What Flash Loan Attacks Are and Why They Can Drain a Protocol in One Transaction
A flash loan lets someone borrow millions with zero collateral, repaid in one transaction. Here's how that mechanism gets turned into a protocol exploit.
A flash loan lets someone borrow an enormous amount of capital — millions of dollars, with no collateral at all — as long as it's paid back within the same single transaction. This unusual mechanism, genuinely useful in legitimate DeFi, has also become the primary tool behind some of the most damaging protocol exploits in crypto.
What a Flash Loan Actually Is
The entire loan — borrowing, using the funds, and repaying them — must complete within one single, atomic transaction, or the entire transaction reverts as if it never happened.
Why This Mechanism Exists Legitimately
Flash loans have genuine uses — arbitrage between different exchanges, refinancing an existing position without needing separate upfront capital.
How Flash Loans Get Used in an Attack
An attacker borrows capital through a flash loan, uses it to manipulate a target protocol's price oracle, exploits the resulting distortion, and repays the loan — all in one transaction.
Why Oracle Manipulation Is the Common Target
A flash loan provides enough capital to temporarily shift a pool's price ratio, the same mechanism behind manipulating a thin liquidity pool generally, just at a much larger scale.
Why This Requires No Ongoing Capital or Risk From the Attacker
If the exploit doesn't work as planned, the transaction simply reverts, and the attacker loses only the gas fee.
Why This Isn't Something an Individual User Can Personally Prevent
A flash loan attack targets the protocol's own code and price-feed design, not individual wallet behavior.
What This Means for Evaluating a DeFi Protocol
Checking whether a protocol has been audited specifically with flash loan attack vectors in mind, and whether it relies on a single price source or a more resistant, aggregated oracle design.
Check a DeFi protocol's audit history and oracle design before depositing significant funds — this specific risk depends on the protocol's own architecture, not your individual wallet behavior.