Flash loans are one of DeFi’s most uniquely innovative — and uniquely dangerous — inventions. A flash loan lets you borrow any amount of money with zero collateral, as long as you return it within the same blockchain transaction. If you don’t return it, the entire transaction reverts as if it never happened. This sounds impossible, but it works because Ethereum transactions are atomic: everything in a transaction either happens or nothing does.
Aave introduced flash loans in January 2020, and they immediately became both a tool for legitimate arbitrage and a weapon for exploitation. The legitimate use case: a trader spots a price discrepancy between two DEXs, borrows millions via flash loan, executes the arbitrage, repays the loan, and keeps the profit — all in one transaction, with zero capital requirement. Flash loans democratized arbitrage, which previously required significant capital.
The exploitative use case proved far more impactful. Flash loans enabled a new category of attacks: borrow massive amounts, manipulate oracle prices or pool ratios, exploit the manipulated price for profit, repay the loan. The bZx protocol was flash loan attacked twice in February 2020 for $1 million. Harvest Finance lost $34 million in October 2020. Pancake Bunny lost $45 million in May 2021. The list grew longer every month.
The flash loan attack pattern became so common that “flash loan attack” entered the crypto lexicon alongside “rug pull” and “51% attack.” Protocols responded by implementing time-weighted average prices (TWAPs) instead of spot prices for oracles, adding flash loan guards, and using Chainlink price feeds that can’t be manipulated within a single transaction. By 2024, flash loan attacks had become less common — not because flash loans changed, but because protocols learned to defend against them. Flash loans remain a powerful primitive: they prove that in DeFi, capital is not a prerequisite for financial operations, which is both revolutionary and terrifying.
Leave a Reply