40 Blockchain Developer Interview Questions (With Answers)

These 40 questions are organized by seniority level and cover the technical depth you should expect from qualified blockchain developers. Each question includes what a strong answer should cover.

Junior Developer Questions (0–2 Years)

1. What is a smart contract?

Strong answer: Self-executing code stored on the blockchain. Once deployed, it runs deterministically without a trusted third party. The candidate should mention immutability and the tradeoffs it creates.

2. What is gas in Ethereum?

Strong answer: The fee paid to validators for computational work. Each EVM opcode has a fixed gas cost. Transactions have a gas limit and a gas price (in gwei). The candidate should understand that gas protects the network from infinite loops.

3. What's the difference between memory and storage in Solidity?

Strong answer: Storage is persistent on-chain and expensive (~20,000 gas for a new slot write). Memory is temporary, exists only during function execution, and is cheaper. Calldata is read-only and cheapest for function arguments.

4. What is ABI and why does it matter?

Strong answer: Application Binary Interface — the standard way to interact with a smart contract from outside. It defines function signatures, parameter types, and return types. Without the ABI, you can't call a contract's functions correctly.

5. What is an ERC-20 token?

Strong answer: A standard interface for fungible tokens on Ethereum. Defines functions like transfer, approve, allowance, totalSupply. Standardization allows DEXes, wallets, and other contracts to interact with any compliant token without custom code.

6. What are events in Solidity and when would you use them?

Strong answer: Events emit logs that are stored on the blockchain but not accessible by contracts. They're cheap and used for: notifying the frontend of state changes, enabling off-chain indexing (via The Graph), and providing a historical audit trail.

7. What is the difference between a public and external function?

Strong answer: External functions can only be called from outside the contract (including via call), while public functions can be called internally too. For functions that will only be called externally, external is more gas-efficient because arguments are read from calldata rather than copied to memory.

8. What is a wallet address and how is it derived?

Strong answer: An Ethereum address is the last 20 bytes of the Keccak-256 hash of the public key, which is derived from the private key using ECDSA. The candidate should understand that the private key controls the address — losing it means losing access permanently.

9. What is a testnet?

Strong answer: A test blockchain that mirrors mainnet functionality but uses worthless test tokens. Used for development and testing before deploying to mainnet. Examples: Sepolia, Holesky for Ethereum; devnet for Solana.

10. Explain the Checks-Effects-Interactions pattern.

Strong answer: A pattern to prevent reentrancy attacks. First: check all conditions (require statements). Second: update all internal state. Third: interact with external contracts. This ensures that if an external call triggers a reentrant call, the state is already updated and the attacker can't exploit it.

Mid-Level Developer Questions (2–5 Years)

11. Explain how reentrancy attacks work and how to prevent them.

Strong answer: A reentrancy attack occurs when an external call (e.g., ETH transfer) triggers the attacker's fallback/receive function, which calls back into the victim contract before state is updated. The 2016 DAO hack exploited this. Prevention: Checks-Effects-Interactions pattern, ReentrancyGuard modifier, or only using send/transfer (deprecated — now prefer call with explicit guards).

12. What is the difference between call, delegatecall, and staticcall?

Strong answer: call — executes in the context of the called contract, state changes affect the callee. delegatecall — executes the called contract's code in the caller's context (same storage, msg.sender, msg.value). Used in proxy patterns. staticcall — read-only call that reverts on any state modification. The candidate should understand that delegatecall storage collisions are a major security risk.

13. How do proxy contracts work?

Strong answer: Proxy contracts use delegatecall to forward function calls to an implementation (logic) contract. The proxy stores state; the implementation provides logic. This enables upgradeability. Common patterns: Transparent Proxy (OpenZeppelin), UUPS, Beacon Proxy. Key risk: storage slot collision between proxy and implementation.

14. What is a flash loan and what risks does it introduce?

Strong answer: An uncollateralized loan that must be repaid within the same transaction. If not repaid, the entire transaction reverts. Legitimate uses: arbitrage, collateral swaps, liquidations. Security concern: flash loans can temporarily give an attacker massive capital to manipulate price oracles, governance votes, or liquidity.

15. Explain how Merkle trees are used in blockchain.

Strong answer: Merkle trees allow efficient and secure verification of large data sets. In Ethereum, transaction and state data is organized as Merkle Patricia Tries. Common DeFi use: Merkle proofs for allowlists (whitelist minting). The root is stored on-chain; individual proofs are verified cheaply without storing all addresses.

16. What is MEV (Maximal Extractable Value)?

Strong answer: Value that can be extracted by reordering, including, or excluding transactions within a block. Searchers use bots to front-run, back-run, or sandwich transactions. MEV can harm regular users (worse execution prices). Countermeasures: MEV blockers, commit-reveal schemes, Flashbots SUAVE for transaction privacy.

17. How do AMMs work?

Strong answer: Automated Market Makers use mathematical formulas to price assets rather than order books. Uniswap v2 uses the constant product formula (x * y = k). Liquidity providers deposit token pairs and earn fees but face impermanent loss when prices diverge. Uniswap v3 introduced concentrated liquidity.

18. What is impermanent loss?

Strong answer: The opportunity cost liquidity providers face when token prices change relative to when they deposited. If you deposit ETH/USDC and ETH price rises, you'd have done better just holding ETH. The 'loss' is 'impermanent' because it can recover if prices return to deposit ratios, but becomes permanent on withdrawal.

19. Explain how Chainlink oracles work.

Strong answer: Chainlink uses a decentralized network of nodes that fetch off-chain data, aggregate it, and report on-chain. Data feeds are updated when prices deviate beyond a threshold (deviation threshold) or after a heartbeat period. Multiple node operators prevent single points of failure. Smart contracts read the aggregator contract for the latest price.

20. What is the difference between L1 and L2 scaling?

Strong answer: L1 scaling (sharding, larger blocks) increases base chain capacity but involves tradeoffs. L2 scaling (rollups) processes transactions off-chain and posts compressed data or proofs to L1 for security. Optimistic rollups (Arbitrum, Optimism) assume validity and use fraud proofs. ZK rollups (StarkNet, zkSync) use cryptographic proofs. L2s inherit L1 security but introduce withdrawal delays.

21. How do you write gas-efficient Solidity?

Strong answer: Use uint256 over smaller types in most cases (EVM word size). Pack storage variables (multiple variables in one slot). Use immutable and constant for values set once. Cache storage reads in memory within loops. Avoid dynamic arrays in storage when possible. Use custom errors instead of strings. Short-circuit boolean expressions. Use unchecked blocks for safe arithmetic.

22. What is EIP-1559 and how does it affect gas pricing?

Strong answer: EIP-1559 introduced a base fee (algorithmically set, burned) and a tip (priority fee, paid to validators). Users set a max fee per gas and a max priority fee. If max fee > base fee, the transaction is included. This made gas pricing more predictable and reduced ETH supply via fee burning. The candidate should understand that they still need to set appropriate tip values for timely inclusion.

23. Explain the Solidity inheritance model.

Strong answer: Solidity supports multiple inheritance using C3 linearization. Order matters — the most derived contract is first, most base is last in the MRO. Conflicts between inherited functions must be explicitly overridden. Virtual functions and override keyword are required. The candidate should know about diamond inheritance risks and the OpenZeppelin pattern for avoiding them.

24. What is front-running and how can you mitigate it?

Strong answer: Front-running occurs when a validator or mempool observer sees a pending transaction and submits their own transaction with a higher gas price to execute first. Common in DEX trades, NFT mints, and auctions. Mitigations: commit-reveal schemes, MEV-protected RPCs (Flashbots Protect), minimum price impacts, private mempools.

25. What testing frameworks do you use and how do you structure tests?

Strong answer: Hardhat with ethers.js or Foundry (Forge). Foundry is preferred for pure Solidity tests and fuzzing. Structure: unit tests (individual functions), integration tests (multi-contract interactions), and fork tests (test against mainnet state). Aim for 100% branch coverage. The candidate should mention fuzz testing and invariant testing.

Senior Developer Questions (5+ Years)

26. How do you approach designing a smart contract system from scratch?

Strong answer: Start with threat modeling — what's the worst case if each function is abused? Define the trust model: who controls what? Design storage layout before writing functions. Minimize state, prefer immutability. Separate concerns (logic contracts, storage contracts, access control). Plan upgrade path before deployment. Get the spec reviewed by a security researcher before writing code.

27. Explain formal verification and when it's appropriate.

Strong answer: Formal verification uses mathematical proofs to verify that code satisfies a specification. Tools: Certora Prover, Halmos, hevm. Appropriate for: high-value DeFi protocols where a bug could cost hundreds of millions, core protocol invariants (token supply never exceeds max, positions always solvent). Not appropriate for: early-stage code, rapidly changing specs. Expensive but increasingly standard for top DeFi protocols.

28. What are the risks of using delegatecall in a proxy pattern?

Strong answer: Storage collision — if the proxy and implementation define storage variables in the same slots, they overwrite each other. Uninitialized implementation — if the implementation can be initialized directly, attackers can take control. Function selector clashes — if a proxy admin function has the same selector as an implementation function. The candidate should know about EIP-1967 storage slots for mitigating these.

29. How do you design a tokenomics model?

Strong answer: Start with the economic goal — what behavior are you incentivizing? Model supply (total, circulating, emission schedule) and demand (utility, governance, fee accrual). Avoid hyperinflationary models where emissions outpace demand. Consider: vesting schedules, lockups, decay curves, protocol-owned liquidity. Test economic assumptions with agent-based simulations before launch.

30. Explain ZK proofs at a high level and how they're used in blockchain.

Strong answer: Zero-knowledge proofs allow proving knowledge of information without revealing the information itself. In blockchain: ZK rollups use SNARKs or STARKs to prove correct execution of many transactions, posting only the proof to L1. This gives Ethereum-level security with L2 throughput. Also used for privacy (Zcash, Tornado Cash pattern), identity verification, and credential systems.

31. How do cross-chain bridges work and what are their security risks?

Strong answer: Bridges lock or burn assets on the source chain and mint or release equivalents on the destination chain. Models: multisig relayers (most common, most hacked), optimistic bridges (fraud proofs), ZK bridges (most secure, most expensive). Largest exploits in crypto history have targeted bridges — the Ronin hack ($625M), Wormhole ($320M), Nomad ($190M). Risk comes from the off-chain components and multisig key security.

32. What is EIP-4337 (account abstraction) and what does it enable?

Strong answer: EIP-4337 introduces smart contract wallets without changing the consensus layer. UserOperations are submitted to a separate mempool, bundled by Bundlers, and executed by an EntryPoint contract. This enables: gas sponsorship (paymasters pay gas for users), social recovery, session keys, multi-sig on a single account, and arbitrary signature schemes. Major UX improvement for onboarding non-crypto-native users.

33. How do you plan for and manage a smart contract audit?

Strong answer: Prepare documentation — natspec comments on all functions, architecture diagrams, list of known issues. Freeze the codebase during the audit. Provide a testing environment. After the report: triage findings by severity (critical/high/medium/low/informational). Fix criticals and highs before deployment. Request a re-audit of changed code. Budget for 2–3 weeks of audit time plus 1–2 weeks for remediation.

34. Explain the UUPS upgrade pattern and how it differs from transparent proxy.

Strong answer: UUPS (Universal Upgradeable Proxy Standard) puts the upgrade function in the implementation contract, not the proxy. This means the proxy is simpler and cheaper to deploy. Risk: if you deploy an implementation without the upgrade function, you lose upgradeability permanently. Transparent Proxy keeps upgrade logic in the proxy and uses admin slot to route calls, but is more expensive. UUPS is now generally preferred.

35. How do you approach incident response for a deployed protocol?

Strong answer: Pre-plan: guardian/pause functionality, communication channels (Discord, Twitter, security email), list of whitehat contacts. During incident: activate pause if available, notify users on all channels, reach out to security researchers. Investigation: fork the chain state, reproduce the exploit in a local environment, quantify exposure. Recovery: if funds are recoverable (whitehats found the vector first), negotiate return. Deploy patched version. Post-mortem within 48 hours.

36. What is the oracle problem and how do protocols address it?

Strong answer: Smart contracts can't natively access off-chain data. If price data comes from a single source, it can be manipulated. Solutions: Chainlink decentralized data feeds (most common), TWAP from AMMs (resistant to flash loan manipulation but has lag), Pyth Network (pull-based, low latency), Redstone (append-only calldata model). The candidate should understand that on-chain AMM spot prices are easily manipulated and TWAPs should be preferred for price-sensitive operations.

37. How does The Graph work and when would you use it?

Strong answer: The Graph is a decentralized indexing protocol. You define a Subgraph — which contracts and events to index, and how to transform event data into entities. Indexer nodes process events and store the data, making it queryable via GraphQL. Use when: you need complex queries across historical events, you're building a frontend that needs to show historical data, or you need aggregations. Alternative: simple event logs via eth_getLogs for simple use cases.

38. What is a DAO and how are voting mechanisms typically implemented?

Strong answer: Decentralized Autonomous Organization — a governance structure where token holders vote on protocol decisions. Voting mechanisms: simple token-weighted voting (plutocratic, susceptible to whale dominance), quadratic voting (vote weight = sqrt of tokens, more democratic), time-weighted voting (longer lock = more weight). Governor Bravo / OpenZeppelin Governor is the standard implementation. Key risks: low participation, flash loan attacks on governance, vote-buying.

39. Explain EIP-712 and why it matters for signing.

Strong answer: EIP-712 defines a standard for structured data signing. Before EIP-712, users signed raw hex strings they couldn't read. EIP-712 lets wallets display human-readable information about what they're signing — domain, type, and field values. This is used for: permit (gasless ERC-20 approvals), off-chain order books (OpenSea, Uniswap), meta-transactions. Protects users from signing malicious opaque payloads.

40. What are the key differences between developing for EVM chains vs. Solana?

Strong answer: Solana uses an account model where programs (contracts) are stateless — all state lives in separate account data. Programs are written in Rust (or C), and Anchor is the primary framework. Solana's execution model is parallel (Sealevel), unlike Ethereum's sequential execution. Key differences: Solana has no global mempool, rent model for storage, and accounts must be pre-allocated. Security model differs significantly — common Ethereum vulnerabilities don't apply, but Solana has its own attack surface (account confusion, missing signer checks).