Flash Loan

A flash loan is an uncollateralized loan that must be borrowed and repaid within a single transaction. If the loan is not repaid by the end of the transaction, the entire transaction reverts, so the lender takes no credit risk. Flash loans are a legitimate DeFi primitive (arbitrage, collateral swaps) but are also a common attack amplifier.

Why They Enable Attacks

Flash loans give an attacker access to enormous capital for one transaction with no upfront funds. That capital is used to temporarily distort prices or balances — for example to crash a DEX price feeding an oracle (oracle manipulation and price manipulation) — then profit from a protocol that trusts the distorted value, all before repaying the loan in the same transaction.

Defending Against Flash-Loan Attacks

The defense is rarely to block flash loans; it is to remove the single-block price dependency they exploit — use a TWAP or a robust oracle, and avoid making decisions on spot balances that can be moved within one transaction.

Frequently Asked Questions

Q: Are flash loans themselves a vulnerability?

A: No. They are a legitimate tool. The vulnerability is a protocol that trusts a value (like a spot price) that a flash loan can distort within a single transaction.

---

Q: How do I protect a protocol from flash-loan attacks?

A: Price against manipulation-resistant oracles (TWAP or Chainlink), avoid spot-balance-based decisions, and add sanity/deviation checks rather than trying to detect flash loans directly.