foundry invariant tests. Coverage: solcover for Hardhat. Debugging: Tenderly debugger (step through EVM), Hardhat traces. Static analysis: Slither (automated vulnerability detection), Mythril. Gas optimization: gas reporter plugins. Best practice: 100% coverage for financial contracts. Test on multiple testnets (Sepolia, Goerli) before mainnet.
The Merge transitioned Ethereum from Proof of Work to Proof of Stake, reducing energy consumption by 99.95% without downtime.
Before (PoW): miners competed to solve puzzles, high energy usage (~same as Finland). After (PoS): validators stake 32 ETH, randomly selected to propose blocks. Energy reduction: 99.95%. No change: gas fees (unchanged — need L2 for cheap transactions), transaction speed (slightly faster). Validators: 32 ETH minimum stake, earn rewards (~4-5% APR), slashed for misbehavior. Withdrawal: enabled in Shanghai upgrade (2023). Future roadmap: The Surge (sharding for L2), The Verge (Verkle trees), The Purge (state expiry), The Splurge (misc improvements).
Oracles bring off-chain data (prices, weather, APIs) to smart contracts, which cannot natively access external information.
Problem: blockchains are isolated — smart contracts can only access on-chain data. Oracle: bridge between off-chain data and on-chain contracts. Chainlink: decentralized oracle network — multiple nodes fetch and aggregate data, preventing single point of failure. Types: (1) Price feeds (DeFi). (2) VRF (verifiable random numbers for gaming/NFTs). (3) Automation (Keepers — trigger contract functions). (4) CCIP (cross-chain messaging). (5) Functions (any API call). Oracle problem: how to trust external data? Solution: decentralized aggregation, staking, reputation. Oracle manipulation is a major DeFi attack vector.
MEV is profit validators/miners extract by reordering, inserting, or censoring transactions within blocks they produce.
Types: (1) Sandwich attack: front-run user's DEX trade (buy before, sell after — profit from price impact). (2) Arbitrage: exploit price differences across DEXs. (3) Liquidation: liquidate undercollateralized DeFi positions. (4) JIT liquidity: provide concentrated liquidity just for one transaction. Impact: users get worse prices, higher gas fees from priority gas auctions. Solutions: Flashbots (private transaction pool, reduced gas wars), MEV-Boost (PBS — Proposer-Builder Separation), encrypted mempools, commit-reveal schemes. MEV is estimated at billions per year on Ethereum.
Multiple audits, formal verification, bug bounties, time-locked upgrades, monitoring, and gradual TVL increase.
Pre-launch: (1) Internal review + static analysis (Slither). (2) External audit by 2+ firms (OpenZeppelin, Trail of Bits). (3) Formal verification for critical math. (4) Bug bounty (Immunefi — up to $10M rewards). Post-launch: (5) Time-locked admin functions (48hr delay). (6) Emergency pause mechanism. (7) Gradual TVL caps (start small, increase). (8) Real-time monitoring (Forta, Tenderly). (9) Insurance (Nexus Mutual). (10) Incident response plan. Upgradability: proxy patterns for fixes, but reduces trustlessness. Most DeFi hacks come from: flash loan attacks, oracle manipulation, or reentrancy in new code.
IPFS is a peer-to-peer distributed file system using content-addressing, commonly used for NFT metadata and dApp frontends.
Content-addressing: files identified by hash of content (CID), not location. Same content always has same hash — immutable. Protocol: peers share files — request by CID, any peer with the file serves it. Pinning: ensure your files stay available (Pinata, Infura, web3.storage). Use in Web3: (1) NFT metadata and images (token URI points to IPFS). (2) dApp frontends (censorship-resistant hosting). (3) DAO document storage. vs Arweave: permanent storage with one-time payment. IPFS can lose data if no one pins it. Filecoin: incentivized IPFS with paid storage market.
DAOs (Decentralized Autonomous Organizations) are community-governed entities using smart contracts for transparent decision-making.
Structure: governance token holders vote on proposals. Smart contracts execute approved decisions automatically. Components: (1) Governance token: voting power (ERC-20). (2) Proposal system: anyone can propose (with minimum token threshold). (3) Voting: on-chain (expensive) or off-chain (Snapshot — gasless). (4) Execution: timelock for delay, multi-sig for emergency. Types: protocol DAOs (Uniswap, Aave governance), investment DAOs (pooled funds), social DAOs (membership). Tools: Governor (OpenZeppelin), Tally (voting interface), Gnosis Safe (treasury). Challenges: voter apathy, plutocracy (whale dominance), legal status unclear.
AMMs use liquidity pools and mathematical formulas (x*y=k) to enable decentralized token swapping without order books.
Concept: liquidity providers deposit token pairs into pools. Traders swap against the pool. Price determined by formula: x * y = k (constant product). As one token is bought, its price increases automatically. Uniswap v2: equal-value token pairs. Uniswap v3: concentrated liquidity — LPs choose price ranges for capital efficiency. Fees: 0.3% per trade, distributed to LPs proportionally. Impermanent loss: LP value vs. simply holding — divergence risk when prices change. MEV: sandwich attacks target large swaps. Innovations: Curve (stablecoin-optimized), Balancer (multi-token pools), Uniswap v4 (hooks for customization).
Pack storage variables, use events for data, minimize SSTOREs, batch operations, and use assembly for critical paths.
Storage: (1) Pack variables: uint128 + uint128 in one 256-bit slot (saves 20K gas). (2) Use mappings over arrays for large datasets. (3) Delete unused storage for gas refund. (4) Use events instead of storage for data only needed off-chain. Code: (5) Use calldata over memory for function inputs. (6) Unchecked math where overflow impossible. (7) Short-circuit conditions (cheap checks first). (8) Batch operations in single transaction. (9) Use custom errors over require strings (saves gas). Advanced: (10) Assembly (Yul) for hot paths. (11) EIP-1167 minimal proxy for deploying many similar contracts. (12) Diamond pattern for large contracts exceeding size limit.
Ethereum prioritizes decentralization with slower throughput; Solana prioritizes speed (65K TPS) with more centralized validators.
Ethereum: ~15-30 TPS (L1), PoS, EVM, Solidity, higher gas fees, largest ecosystem and liquidity, most battle-tested. Solana: theoretical 65,000 TPS, Proof of History + PoS, Rust/Anchor framework, sub-cent fees, growing DeFi/NFT ecosystem. Programs (Solana term for smart contracts) use account model vs Ethereum's storage model. Solana tradeoffs: higher hardware requirements (fewer validators, more centralized), history of outages, smaller developer ecosystem. Both have L2 solutions. Ethereum dominates DeFi TVL; Solana gaining in NFTs and consumer apps.
Ready to master Blockchain web3?
Start learning with our comprehensive course and practice these questions.
