What is a Flash Loan?
A flash loan is a unique DeFi primitive that allows users to borrow any available amount of assets without collateral, provided the loan is repaid within the same blockchain transaction. If repayment fails for any reason, the entire transaction reverts as if the loan never happened. All state changes unwind. This enables complex financial operations that would otherwise require significant capital, democratizing access to advanced strategies.
How Flash Loans Work
Flash loans exploit blockchain atomicity. The property that either all operations in a transaction succeed, or none do. The lending protocol checks at transaction end whether borrowed funds plus fees have been returned. If yes, the loan completes successfully. If no, the entire transaction reverts, protecting the protocol from any possible loss.
From the protocol's perspective, flash loans are risk-free. The contract never ends a block with outstanding uncollateralized debt. It's mathematically impossible. This enables lending any amount regardless of borrower creditworthiness. Fees are typically 0.05-0.09% of borrowed amount.
Legitimate Use Cases
Flash loans enable powerful legitimate strategies: arbitrage across DEXs (profit from price differences), collateral swaps (change loan collateral without closing positions and paying interest), self-liquidation (repay debt to avoid liquidation penalties), and debt refinancing (move between lending protocols in one transaction).
These operations would otherwise require large capital reserves. Flash loans democratize access. Anyone can execute strategies previously limited to well-capitalized traders.
Flash Loan Attacks
Flash loans have also enabled significant exploits by providing attack capital without upfront investment. Attack patterns include oracle manipulation (borrow huge amounts to temporarily move prices, exploit protocols using manipulated prices), governance attacks (borrow tokens, vote maliciously, return tokens), and reentrancy exploitation.
Notable attacks include bZx ($8M), Cream Finance ($130M), and Euler Finance ($197M). These combined flash loans with other vulnerabilities.
Security Implications
Protocols must design assuming flash loan availability. Oracles should resist single-block manipulation (use TWAPs). Governance should have timelock delays. Critical operations should consider whether flash-borrowed capital changes threat models. Flash loans fundamentally change the attack economics of DeFi.