Access control patterns in Blockchain / Solidity - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Solidity contract function?

Consider the following Solidity contract snippet that implements a simple role-based access control. What will be the output when checkAccess is called by address 0x123?

Blockchain / Solidity

pragma solidity ^0.8.0;

contract AccessControl {
    mapping(address => bool) public admins;

    constructor() {
        admins[msg.sender] = true;
    }

    function checkAccess(address user) public view returns (string memory) {
        if (admins[user]) {
            return "Access granted";
        } else {
            return "Access denied";
        }
    }
}

A "Access granted"

B "Access denied"

C Compilation error

D Runtime error

💡 Hint

Remember that only the contract deployer is set as admin in the constructor.

The constructor sets msg.sender as admin. Since 0x123 is not the deployer, admins[0x123] is false, so the function returns "Access denied".

🧠 Conceptual

intermediate

Which access control pattern is demonstrated by this smart contract snippet?

This contract uses a mapping of addresses to booleans to control who can call certain functions. What is this pattern called?

Blockchain / Solidity

mapping(address => bool) private whitelist;

function addToWhitelist(address user) public onlyOwner {
    whitelist[user] = true;
}

modifier onlyWhitelisted() {
    require(whitelist[msg.sender], "Not whitelisted");
    _;
}

A Capability-based access control

B Role-based access control

C Whitelist access control

D Discretionary access control

💡 Hint

Think about the list of allowed users explicitly stored.

This pattern uses a whitelist, a list of allowed addresses, to control access. Only addresses in the whitelist can call protected functions.

🔧 Debug

advanced

Why does this smart contract fail to restrict access properly?

Examine the following Solidity code. Why can anyone call restrictedFunction even though it is supposed to be restricted?

Blockchain / Solidity

pragma solidity ^0.8.0;

contract FaultyAccess {
    address public owner;

    constructor() {
        owner = msg.sender;
    }

    modifier onlyOwner() {
        require(owner == msg.sender);
        _;
    }

    function restrictedFunction() public onlyOwner {
        // restricted logic
    }

    function changeOwner(address newOwner) public {
        owner = newOwner;
    }
}

A Anyone can call changeOwner and set themselves as owner, bypassing restriction

B The constructor does not set the owner correctly

C The modifier onlyOwner is missing a revert message, so it does not revert on failure

D The restrictedFunction is not marked as public

💡 Hint

Check who can call changeOwner and what it does.

The changeOwner function is public and unprotected, so anyone can call it to become the owner. This breaks the access control.

📝 Syntax

advanced

Which option correctly implements a modifier to restrict access to an admin role?

Choose the correct Solidity code snippet that defines a modifier onlyAdmin which restricts function access to addresses marked as admins in a mapping.

A

modifier onlyAdmin() {
    if (!admins[msg.sender]) {
        revert("Not admin");
    }
}

B

modifier onlyAdmin() {
    if (admins[msg.sender]) {
        _;
    } else {
        revert("Not admin");
    }
}

C

modifier onlyAdmin() {
    require(admins[msg.sender] == true);
}

D

modifier onlyAdmin() {
    require(admins[msg.sender], "Not admin");
    _;
}

💡 Hint

Modifiers must include _; to continue execution.

Option D correctly uses require with a message and includes _; to continue function execution. Option D is valid but less common. Option D lacks _;. Option D lacks _; and will block all calls.

🚀 Application

expert

How many addresses have access after running this smart contract code?

Given the following Solidity contract, how many addresses will have access after deploying and calling grantAccess three times with different addresses?

Blockchain / Solidity

pragma solidity ^0.8.0;

contract MultiAccess {
    mapping(address => bool) private accessList;

    function grantAccess(address user) public {
        accessList[user] = true;
    }

    function hasAccess(address user) public view returns (bool) {
        return accessList[user];
    }
}

A 3

B 0

C 1

D Cannot determine without knowing the addresses

💡 Hint

Each call to grantAccess sets one address to true in the mapping.

Each call to grantAccess adds one address to the accessList. After three calls with different addresses, three addresses have access.