Flash Loan Attacks: How They Work and How to Defend Against Them

Flash loans are simultaneously a powerful DeFi primitive and the most significant attack amplifier in the ecosystem. Understanding the attack patterns is essential for anyone designing protocols that interact with price data or governance.

What Flash Loans Are

A flash loan is an uncollateralized loan that must be borrowed and repaid within the same transaction. Aave and dYdX offer flash loans. The mechanic is atomic — if the loan isn't repaid by transaction end, the entire transaction reverts as if it never happened. This enables legitimate uses (arbitrage, collateral swaps, self-liquidation) and malicious ones.

Oracle Price Manipulation Attacks

The most common flash loan attack pattern: borrow a large amount → use it to manipulate an AMM spot price → interact with a protocol that uses that AMM spot price as its oracle → profit from the distorted price → repay the loan. Example: borrow $100M in token A → buy token B with it in an AMM (price of B spikes) → use the manipulated price in a lending protocol to borrow against B as if it's worth 10x → drain the lending protocol → repay A. Defense: never use AMM spot prices as oracles. Use TWAPs or Chainlink.

Governance Attacks

If governance voting weight is determined by token balance at time of vote (not a snapshot), flash loans can temporarily give an attacker enough tokens to pass any proposal. Borrow governance tokens → vote on a malicious proposal → repay → the vote passes. Defense: use on-chain snapshots for voting power (ERC20Votes), implement time-locks on governance execution so attacks can be spotted before taking effect.

Logic Exploitation

Flash loans enable attacking logic bugs that would otherwise require large capital. Euler Finance ($197M) used a flash loan to exploit a donation function combined with a health factor calculation bug. Without the flash loan, the attacker would need real capital. With it, they needed only to pay the gas. Defense: assume attackers have unlimited capital in your threat model.

Designing Flash Loan-Resistant Protocols

Use TWAPs or Chainlink oracles instead of spot prices. Use ERC20Votes snapshots for governance. Implement time-locks on governance. Design health checks to be manipulation-resistant. Add circuit breakers for unusual price movements. In threat modeling, explicitly ask: 'what if the attacker has $1B to use within one transaction?'

Flash Loans as a Tool

Flash loans are also legitimately useful. They power collateral swapping (switch collateral type without capital), self-liquidation (liquidate your own position to save the liquidation bonus), arbitrage bots (exploit price differences across DEXes), and protocol migrations (move a position from one protocol to another in one transaction). They're infrastructure, not inherently malicious.