Flash Loan Attacks: Uncovering the Weak Spots in DeFi
A flash loan attack is a type of exploit in decentralized finance (DeFi) that involves borrowing a large sum of money with no collateral and repaying it within a short period, often just seconds. This mechanism is legitimate when used for arbitrage opportunities or debt refinancing, but it can be misused to break a protocol's pricing or logic.
The attack starts by borrowing a large sum through a flash-loan from a lending protocol, then moving funds into a target protocol with thinner liquidity. The attacker manipulates a price feed or pool balance with one lopsided trade, exploiting the distorted price elsewhere that trusts the same feed. Finally, they repay the flash-loan and pocket whatever's left over.
Price oracle manipulation is a repeat offender in these attacks, as many protocols pull prices from a single decentralized exchange pool with thin liquidity. Bad code, reentrancy bugs, and sloppy balance checks can also be vulnerabilities that attackers exploit.
The DeFi design invites this type of attack due to its permissionless nature, allowing anyone to interact with a contract without ID or reputation. As a result, newer protocols are more vulnerable to flash loan attacks due to their thinner liquidity and unproven code.