Fifteen common blockchain interview questions
- How does a blockchain achieve immutability?
- Proof of work versus proof of stake?
- What is gas, and how do you reduce gas costs?
- What happens when you send a transaction on Ethereum?
- Externally owned accounts versus contract accounts?
- What is a reentrancy attack, and how do you prevent it?
- What is the checks-effects-interactions pattern?
- How do integer overflows affect contracts today?
- What is front-running, or MEV?
- How do upgradeable contracts work, and what are the risks?
- What is an oracle, and why is it a risk?
- Explain the ERC-20 and ERC-721 standards.
- What are layer 2 rollups?
- How do you test and audit a contract before deployment?
- Storage versus memory versus calldata in Solidity?
Fundamentals
- Immutability: each block contains the previous block's hash, so changing history means redoing all subsequent blocks and outpacing the honest network.
- Consensus: proof of work secures the chain with computation; proof of stake with economically staked validators who can be penalised (slashed) for misbehaviour. Ethereum moved to proof of stake in 2022.
- Gas: the unit of computational cost; users pay gas × price. Reduce it by minimising storage writes (the most expensive operation), packing variables, using calldata for read-only inputs and avoiding unbounded loops.
- Data locations: storage is persistent and expensive; memory is temporary within a call; calldata is read-only input and cheapest.
Security: the heart of the interview
| Vulnerability | Defence |
|---|---|
| Reentrancy | Checks-effects-interactions, reentrancy guards, pull-over-push payments |
| Access control errors | Explicit role checks, least privilege, two-step ownership transfer |
| Front-running / MEV | Commit–reveal schemes, slippage limits, batch auctions |
| Oracle manipulation | Decentralised oracles, time-weighted prices, sanity bounds |
| Unchecked external calls | Check return values, handle failures |
| Denial of service via loops | Avoid unbounded iteration over user-controlled arrays |
Reentrancy is the classic question: a contract sends funds before updating its balance, and the recipient's fallback function calls back in to withdraw again. Updating state before external calls — checks, then effects, then interactions — prevents it. Solidity 0.8 and later revert on arithmetic overflow by default, so overflow questions now often test whether you know when unchecked blocks reintroduce the risk.
Upgrades, standards and scaling
Contracts are immutable, so upgradeability uses proxies that delegate calls to a replaceable implementation; the risks are storage layout collisions, initialiser bugs and centralised admin keys. ERC-20 defines fungible tokens (balances, transfers, allowances); ERC-721 defines non-fungible tokens with unique IDs. Layer 2 rollups execute transactions off the main chain and post compressed data back — optimistic rollups assume validity with a challenge window, zero-knowledge rollups post validity proofs.
Testing and auditing
- Unit tests for every function and revert condition.
- Fuzz and invariant testing to find unexpected states.
- Static analysis tools and a manual review checklist.
- Testnet deployment and, for significant value, an external audit and a bug bounty.
A typical interview loop
Expect a fundamentals screen, a smart contract coding exercise — often a token, an escrow or a simple marketplace — and a security review round where you're handed a vulnerable contract and asked to find the issues. Senior roles add protocol design discussions: incentive mechanisms, upgrade governance and how you'd respond to an exploit in production. Have one real incident or audit finding you can discuss, even from a public post-mortem you studied, because security judgement is the deciding factor in most loops.
Practising
Reading answers is not the same as saying them. Pick ten of the questions above and answer them aloud against a timer; a free AI interview assistant like CoPilot Interview can ask smart contract questions in a mock interview and flag answers that ran long or lacked an example. Walk through one contract you wrote line by line, explaining each security decision — interviewers often ask exactly that.
Disclosure: CoPilot Interview is our product, so weigh what we say about it accordingly. Everything else on this page applies whichever tool you use, or none.
Frequently asked questions
What questions are asked in a blockchain developer interview?
Consensus, transactions and gas, account types, Solidity data locations, vulnerabilities such as reentrancy and front-running, upgrade patterns, oracles, token standards, layer 2 rollups, and testing and auditing practice.
What is a reentrancy attack?
When a contract makes an external call before updating its state and the callee calls back into the contract, repeating an action such as a withdrawal. Updating state before external calls and using reentrancy guards prevent it.
How do you reduce gas costs?
Minimise storage writes, pack variables, use calldata for read-only parameters, avoid unbounded loops, and cache storage reads in memory within a function.
What is the difference between optimistic and ZK rollups?
Optimistic rollups assume transactions are valid and allow a challenge period for fraud proofs. Zero-knowledge rollups submit cryptographic validity proofs, enabling faster finality.
Practise on real interview questions
Run 145 real interview questions across 10 tracks, answer out loud and see a structured answer to compare with yours. Free, no signup.
Try a practice question