# Web3 Interview Questions with Answers 12 Web3 interview questions, each with a model answer, the points to cover, common mistakes and the follow-ups interviewers ask. _Source: Astra (https://useastra.in). Updated 2026-09-05._ ### 1. Explain the difference between 'Proof of Work' (PoW) and 'Proof of Stake' (PoS). Proof of Work (PoW): Miners solve complex mathematical puzzles (hashing) to validate transactions. It is energy-intensive but highly secure (e.g., Bitcoin). Proof of Stake (PoS): Validators are chosen to create blocks based on the amount of crypto they hold and 'stake'. It is energy-efficient and allows for greater scalability (e.g., Ethereum post-Merge). Key Difference: PoW uses energy as the scarcity mechanism; PoS uses capital. **Points a strong answer covers:** - PoW: hash-race, energy-secured - PoS: stake + slashing-secured - Different attack economics + finality styles **Common mistakes:** - Energy-only comparison **Likely follow-ups:** - What replaced miners' sunk cost in PoS security? **What the interviewer is assessing:** - Consensus fundamentals. ### 2. What is the 'EVM' (Ethereum Virtual Machine), and why is it sandboxed? The EVM is the runtime environment for smart contracts in Ethereum. It is a quasi-Turing complete machine. Sandboxed: It is isolated from the main network, filesystem, or other processes on the node. This ensures that if a smart contract contains malicious code or crashes, it does not bring down the entire node or the blockchain network. **Points a strong answer covers:** - EVM: deterministic bytecode executor all nodes replicate - Sandboxed: no network/disk/host access -- consensus safety - Gas bounds execution **Common mistakes:** - Sandbox reason unstated **Likely follow-ups:** - What would nondeterminism do to consensus? **What the interviewer is assessing:** - Runtime-isolation understanding. ### 3. In Solidity, what is the difference between memory, storage, and calldata? These are data locations. 1. Storage: Persistent data stored on the blockchain (expensive). State variables use this by default. 2. Memory: Temporary data used during function execution (cheaper). It is erased after the function runs. 3. Calldata: Non-modifiable, temporary area where function arguments are stored. It is the cheapest location and is required for external function parameters. **Points a strong answer covers:** - storage: persistent, expensive - memory: per-call scratch - calldata: read-only args, cheapest **Common mistakes:** - Gas dimension missing **Likely follow-ups:** - When must you copy calldata to memory? **What the interviewer is assessing:** - Solidity data-location precision. ### 4. What is a 'Reentrancy Attack', and how do you prevent it? A Reentrancy Attack occurs when a malicious contract calls back into the victim contract before the first function execution is finished, potentially draining funds (e.g., The DAO hack). Prevention: 1. Checks-Effects-Interactions Pattern: Always update the state (balances) before sending Ether. 2. ReentrancyGuard: Use a mutex modifier (like OpenZeppelin's nonReentrant) to lock the function during execution. **Points a strong answer covers:** - External call before state update -> recursive drain - Checks-effects-interactions + ReentrancyGuard - Pull payments over push **Common mistakes:** - Guard-only answers **Likely follow-ups:** - Cross-function reentrancy -- how? **What the interviewer is assessing:** - Security-pattern mastery. ### 5. Explain the concept of 'Gas' in Ethereum. Why is it necessary? Gas is a unit that measures the computational effort required to execute specific operations on the EVM. Necessity: 1. Resource Allocation: It prevents spam by making transactions cost money. 2. Halting Problem: It prevents infinite loops. Every transaction has a 'gas limit'; if the code runs out of gas, the execution reverts, ensuring the network doesn't freeze. **Points a strong answer covers:** - Gas: per-opcode computation pricing - Stops infinite loops/spam; compensates validators - Fee = gas used x gas price **Common mistakes:** - No resource-metering framing **Likely follow-ups:** - Why do storage writes cost most? **What the interviewer is assessing:** - EVM-economics basics. ### 6. What is the difference between view and pure functions in Solidity? View: The function promises not to modify the state, but it can read from the state (e.g., checking a balance). Pure: The function promises not to read or modify the state. It only uses local variables or arguments passed to it (e.g., a math calculation like add(a, b)). Both are free to call externally (no gas) but cost gas if called internally by another transaction. **Points a strong answer covers:** - view reads state; pure touches nothing - Both free via RPC calls - Compiler-enforced promises **Common mistakes:** - Confusing the two **Likely follow-ups:** - Pure function reading block.timestamp -- allowed? **What the interviewer is assessing:** - Language-detail check. ### 7. What is an ERC-20 token? Describe its core functions. ERC-20 is the technical standard for fungible tokens on Ethereum. Core Functions: 1. totalSupply(): Total tokens in existence. 2. balanceOf(account): Returns token balance of an address. 3. transfer(to, amount): Moves tokens from caller to another address. 4. approve() and transferFrom(): Used for allowing third parties (like DEXs) to spend tokens on your behalf. **Points a strong answer covers:** - Fungible token standard: balanceOf, transfer, approve/transferFrom, allowance - Approve/allowance enables DEX/contract spending - Known footguns: approve race, fee-on-transfer tokens **Common mistakes:** - Core functions unnamed **Likely follow-ups:** - Why approve before swap -- and infinite approvals risk? **What the interviewer is assessing:** - Token-standard working knowledge. ### 8. What is the difference between transfer, send, and call when sending Ether? 1. transfer: Throws an error on failure and has a fixed gas limit of 2300 (prevents reentrancy). 2. send: Returns a boolean (false) on failure instead of reverting. Also has a 2300 gas limit. 3. call: The recommended method. Returns a boolean and data. It forwards all available gas (unless specified) and is vulnerable to reentrancy if not handled correctly. Syntax: (bool sent, ) = _to.call{value: msg.value}(""); **Points a strong answer covers:** - transfer/send: 2300 gas stipend, brittle post-repricing - call{value:}: forward gas, check success -- current standard - Reentrancy care with call **Common mistakes:** - Recommending transfer() today **Likely follow-ups:** - Why did transfer() break after EIP-1884? **What the interviewer is assessing:** - Ether-transfer currency. ### 9. What are 'Events' in Solidity, and why are they used? Events allow smart contracts to log data to the blockchain, which can be listened to by frontend applications (using Web3.js or Ethers.js). Why used: 1. Cheaper Storage: Storing data in events (logs) is much cheaper than storing it in contract storage. 2. Triggers: They act as triggers to update the UI when a transaction is confirmed (e.g., 'Token Minted'). **Points a strong answer covers:** - Events: indexed logs for off-chain apps - Cheap vs storage; UI/indexer backbone - Not readable on-chain **Common mistakes:** - Events-as-state misuse **Likely follow-ups:** - Design event schema for a marketplace **What the interviewer is assessing:** - Dapp-integration pragmatics. ### 10. Explain the concept of a 'Merkle Tree' and its importance in blockchain. A Merkle Tree is a data structure where every leaf node is a hash of a block of data, and every non-leaf node is a hash of its children. Importance: 1. Efficiency: It allows 'Light Clients' to verify a specific transaction is included in a block without downloading the entire blockchain (Merkle Proof). 2. Integrity: Changing one transaction changes the Root Hash, invalidating the block. **Points a strong answer covers:** - Pairwise hashing to a root; inclusion proofs O(log n) - Light clients + airdrop claims (merkle proofs) - Root on-chain, data off-chain **Common mistakes:** - No proof-use case **Likely follow-ups:** - Merkle airdrop -- why cheaper than storing a list? **What the interviewer is assessing:** - Efficient-verification insight. ### 11. What is delegatecall and how does it differ from a regular call? delegatecall is a low-level function that executes code in another contract but uses the storage, balance, and address of the calling contract. Usage: It is the backbone of Proxy Patterns (upgradable contracts). The logic is in the 'Implementation' contract, but the state remains in the 'Proxy' contract. **Points a strong answer covers:** - delegatecall: callee code, caller storage/context - Proxy/upgrade machinery - Risks: layout collision, uninitialized implementations **Common mistakes:** - Context inheritance unexplained **Likely follow-ups:** - Wormhole/Parity bugs -- which class? **What the interviewer is assessing:** - Upgrade-pattern depth. ### 12. What is the role of an 'Oracle' in blockchain? Blockchains are isolated systems; they cannot access external data (API calls, weather, stock prices). An Oracle (like Chainlink) acts as a bridge. It fetches off-chain data and pushes it on-chain via a transaction so smart contracts can use it. Decentralized Oracles are preferred to avoid a single point of failure. **Points a strong answer covers:** - Oracles feed external data on-chain - Trust problem: garbage in = consensus garbage - Decentralized feeds, medianizers, heartbeat/deviation updates **Common mistakes:** - Single-source oracle acceptance **Likely follow-ups:** - Design a manipulation-resistant price feed **What the interviewer is assessing:** - Data-trust architecture. Full topic: https://useastra.in/interview-questions/topic/web3