▸case-21 A Web3 frontend needs to display historical user token transfer events efficiently without querying full RPC archive nodes on every page load. Which indexing protocol uses event handlers written in AssemblyScript to index smart contract events into a GraphQL database? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-22 A blockchain gaming application needs to transfer 5 different weapon NFTs and 500 gold utility tokens from a seller to a buyer in a single transaction while minimizing gas overhead. Which token standard should be used, and what function executes this operation? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-06 Our Node.js Express REST API for an e-commerce platform needs protection against Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Provide middleware setup for Helmet and CSURF without smart contract or Web3 elements. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-01 I am building a decentralized lending vault on Ethereum and need help designing the smart contracts. Please provide a production-ready Solidity implementation for an upgradeable token vault, including architectural layout, security mitigation strategies for common attack vectors like reentrancy, gas optimization recommendations, and a concrete verification plan to test the contract before mainnet deployment. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-12 When implementing smart account wallets without changing Ethereum consensus protocols, transactions are bundled together off-chain into custom operations rather than standard ECDSA transactions. What is the standard data structure defined by account abstraction for these user requests, and which canonical contract verifies and executes them? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-24 A smart contract developer wants to build a security-critical financial primitive using a language that enforces strict safety constraints at compile time, prevents integer overflow/underflow by default, forbids recursive function calls, and omits class inheritance. Which EVM-native smart contract programming language should they choose? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-20 A decentralized exchange user submits a large token swap transaction. A MEV bot detects the pending transaction in the public mempool, places a buy order with higher gas before it, and a sell order immediately after, extracting value from the user. What is this attack called, and how can dApps protect user transactions from public mempool exploitation? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-19 A privacy-preserving token mixer relies on off-chain zero-knowledge proofs to allow withdrawals without linking depositor addresses. What contract component verifies the zero-knowledge proof on-chain, and how does the protocol prevent double-spending the same deposit? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-08 We are writing a DeFi lending protocol liquidation function on Polygon using a primary oracle price feed integration. A common developer practice is to directly read `[, int256 price, , , ] = priceFeed.latestRoundData();` without evaluating the other return values. What critical validation must be added to prevent executing liquidations on stale or invalid price feed data? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-13 To allow users to approve token transfers without paying gas for a separate `approve()` transaction, a team wants to implement off-chain signature verification for ERC-20 transfers. Which EIP standard provides typed structured data signing, and what built-in EVM opcode or cryptographic function recovers the signer address from the signature? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-23 In a Solidity smart contract withdrawal function, a developer writes: `(bool success, ) = msg.sender.call{value: amount}(""); balances[msg.sender] -= amount;`. Why is this pattern insecure, and how should the code order be restructured? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-05 I sold 500 shares of traditional S&P 500 index ETF stock through a standard broker. How do I calculate tax basis and fill out IRS Form 8949 for capital gains? | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-03 Our team is designing a multi-sig DAO treasury governance contract with a time-locked execution mechanism. Please furnish a full architecture overview, the complete Solidity code using battle-tested library patterns, a breakdown of potential security vulnerabilities with corresponding fixes, and actionable instructions for testing and validating transaction flows on a local network. | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-18 A cross-chain asset bridge relays deposit messages from Ethereum to Arbitrum. An attacker intercepts a valid message payload sent on Ethereum and submits it multiple times to the destination bridge contract on Arbitrum to drain funds. What security mechanism must be added to the destination contract to prevent this attack? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-17 A developer declares state variables in a Solidity contract as follows: `uint8 flag1; uint256 totalAmount; uint8 flag2; address owner;`. How many 32-byte storage slots does this layout occupy, and how can it be optimized to reduce storage slot usage? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-15 On the Solana blockchain, smart contracts require deterministic account addresses controlled solely by the program without a private key. When implementing this using Rust, how are these addresses derived and validated against programmatic seeds? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-11 Our protocol calculates share prices by querying `get_virtual_price()` on an external curve-style automated market maker during state updates. An attacker executes a single transaction that deposits liquidity, triggers a callback, queries our contract while the AMM pool state is mid-update, and withdraws liquidity. What specific category of reentrancy vulnerability is present? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-04 We need to set up a primary-replica streaming replication architecture for a PostgreSQL 15 database handling online merchant transactions. Please provide the step-by-step configuration for postgresql.conf and pg_hba.conf, along with failover procedures. | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-09 A developer is writing a high-frequency trading contract on Ethereum where deployment byte size and execution gas are constrained. They are using verbose revert messages like `require(balance >= amount, "Insufficient balance in user vault for execution");`. How should error handling be refactored to minimize execution gas and runtime bytecode? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-25 In a decentralized DAO protocol, token holders vote to pass a protocol parameter update proposal. To give the community time to review or exit before changes take effect, which OpenZeppelin contract module enforces a delay between proposal queuing and execution? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-07 We are deploying a suite of 50 token vault instances on Ethereum mainnet and want to minimize deployment gas costs while preserving upgradeability. The team is considering deploying a separate admin contract for every single proxy instance. Which upgradeability proxy pattern should we adopt to avoid per-proxy admin overhead and minimize deployment gas? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-16 A multi-faceted smart contract system exceeds the 24KB EVM contract size limit (`EIP-170`). The team splits logic across multiple implementation contracts and delegates calls through a single proxy. What architecture pattern achieves this, and what mechanism routes function calls to individual implementation contracts? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-02 We are launching a dynamic NFT collection on Arbitrum that changes visual states based on external live price feeds. Could you outline the complete technical solution, provide the Solidity smart contract code integrating Chainlink data feeds, detail the off-chain metadata architecture, and supply an audit checklist for verifying randomness and oracle safety? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-10 When upgrading an existing smart contract implementation from V1 to V2, a developer added a new `uint256 public totalFeesCollected;` variable at line 5 of the V2 contract, above existing state variables `address public owner;` and `mapping(address => uint256) public balances;`. What state corruption vulnerability does this introduce? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
▸case-14 An NFT marketplace smart contract needs to query royalty details for secondary market sales across multiple collection contracts. Which standard interface method must the marketplace call, and what two values must it return? | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |