Flash Loan Attack
In short: A flash loan attack occurs when malicious actors exploit smart contracts with the help of a flash loan: a loan that is borrowed and repaid within a…
A flash loan attack occurs when malicious actors exploit smart contracts with the help of a flash loan: a loan that is borrowed and repaid within a single blockchain transaction, without any collateral.
Why it matters
Flash loans themselves are a legitimate DeFi tool. The loan must be repaid before the transaction ends, and if it is not, the whole transaction is reversed, so the lender takes little risk. They are used for arbitrage and for moving collateral between protocols. The same feature, however, gives anyone brief access to a very large amount of capital. A flaw that would otherwise require a wealthy attacker can be exploited by anyone who spots it. A common target is a protocol that reads prices from a single small liquidity pool, where one large trade can move the price sharply for a moment. Protocols defend themselves with robust price oracles, such as time-weighted averages or several independent sources, along with code audits and limits on how much can change in one transaction.
Example
In one transaction, an attacker borrows a large sum through a flash loan and uses it to buy a token in a small pool, pushing that pool's price up. They deposit the now "expensive" token as collateral in a lending protocol that trusts this pool's price, and borrow more than the collateral is really worth. They repay the flash loan and keep the difference, leaving the lending protocol with a loss.