Blockchain developer interview questions for remote roles
Web3 interviews spend more time on security than almost any other developer interview. Expect Solidity and EVM questions, at least one "find the bug in this contract" exercise, gas optimisation, upgrade patterns and testing, plus a take-home contract task.
These are questions we see often in interviews for remote Solidity and blockchain roles.
Updated October 2026 by the WorkRemote careers team
On this page
About the role and your experience
Openers that check you understand the job and have done the work.
Tell me about a contract you wrote and how you made sure it was safe.
Why they ask
They want evidence of careful work.
How to answer
Describe the contract, your test approach, any tools used and what reviews it went through. Mention a bug you caught and how.
Have you taken part in audit contests or bug bounties?
Why they ask
Contest results are strong public evidence of security skill.
How to answer
Give platforms, findings and severity, with links if public. If you have not, say which audit reports you have studied and what you learned.
Technical questions
What you know and how you'd do the work, often with a live task or test.
What is a reentrancy attack, and how do you prevent it?
Why they ask
The best-known smart contract vulnerability. If you cannot explain it, the interview ends early.
How to answer
Reentrancy happens when a contract makes an external call, such as sending ETH, before updating its own state, and the receiver calls back into the contract to repeat the action, for example withdrawing again before the balance is set to zero. Prevent it with checks-effects-interactions (update state before external calls), a reentrancy guard such as OpenZeppelin's ReentrancyGuard, and pull-based payments. Mention read-only reentrancy and cross-function reentrancy too.
What is the difference between msg.sender and tx.origin, and why should you not use tx.origin for authorisation?
Why they ask
A classic access control trap.
How to answer
msg.sender is the immediate caller (an account or a contract). tx.origin is the externally owned account that started the transaction. If you authorise with tx.origin, a malicious contract the owner interacts with can call your contract and pass the check. Use msg.sender with proper access control.
Explain storage, memory and calldata.
Why they ask
Shows EVM understanding and affects gas costs.
How to answer
Storage is persistent contract state, written to the blockchain and expensive to write. Memory is temporary for the duration of a call and can be modified. Calldata is the read-only input data of an external call; using calldata for external function array and struct parameters avoids copying and saves gas.
How would you reduce the gas cost of a frequently called function?
Why they ask
Users pay for every operation, so gas matters.
How to answer
Cache storage reads in local variables, pack related small variables into one storage slot, use calldata for read-only parameters, use custom errors instead of revert strings, avoid unbounded loops, use immutable and constant where possible, and use unchecked blocks only where overflow is impossible. Measure with forge's gas reports before and after.
Does Solidity 0.8 still need SafeMath?
Why they ask
Checks you are current.
How to answer
No. From 0.8.0, arithmetic overflow and underflow revert by default. SafeMath is unnecessary. You can opt out with unchecked blocks for gas savings when you have proven overflow cannot happen, such as a loop counter bounded by an array length.
How do upgradeable proxies work, and what can go wrong?
Why they ask
Many protocols use proxies, and mistakes have caused major losses.
How to answer
A proxy holds the state and uses delegatecall to run logic from an implementation contract, so you can point it at a new implementation. In transparent proxies the upgrade logic lives in the proxy; in UUPS it lives in the implementation. Risks: storage layout collisions between versions, uninitialised implementations that an attacker can take over, forgetting to disable initialisers, and an upgrade function without proper access control.
Why is using a DEX pool's spot price as an oracle dangerous?
Why they ask
Price manipulation is behind many DeFi exploits.
How to answer
A spot price from an AMM pool can be moved within one transaction, often with a flash loan, then used to borrow or liquidate unfairly before the price is moved back. Use manipulation-resistant sources such as Chainlink price feeds or time-weighted average prices, check for stale data, and add sanity limits.
How do you prevent signature replay?
Why they ask
Signed messages (permits, meta-transactions, allowlists) are common and often implemented badly.
How to answer
Include a nonce that is consumed on use, a deadline, the chain ID and the contract address in the signed data, using EIP-712 typed data. Protect against signature malleability by using OpenZeppelin's ECDSA library. Never accept the same signature twice.
What is front-running, and how can a contract reduce its impact?
Why they ask
Transaction ordering is a reality on public chains.
How to answer
Because pending transactions are visible, others can submit transactions that execute before or after yours to profit, such as sandwiching a swap. Mitigations include slippage limits and deadlines on trades, commit-reveal schemes, batch auctions and private transaction relays.
How do you test a smart contract properly?
Why they ask
Testing is most of the work on a serious team.
How to answer
Unit tests for every function and revert path, fuzz tests that throw random inputs at functions, invariant tests that check properties always hold (for example, total deposits always equal the sum of balances), fork tests against mainnet state, static analysis with Slither, and an external audit before launch.
Show a sample answerHide the sample answer
On my vault project I wrote an invariant test in Foundry that the vault's total assets must always be at least the sum of what users can withdraw. The fuzzer found a rounding issue in withdraw that let a user take one extra wei per call. I changed the rounding to favour the vault, as ERC-4626 recommends, and the invariant held after 100,000 runs.
Here is a contract. Find the bugs.
Why they ask
Most web3 interviews include a live security review.
How to answer
Read the whole contract first, then go through systematically: access control on every state-changing function, external calls and reentrancy, arithmetic and rounding, use of tx.origin, unchecked return values, oracle use, initialisation and upgrade paths, and denial of service through unbounded loops. Explain severity and a fix for each issue.
Behavioural questions
Past situations. Answer with a real example: what happened, what you did, what changed.
How do you decide whether a web3 project is worth joining?
Why they ask
Good teams want people who think about legitimacy and risk.
How to answer
Check the team's public history, funding, audits, whether pay is in dollars or stablecoins rather than only tokens, and how they handle security. It shows maturity.
Situational questions
Hypotheticals about problems you'd meet in the job.
A bug is found in a live contract holding user funds. What do you do?
Why they ask
Incident response is high-stakes in web3.
How to answer
Follow the team's incident plan: confirm the issue quietly, pause the contract if it has a pause function, coordinate with the team and security partners, avoid publishing details before funds are safe, then fix, communicate clearly with users and write a public post-mortem.
Remote work questions
How you'll work from Nigeria with a team elsewhere: hours, power, internet, communication.
How do you keep your machine and keys secure while working remotely?
Why they ask
Compromised developer machines have led to major hacks.
How to answer
Hardware wallet for anything real, separate machines or VMs for untrusted code, no private keys in .env files on your laptop, multisig for deployments, two-factor authentication everywhere, and caution with unsolicited files and links.
Show a sample answerHide the sample answer
I keep deployment keys on a hardware wallet and the team uses a Safe multisig for anything on mainnet. Any code from outside the team runs in a disposable VM first. After seeing two friends in Lagos lose wallets to fake interview repos, I do not run anything from a recruiter until I have read every script in package.json.
How do you work with a team spread across many time zones?
Why they ask
Web3 teams are often spread across the world.
How to answer
Clear specs and pull requests, written decisions, recorded calls for those who miss them, and agreeing core overlap hours. Lagos time overlaps well with Europe and partly with both the US and Asia.
Remote interview tips
Treat every web3 interview as a security test of you, too. Do not run code from a recruiter before you have verified the company, and never connect a wallet holding real funds during an interview.
For live security reviews, read the whole contract before commenting, then go through it in a fixed order out loud. Interviewers want to see your method.
Have your Foundry setup working with a forked mainnet test ready to show; it impresses more than slides.
Questions people ask
What is a typical blockchain developer take-home test?
Writing a small contract (a staking, vesting or escrow contract) with Foundry tests, or reviewing a contract and writing up the bugs you find. Expect four to eight hours.
Do web3 interviews ask about data structures and algorithms?
Less often than big tech. They focus on Solidity, the EVM, security and testing. Some ask general coding questions in TypeScript or Rust.
How do I prepare for a smart contract security interview?
Study public audit reports and post-mortems of past hacks, practise finding bugs in intentionally vulnerable contracts, and work through the security sections of Cyfrin Updraft.
Updated October 2026 by the WorkRemote careers team
Interview questions for roles close to blockchain developer
- Backend Developer
A backend developer builds the servers, APIs, databases and background jobs that apps run on, typically in Node.js, Python, Go, Java or C#. Nigerian backend developers are hired remotely by foreign companies, especially those with fintech or payments experience, though most remote roles want two or more years of production work.
- Full Stack Developer
A full stack developer builds both the user interface and the server side of a product, often React or Next.js on the front and Node.js, Python, Laravel or Rails behind it with a SQL database. Startups hiring remotely like full stack developers because one person can ship a whole feature, and many Nigerians land remote work this way after a few years at an agency or startup.
- Cybersecurity Analyst
A cybersecurity analyst watches an organisation's systems for attacks, investigates suspicious alerts and helps contain incidents, usually from a security operations centre (SOC). Remote SOC work from Nigeria is possible, mostly through managed security providers and private companies, but many security jobs abroad require citizenship, security clearance or local background checks, and entry-level remote roles are scarce.
- Software Engineer
A software engineer designs, writes, tests and maintains the code behind products, and it is one of the remote jobs Nigerians most often get with foreign companies. Entry-level remote roles are rare, so most people get their first two years of experience locally or through freelance work before landing a dollar-paid contract.