Withdrawal patterns in Blockchain / Solidity - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Understanding withdrawal pattern output

What is the output of this Solidity contract snippet when calling withdraw() after depositing 5 ether?

Blockchain / Solidity

pragma solidity ^0.8.0;

contract Withdrawal {
    mapping(address => uint) public balances;

    function deposit() public payable {
        balances[msg.sender] += msg.value;
    }

    function withdraw() public {
        uint amount = balances[msg.sender];
        require(amount > 0, "No balance to withdraw");
        (bool success, ) = msg.sender.call{value: amount}("");
        require(success, "Transfer failed");
        balances[msg.sender] = 0;
    }
}

A The contract runs out of gas and reverts

B The contract throws an error because balances[msg.sender] is not updated before transfer

C The user balance remains 5 ether after withdrawal

D The user receives 5 ether and their balance resets to 0

💡 Hint

Think about the order of state update and transfer in the withdrawal function.

The contract sends the ether first and then sets the user's balance to zero. Since the transfer is done via call and the balance is reset after, the user receives the full amount and the balance is cleared.

🧠 Conceptual

intermediate

Why use withdrawal pattern in smart contracts?

Which of the following best explains why the withdrawal pattern is recommended over direct transfers in smart contracts?

A It prevents reentrancy attacks by letting users withdraw funds themselves

B It reduces gas costs by batching transfers automatically

C It allows contracts to send ether to multiple users simultaneously

D It guarantees instant transfer of ether without delays

💡 Hint

Think about security risks when sending ether directly.

Withdrawal pattern avoids reentrancy attacks by letting users pull their funds instead of contracts pushing funds directly, which can trigger malicious fallback functions.

🔧 Debug

advanced

Identify the bug in this withdrawal pattern implementation

What is the main bug in this Solidity withdrawal function?

Blockchain / Solidity

function withdraw() public {
    uint amount = balances[msg.sender];
    require(amount > 0, "No balance");
    (bool sent, ) = msg.sender.call{value: amount}("");
    require(sent, "Failed to send Ether");
    balances[msg.sender] = 0;
}

A The call method is deprecated and should use transfer instead

B The balance is set to zero after sending ether, risking reentrancy attack

C The function does not check if msg.sender is a contract

D The require statement should be after setting balance to zero

💡 Hint

Consider what happens if the recipient is a contract with fallback code.

Setting the balance to zero after sending ether allows a malicious contract to reenter the withdraw function before balance is cleared, draining funds.

📝 Syntax

advanced

Which option correctly implements a safe withdrawal pattern?

Choose the correct Solidity code snippet that safely implements the withdrawal pattern preventing reentrancy.

A

function withdraw() public {
    uint amount = balances[msg.sender];
    require(amount > 0);
    balances[msg.sender] = 0;
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
}

B

function withdraw() public {
    uint amount = balances[msg.sender];
    require(amount > 0);
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
    balances[msg.sender] = 0;
}

C

function withdraw() public {
    uint amount = balances[msg.sender];
    balances[msg.sender] = 0;
    (bool success, ) = msg.sender.transfer(amount);
    require(success);
}

D

function withdraw() public {
    uint amount = balances[msg.sender];
    require(amount > 0);
    balances[msg.sender] = 0;
    msg.sender.transfer(amount);
}

💡 Hint

Remember to update state before external calls and use recommended call syntax.

Option A sets the balance to zero before calling external address, preventing reentrancy. It uses call with require to check success, which is the recommended pattern.

🚀 Application

expert

Calculate total withdrawn after multiple withdrawals

Given this contract snippet, what is the total ether withdrawn by user after calling withdraw() twice, assuming deposit() was called once with 3 ether?

Blockchain / Solidity

pragma solidity ^0.8.0;

contract Withdrawal {
    mapping(address => uint) public balances;

    function deposit() public payable {
        balances[msg.sender] += msg.value;
    }

    function withdraw() public {
        uint amount = balances[msg.sender];
        require(amount > 0, "No balance");
        balances[msg.sender] = 0;
        (bool success, ) = msg.sender.call{value: amount}("");
        require(success, "Transfer failed");
    }
}

A 0 ether

B 6 ether

C 3 ether

D Reverts on second withdrawal

💡 Hint

Consider the balance after the first withdrawal and what happens on the second call.

After the first withdrawal, the balance is set to zero. The second withdrawal call fails the require check and reverts, so total withdrawn is 3 ether.