What Is a Flash Loan Exploit and How Does This Attack Work on DeFi Protocols?

What Is a Flash Loan Exploit?

A flash loan exploit is an attack where someone temporarily borrows a large amount of crypto to take advantage of a flaw in a DeFi protocol. A flash loan is a loan that has to be paid back within a single blockchain transaction.

That kind of flash loan is unsecured. So you do not have to put up your own collateral first, but there is an important condition: the loan, including the fee, has to be repaid before the end of the same transaction. If that does not happen, the blockchain rolls back the entire transaction as if it never happened.

That is called atomic execution. You can think of it as one package: all parts succeed together, or nothing happens. Flash loans are also used normally, for example for arbitrage, liquidations, and swapping collateral.

In an exploit, an attacker uses that temporary liquidity to hit a weak spot somewhere else. Often, this involves a protocol that relies on the spot price from a single DEX for an important decision. That price can be pushed around temporarily by a very large swap.

Say a lending protocol treats that temporarily inflated price as the real market price. Then an attacker can make collateral look way more valuable than it really is and borrow more crypto against it than is actually safe. Other attacks are not about prices, but instead about temporary voting power in on-chain governance or a flaw in the business logic of smart contracts.

Key Takeaways

• A flash loan is an unsecured loan that has to be repaid within the same transaction.
• A flash loan exploit usually takes advantage of a flaw in another DeFi protocol, not the flash loan itself.
• A common attack temporarily manipulates the spot price in a DEX pool.
• Because of atomic execution, the whole attack either succeeds or gets rolled back.
• Flash liquidity can also be used to exploit governance or flaws in protocol rules.

How Does a Flash Loan Exploit Work?

A flash loan exploit usually works because an attacker temporarily uses a lot of capital to change a price or protocol state, after which the target protocol makes the wrong decision. Everything happens within one atomic transaction.

So how does that work? First, the attacker has their own smart contract take out a flash loan. That contract can then immediately carry out multiple actions, like swapping tokens, depositing collateral, and borrowing crypto

In an oracle manipulation attack, the attacker buys or sells a large amount of a token in a DEX pool with a big swap. That changes the reserves in that pool and temporarily sends the local spot price sharply up or down. A price oracle is simply the part that tells a protocol what something is worth.

The danger starts when another protocol reads that one distorted price as if it were the normal price across the broader market. The attacker can then, for example, borrow too many assets against inflated collateral or trigger an incorrect settlement.

At the end, the attacking contract converts enough of the proceeds to pay back the flash loan and fee. Whatever is left after that is the profit. If there is not enough to repay the loan, the full transaction reverts.

That keeps the risk limited for the attacker: all steps have to work at once. For the victim protocol, though, the damage can be permanent. The protocol may have already lent out too much crypto based on a price that was only wrong for a very short time.

Not every attack follows this exact pattern. In governance attacks, temporary liquidity may mainly be used to get a lot of voting power. In other exploits, the flaw is in a calculation or access rule in the protocol.

What Steps Are Involved in a Flash Loan Attack?

A flash loan attack often follows five logical steps, although in practice attackers can combine multiple loans, protocols, and swaps.

1. Find a weak spot The attacker first looks for a flaw that is financially interesting. Think of a DEX spot price that is easy to influence, an incorrect valuation of LP tokens or vault shares, or governance where borrowed tokens immediately give voting rights.

2. Borrow temporary capital Next, an attacking smart contract takes out a flash loan. No collateral is needed upfront, but the loan still has to be repaid within the same transaction.

3. Influence the price or state Using the borrowed capital, the contract carries out large swaps, deposits, borrows, mints, votes, or other contract calls. The goal is to temporarily change a price, reserve value, or other important input.

4. Extract value from the protocol While the wrong price or state is in effect, the contract can, for example, borrow too many assets, mint too many tokens, or carry out a harmful governance action.

5. Settle the loan Finally, the contract repays the principal and fee. The remaining assets are the profit. If that repayment does not fully work, everything gets rolled back.

Example: In the bZx attack on February 18, 2020, the attacker borrowed 7,500 ETH through a flash loan. After that, the sUSD price was pushed up through swaps. The attacker used about 1.1 million sUSD as overvalued collateral to borrow 6,796 ETH and then paid back the flash loan. In the end, the attacker kept about 2,378 ETH in profit.

Which DeFi Protocols Are Vulnerable to Flash Loan Exploits?

No single type of DeFi protocol is automatically vulnerable. The risk appears when a protocol does something valuable based on information that is cheap to manipulate within one transaction.

Lending and borrowing protocols can be at risk if they use the spot price from one DEX as the only price source for collateral, borrow limits, or liquidations. A large swap can temporarily change that local price, while the price across the rest of the crypto market is very different.

Yield aggregators and vaults can also be vulnerable. This is especially true when the price for minting or redeeming vault shares depends on pool reserves that an attacker can temporarily change. Existing depositors can then be hurt.

Stablecoin, derivatives, and synthetic asset protocols face similar risks when important processes, such as determining collateral, profit and loss (PnL), funding, or liquidations, depend on an unreliable price. PnL stands for the profit or loss on a position.

On-chain governance is another concern. If voting power directly follows tokens that someone only holds or borrows for a very short time, an attacker can temporarily gather enough influence to push a proposal through. That becomes even more dangerous if an approved proposal can immediately start executable code or actions with a DAO treasury.

Important to know: a flash loan is not always necessary. Someone with enough of their own capital, or another source of temporary liquidity, can sometimes exploit the same design flaw.

Examples of Flash Loan Exploits

Flash loan exploits can look very different. The well-known examples show clearly that not only price oracles, but also valuation rules and governance can be attacked.

• bZx, February 15, 2020: the attacker used a flash loan of 10,000 ETH in a combined attack on multiple DeFi protocols. By pushing up the WBTC price with large swaps and taking advantage of a flaw in bZx margin logic, the reported damage was about 1,271 ETH, worth around $350,000 at the time.

• bZx, February 18, 2020: a few days later, a second attack followed with a flash loan of 7,500 ETH. The sUSD price was manipulated, allowing sUSD to be used as overvalued collateral to borrow 6,796 ETH. The reported profit was 2,378 ETH, worth around $633,000 at the time.

• Harvest Finance, October 26, 2020: in this economic attack, the values of USDC and USDT in Curve's Y pool were repeatedly influenced. That allowed the attacker to mint vault shares at a favorable price and later redeem them at the normal share price. About $24 million was drained from the vaults involved.

• PancakeBunny, May 19, 2021: here, an attacker manipulated the BUNNY price through a flash loan. A flaw in the valuation of PancakeSwap LP tokens then led to minting an excessive amount of BUNNY tokens.

• Beanstalk, April 17, 2022: the attacker used a flash loan to manipulate on-chain governance and took away about $77 million in non-Bean user assets. After that, the protocol was paused and on-chain governance was temporarily disabled.

The amounts in incidents like these can vary depending on how the damage is measured. Think of gross assets taken, net proceeds, returned funds, and the price at that moment.

What Are the Consequences of a Flash Loan Exploit?

A flash loan exploit can cause users, liquidity providers, and a DAO to lose crypto right away. The damage usually does not hit the flash loan provider, but the protocol whose price logic, valuation, governance, or smart contracts were exploited.

In a lending protocol, a manipulated collateral price can lead to debt that is not properly backed. Once the price returns to normal, the collateral turns out to be worth less than the crypto that was lent out. The protocol is then left with a shortfall.

In an attack on vault shares, existing depositors are often diluted. Put simply, the attacker temporarily gets more shares than is fair. When those shares are later redeemed, the attacker takes more out of the vault than was actually put in.

There are often practical consequences too. A protocol may pause contracts, disable or change governance, move users to a new contract, and start a long recovery or compensation process.

That also happened after the Beanstalk attack. Along with the direct loss, the protocol was paused and on-chain governance was turned off. After its incident, Harvest pulled the remaining funds out of the pools involved and limited conversions during the investigation.

How Can DeFi Protocols Prevent Flash Loan Exploits?

DeFi protocols cannot prevent flash loan exploits with just one measure. Good security uses multiple layers that together make price manipulation, calculation errors, and governance abuse harder.

• Do not rely on one DEX spot price. Do not use a directly manipulable price from one pool as the only oracle for loans, liquidations, minting, or share pricing.

• Use broader price feeds. An oracle with multiple independent data sources and wider market coverage lowers the chance that one temporarily manipulated pool decides the outcome.

• Use a TWAP where it makes sense. A time-weighted average price, or TWAP, is an average price over a certain period. A longer window makes manipulation more expensive, but it also makes the price react more slowly to real market changes.

• Build in clear checks. Think of maximum price deviations, checks for whether price data is still fresh, minimum liquidity, conservative loan-to-value limits, and caps per asset. If oracle data looks strange, a protocol can block or pause sensitive actions.

• Test LP tokens and vault shares separately. The value of these positions often depends on reserves and underlying positions. So test extreme slippage and deposits and withdrawals within the same transaction too.

• Limit temporary voting power. Governance can use pre-set snapshots, add a delay between voting and execution, and limit which actions a proposal can carry out. After the April 2022 attack, Beanstalk removed on-chain governance and temporarily switched to Snapshot voting with execution by a 5-of-9 community multisig.

• Test attacks on purpose ahead of time. Independent audits, economic attack simulations, and fork tests should include flash loans, oracle manipulation, reentrancy, and combined transactions. Reentrancy means an external contract can unexpectedly call a function again before the first execution has safely finished.

• Prepare incident response. Monitoring extreme price and reserve changes, having a careful pause mechanism, and clear emergency procedures can limit damage. A pause like that cannot undo an attack that has already finished atomically, but it can help prevent further damage.

Conclusion

A flash loan exploit is not about an unsafe flash loan, but about a flaw in the DeFi protocol that gets attacked afterward. The flash loan gives an attacker temporary access to a lot of capital, which can be used to influence a price, valuation, or governance process.

Protocols that blindly trust one DEX price, vulnerable valuation rules, or directly executable temporary voting power are especially at risk. Good oracles, smart limits, well-tested smart contracts, and a solid emergency plan make these attacks much harder. For users, the main lesson stays simple: DeFi can offer a lot of opportunities, but the technical risks of a protocol are just as important as the possible return.