Top 40 Solidity Interview Questions (With Answers)

TL;DR

• These 40 Solidity interview questions cover basics, security, gas, the EVM and process
• Security carries the most weight, expect 30 to 40 percent of technical time there
• Most loops run 3 to 5 rounds including a paid or timed challenge
• Strong answers name tradeoffs, not just definitions

Solidity interview questions in 2026 cluster into five areas: language basics, security, gas optimization, EVM internals and practical engineering process. Interviewers weight security hardest because exploits cost real money, and the strongest candidates explain tradeoffs rather than recite definitions. Below are the 40 questions that come up most, each with a concise answer you can build on.

Use this as a checklist rather than a script. Rehearsed answers collapse under follow ups, so aim to reach the point where you could defend each answer in a live code review. While you prep, browse web3 jobs to see which employers are running Solidity loops right now.

Pair this with behavioral prep too. Technical excellence gets you to the final round, and communication closes it.

What Solidity basics should you have cold?

1. What is the difference between storage, memory and calldata? Storage persists onchain and costs the most, memory is temporary within a call and calldata is read only input data, the cheapest place for external function arguments.
2. What do the visibility keywords mean? Public is callable by anyone, external only from outside the contract, internal from the contract and its children and private from the defining contract alone.
3. What is the difference between constant and immutable? Constant values are fixed at compile time. Immutable values are set once in the constructor, then baked into the deployed bytecode.
4. What are events and why use them? Events write logs that offchain apps can index cheaply. They are the standard way to signal state changes without paying for extra storage.
5. What is a modifier? A reusable code wrapper around functions, most often for access control like onlyOwner, executing checks before or after the function body.
6. What is the difference between fallback and receive? Receive runs on plain ether transfers with empty calldata. Fallback runs when no function matches the call or when receive does not exist.
7. How do mappings work and what are their limits? Mappings hash keys to storage slots for constant time lookup. They cannot be iterated or sized, so you track keys separately if you need enumeration.
8. What does payable do? It allows a function or address type to receive ether. Without it, value bearing calls revert.
9. What is the difference between require, revert and assert? Require validates inputs and conditions with refunded remaining gas, revert does the same with custom errors and assert checks invariants that should never fail.
10. What happens during contract inheritance with the same function name? Solidity uses C3 linearization. You mark parents virtual and children override, and super walks the inheritance chain in order.

Which security questions decide the interview?

1. Explain reentrancy and how to prevent it. A malicious contract reenters your function mid execution through an external call. Prevent it with the checks effects interactions pattern, reentrancy guards and pull based withdrawals.
2. What is the checks effects interactions pattern? Validate conditions first, update state second and make external calls last, so reentrant calls always see finished state.
3. Why is tx.origin dangerous for authentication? It returns the original signer of the transaction chain, so a phishing contract can pass your check while acting as the caller. Use msg.sender.
4. What risks come with delegatecall? The callee executes with the caller's storage, so mismatched storage layouts or untrusted targets let attackers overwrite critical state, including owners.
5. How did arithmetic change in Solidity 0.8? Overflow and underflow revert by default. Before 0.8, silent wrapping enabled classic exploits, which is why SafeMath mattered historically.
6. What is oracle manipulation? Attackers move a price feed the contract trusts, often via flash loans against a thin pool, then exploit the distorted price. Use time weighted or aggregated oracles.
7. What is front running and how do you mitigate it? Bots see pending transactions and insert their own first. Mitigations include commit reveal schemes and private transaction relays.
8. How do signature replay attacks work? A valid signature gets reused on another chain or contract. Include nonces, chain id and contract address in signed data, per EIP712.
9. Why check return values of external calls? Low level calls return false instead of reverting on failure. Ignoring that lets execution continue on a failed transfer, corrupting accounting.
10. What is access control beyond onlyOwner? Role based systems grant granular permissions to many addresses, usually via OpenZeppelin AccessControl, reducing single key risk and enabling safer operations.

What gas optimization questions come up?

1. How does storage packing save gas? Variables smaller than 32 bytes share a slot when declared adjacently, cutting expensive storage writes. Order struct fields to pack tightly.
2. When do you use calldata instead of memory? For external function array and struct parameters that are read only, calldata avoids a copy and is meaningfully cheaper.
3. What does unchecked do? It skips overflow checks inside the block, saving gas where overflow is provably impossible, such as bounded loop counters.
4. Why prefer custom errors over require strings? Error strings are stored in bytecode and expensive to revert with. Custom errors encode a selector, cutting deployment and revert costs.
5. Why cache storage variables in memory? Each storage read costs far more than a memory read, so loading once before a loop and writing back after saves significant gas.
6. Events versus storage for historical data? If contracts never need to read the data, emit events and let indexers store history, since logs cost a fraction of storage.

What EVM and advanced questions separate seniors?

1. How does the EVM lay out storage slots? State variables occupy sequential 32 byte slots, mappings and dynamic arrays derive positions from hashes of their slot, which is exactly what proxy layouts must respect.
2. How do upgradeable proxies work? A proxy holds state and delegatecalls a logic contract. Patterns like UUPS and the transparent proxy manage who can upgrade and avoid selector clashes.
3. What is a storage collision in proxies? Logic contract variables overlapping proxy slots corrupt state. Standards like EIP1967 place proxy data at hashed slots to avoid it.
4. What is the difference between create and create2? Create derives addresses from sender and nonce. Create2 uses sender, salt and bytecode hash, making addresses predictable before deployment.
5. Why keep constructors out of logic contracts? Proxies never run the logic constructor, so upgradeable contracts use initializer functions guarded against repeat calls.
6. Explain the ERC20 approve race condition. Changing a nonzero allowance lets a fast spender use both old and new amounts. Mitigate by setting to zero first or using increase and decrease functions.
7. What is EIP712? A standard for hashing and signing typed structured data, giving wallets readable signature prompts and contracts a safe verification format for things like permits.
8. How do flash loans work and why do they matter for security? They lend any amount within one transaction that must repay by the end. They democratize capital for arbitrage and for attacks, so protocols must assume attackers have unlimited funds.

How should you talk about process and tooling?

1. What does your testing stack look like? Name Foundry or Hardhat, describe unit tests plus fuzz tests for invariants and mainnet fork tests against live protocols.
2. What is fuzz testing and why does it matter? The framework throws random inputs at properties that must always hold, surfacing edge cases humans never write, which is standard practice in serious audits.
3. Walk through your deployment process. Scripted deployments, testnet rehearsal, verification on Etherscan, then post deployment checks and monitoring, with keys secured in hardware or a signer service.
4. How do you prepare a codebase for audit? Freeze scope, write specification docs and natspec comments, achieve high test coverage and run static analysis like Slither before auditors start.
5. How do you stay current on exploits? Follow postmortems from rekt and security researchers on X, read audit reports and rebuild notable exploits locally to internalize the patterns.
6. A protocol you rely on gets hacked. What do you do first? Assess exposure, pause affected functions if permissions allow, communicate honestly with users and coordinate with security responders before touching fixes.

What does the interview process itself look like?

Most Solidity developer interview loops run 3 to 5 stages. Expect a screening call, one or two technical deep dives built from questions like those above, a practical challenge and a final culture and offer conversation.

The practical stage matters most. Companies increasingly use timed audits of intentionally buggy contracts or a small paid build, so practice finding the classics fast: reentrancy, access control gaps, oracle trust and unchecked calls.

Bring questions of your own about code review culture and incident history. Serious teams love being asked, and evasive answers tell you to walk away. Our guide to general web3 interview questions covers the nontechnical rounds.

How do the interview stages map to preparation?

Stage	What they test	How to prepare
Recruiter screen	Motivation and communication	Tight story of your best contract work
Technical deep dive	Questions 1 to 40 above	Explain answers aloud with tradeoffs
Practical challenge	Finding and fixing vulnerabilities	Timed audits of known buggy contracts
Final round	Judgment and collaboration	Process answers plus your own questions

What should you do with these questions now?

Work through five per day and write your answers from memory, then check them against documentation and real audit reports. Four weeks is the realistic runway, moving from language mechanics into security patterns, then EVM internals and finally timed practice. Explaining out loud to another person exposes the gaps that silent reading hides.

Ship proof alongside prep. A public repo with tested contracts and one thoughtful writeup of a known exploit beats certificates, and our piece on web3 portfolio projects shows what convinces hiring managers. When you are ready, browse web3 jobs and start booking loops.

FAQ

How many Solidity interview questions should I prepare for?

Depth beats coverage. The 40 here span what most loops draw from, but interviewers follow up until you run out of understanding, so aim to defend each answer twice over.

Do I need to memorize EVM opcodes?

No. You should understand storage layout, call types and gas mechanics conceptually. Opcode recall only matters for specialized MEV or compiler roles.

What salary can a Solidity developer expect in 2026?

It varies widely by seniority and region. Remote roles commonly land between $100K and $180K, with senior protocol engineers above that, and our Solidity developer jobs guide breaks down the full market.

Are take home assignments worth doing?

Short paid ones, yes. Long unpaid builds are a red flag, and it is reasonable to offer a timed live session instead when an assignment exceeds a few hours.