i used to think flash loans were just free money.
until last week i learned that a flash loan is money you borrow, use, and repay within a single transaction and you don't need any collateral. if the repayment isn’t completed before the transaction ends, the entire transaction is automatically reverted.
here’s another reason this tek is brilliant.
the lender faces zero risk. the loan is either paid back in full or the transaction will be reverted.
you, the borrower, also face zero risk. no collateral, no liquidation, no debt.
> the legitimate use case
let’s say you see
$ETH priced at $2,000 on
@Uniswap but priced at $2,020 on Curve.
this is how you can use a flashloan in this instance.
you borrow 1,000 ETH via a flash loan on
@CurveFinance → buy on Uniswap and sell on Curve to capture the spread minus fees → repay the loan → everything ia settled in one transaction.
the flash loan helped you act on the price gap with zero capital.
> how this tek can be manipulated (north korea is among us 😑)
an attacker's best target for this tek is a protocol that reads its prices from just one liquidity pool.
in a single transaction they can
1 - take a flash loan
2 - use the borrowed funds to temporarily distort the price in that pool
3 - interact with the vulnerable protocol while the fake price is active (withdrawing far more value than they should)
4 - repay the flash loan before the transaction ends
when the price comes back to normal, the attacker walks away with the profit and this is because everything happens atomically in one block.
a famous incident like this occurred in October 2020 when Harvest Finance lost approximately $34 million in a flash loan manipulation attack.
the attacker borrowed funds via a flash loan (from Uniswap), temporarily distorted the price of stablecoins in a Curve Finance pool that Harvest Finance relied on for pricing, then exploited the fake price to drain value from Harvest’s vaults. When the prices returned to normal, the attacker had already cashed out the profit.
> 𝘩𝘰𝘸 𝘺𝘰𝘶 𝘤𝘢𝘯 𝘴𝘵𝘢𝘺 𝘴𝘢𝘧𝘦 𝘢𝘴 𝘢 𝘥𝘦𝘧𝘪 𝘶𝘴𝘦𝘳
always check where a protocol gets its prices from.
if it gets its prices from a single on-chain liquidity pool with no time-weighted protection, it is vulnerable to this exact attack.
in simple terms, make sure the protocol uses either
- a TWAP (Time-Weighted Average Price) from a DEX like Uniswap v2/v3, or
- a reputable external oracle like
@Chainlink.
both options are much safer because a single-block price swing can’t distort them. the attacker’s transaction will simply revert with no funds extracted and users money stay safe.