Flash loan exploit
A flash loan exploit is an attack on a DeFi protocol. The attacker temporarily borrows a large amount of crypto to exploit a flaw in that protocol.
What is a flash loan exploit?
A flash loan is a loan that doesn’t require collateral. The loan must be repaid, including the fee, within the same transaction. Here, a transaction is a set of actions carried out all at once.
What if the borrower can’t repay it? The blockchain reverses the entire set of actions. In an exploit, an attacker uses the temporary loan to change a price, for example. Another protocol may then make a decision based on incorrect information.
The flaw usually isn’t in the flash loan itself. The problem is often with the price data, rules, or smart contracts of the targeted protocol.
An example of a flash loan exploit
An attacker temporarily borrows a large amount of crypto and uses it to swap a token on a DEX. That large swap can cause the price in that pool to rise sharply for a short time.
A lending protocol sees the high price and overvalues the attacker’s collateral. This may allow the attacker to borrow too much crypto. The attacker then repays the flash loan. If all the steps can’t be completed within the same transaction, everything is reversed.
Why do flash loan exploits matter in crypto?
Flash loan exploits can cost users, liquidity providers, and a DAO their crypto. For example, the targeted protocol may be left with too little collateral or a shortfall. The losses usually fall on that protocol, not on the flash loan provider.
In news about DeFi attacks, you’ll often read that a price oracle, a DEX price, or governance was exploited. An oracle tells a protocol how much a token is worth. If a protocol relies on a single price that can be temporarily influenced, that can be dangerous.
A flash loan isn’t automatically bad. Flash loans can also be used normally, for example, for arbitrage. A report of a flash loan exploit mainly means that an attacker took advantage of a vulnerability in a protocol.
