What is a flash loan attack?
A flash loan lets anyone borrow a large amount with no collateral, provided it is repaid in the same transaction. A flash loan attack uses that borrowed capital to manipulate something a protocol trusts, usually a price, a share value or a governance vote, profit from the distortion, and repay the loan, all in one transaction.
How an attack plays out
- Borrow a large sum through a flash loan.
- Use it to move a price in a pool, inflate a vault’s share price, or acquire voting power.
- Interact with the target protocol while the distortion holds: borrow against overvalued collateral, mint cheaply, liquidate, or pass a proposal.
- Reverse the distortion if needed, repay the loan, and keep the profit.
Because it all happens in one transaction, there is no window to react.
Examples
- PancakeBunny (2021). An attacker used flash loaned funds to manipulate the price of BUNNY, withdrew a large amount from the BUNNY-BNB pool and profited.
- Euler Finance (March 2023). Hackers used a flash loan as part of an attack that took over $195 million, accounting for 60% of funds lost in Q1 2023. Around 90% was later recovered through negotiation.
Defences
- Never use a spot price from a single pool as an oracle. See oracle manipulation.
- Snapshot governance voting power before proposals are created.
- Protect vaults against donation and inflation attacks.
- Assume unlimited capital when reviewing economic logic. HYDN’s DeFi audits model exactly that.
Frequently asked questions
Are flash loans the vulnerability?
No. They give an attacker capital. The vulnerability is the thing the capital is used against: a spot price that can be moved, a share calculation that can be skewed, or votes counted at the wrong moment.
How much has been lost to these attacks?
In the first quarter of 2023 alone, more than $222 million was lost across 52 flash loan and oracle manipulation exploits, including the Euler Finance attack of over $195 million.
Published Updated