A flash loan attack uses a flash loan, an uncollateralized loan that must be borrowed and repaid within a single transaction, to give an attacker enormous temporary capital to manipulate a protocol. With millions in hand for one transaction, the attacker can skew a price oracle, imbalance a pool, or trigger faulty logic, extract profit, and repay the loan, all atomically. Flash loans are not the bug; they remove the cost of capital, exposing protocols that assumed attackers could not move large sums. The defense is robust, manipulation-resistant design.
What it is
A flash loan is a DeFi primitive: you can borrow a huge amount with no collateral, on the condition that you repay it (plus a fee) in the same transaction. If you do not repay, the whole transaction reverts as if it never happened, so the lender has no risk.
A flash loan attack weaponizes this. The attacker borrows a fortune for a single transaction and uses that capital to push a protocol into a state it mishandles, then profits and repays, all in one atomic step.
How it works and example
A typical flash-loan-powered exploit, all in one transaction:
1. Borrow a large sum via flash loan. 2. Manipulate: dump the borrowed funds into a low-liquidity pool to crash or spike a price the target reads as an oracle. 3. Exploit: interact with the target protocol while the price is wrong, for example borrow far more than the collateral is really worth, or mint/redeem at a distorted rate. 4. Repay the flash loan and keep the profit.
Flash loans also amplify governance attacks (borrow tokens to pass a vote). Documented for defensive context.
How to defend
- Use manipulation-resistant price feeds: decentralized oracles and time-weighted average prices (TWAP), never a single spot price from a low-liquidity pool.
- Do not trust in-transaction spot prices for critical accounting.
- Add economic guardrails: caps, circuit breakers, and sanity checks on large swings.
- Make governance flash-loan-resistant (voting snapshots, timelocks) so borrowed tokens cannot pass votes.
- Audit the economics, model what an attacker with unlimited one-transaction capital can do.
References
- [1]OWASP Smart Contract Top 10(OWASP)
- [2]Ethereum.org: Smart contract security(Ethereum.org)
- [3]SWC Registry: Smart Contract Weakness Classification(SWC Registry)