Roguelite Labs

Flash Loans

4 min · blockchain, defi, ethereum

Flash Loans

Uncollateralized loans that must be borrowed and repaid within a single Ethereum transaction. If the repayment condition isn't met, the entire transaction reverts as if it never happened — meaning there's no credit risk to the lender. Flash loans are possible because Ethereum transactions are atomic: all state changes either fully apply or fully revert.

No collateral required. No credit check. Any amount, as long as you return it plus a fee before the transaction closes.

How They Work

A flash loan is a call sequence inside one transaction:

  1. Borrow N tokens from the flash loan contract
  2. Execute arbitrary logic with those tokens (arbitrage, collateral swap, whatever)
  3. Return N tokens + fee to the flash loan contract
  4. If step 3 fails or isn't reached, the entire transaction reverts — the loan never happened

The lender's liquidity is never actually at risk. They earn the fee regardless of what the borrower does in between.

Fee: ~0.05% on Aave, 0.09% on Uniswap v3, free on Balancer (within permitted use cases). Compared to the size of operations flash loans enable, the fee is negligible.

Providers: Aave V3 (flashLoan), Uniswap V3 (flash), Balancer (flashLoan), dYdX, MakerDAO (flashMint for DAI).

Legitimate Uses

Arbitrage — buy a token cheap on DEX A, sell it expensive on DEX B, return the loan and keep the spread. Flash loans make arbitrage capital-free; anyone can exploit price discrepancies without owning the capital required for the trade.

Collateral swaps — replace collateral in a lending position without closing it. Example: you have ETH collateral backing a DAI loan on Aave. Flash loan DAI, repay your debt, withdraw the ETH, deposit WBTC instead, reborrow DAI, repay the flash loan. The result: same position, different collateral — executed atomically.

Self-liquidation — if your collateral ratio is close to the liquidation threshold, liquidation bots will claim your collateral and charge a penalty. Flash loan the debt asset, repay your position yourself, withdraw your collateral, sell enough to repay the flash loan. Cheaper than the liquidation penalty.

Leveraged unwinding — close a leveraged position that would otherwise require multiple transactions and intermediate capital.

Attack Vectors

Flash loans are neutral infrastructure. The attacks they enable are attacks on other protocol design flaws — specifically, oracle vulnerabilities and governance systems that assume borrowing requires capital.

Oracle manipulation — most high-profile flash loan attacks target spot price oracles. The pattern: flash loan a large position, dump it into an AMM pool to move the spot price dramatically, exploit a protocol that trusts that spot price as a signal (e.g., borrow against inflated collateral), profit, return the flash loan. The attack works only if a protocol reads a price from an AMM spot (manipulable in one block) rather than a TWAP or Chainlink feed.

Key examples:

  • Harvest Finance (October 2020) — $34M. Flash loaned USDC and USDT, manipulated Curve's USDC/USDT pool prices, deposited and withdrew from Harvest at manipulated prices. Repeated 17 times within the same transaction.
  • Cream Finance V1 (August 2021) — $18.8M. Exploited via price oracle manipulation using Yearn's yUSD token.
  • bZx (February 2020) — two attacks in one week, $1M combined. The first high-profile flash loan attacks; alerted the ecosystem to oracle risk.

Governance attacks — protocols that allow voting with borrowed (delegated) tokens are vulnerable. If governance weight can be acquired in one transaction, it can be used in the same transaction without holding tokens through a proposal period.

  • Beanstalk (April 2022) — $182M. Attacker flash loaned enough governance tokens to acquire a supermajority, passed an "emergency governance" proposal that transferred the protocol treasury to their wallet, all in a single transaction. The entire $182M was donated to Ukraine within 24 hours (reportedly). The fix: add a minimum commitment period between token acquisition and vote execution.

Protocol Design Implications

Flash loans exposed two systematic design flaws:

  1. Spot price oracles are dangerous — any system that trusts an AMM spot price as a reliable signal is attackable if someone can borrow the liquidity to move that price. The fix: Chainlink, TWAP over multiple blocks, or multi-source aggregation.

  2. Same-block governance is dangerous — any governance system where tokens can be borrowed, voted with, and returned in one transaction can be captured with zero long-term capital commitment. The fix: snapshot voting (vote weight measured at a prior block), time locks between acquisition and voting, vote escrow (veToken models).

Related

defi-risks · mev · stablecoins · dao-governance · amm

Sources

linked from
AMMs (Automated Market Makers)MEV (Maximal Extractable Value)