Flash Loan Attack
An exploit that uses a flash loan's large, temporary, capital-free borrowing power to manipulate a price feed or exploit a protocol's logic within a single transaction, then repays the loan before it reverts.
A flash loan attack uses the large, temporary borrowing power a flash loan (see Kaavon's "Flash Loan" glossary definition) provides to manipulate a vulnerable protocol within a single transaction, most commonly by briefly distorting a thinly liquid price feed or oracle (see Kaavon's "Oracle Manipulation" glossary definition) enough to trigger an advantageous, mispriced action elsewhere — such as borrowing against collateral that's been artificially inflated in value, or triggering a favorable liquidation — before repaying the flash loan and keeping the ill-gotten profit, all within that same atomic transaction.
Flash loan attacks are possible specifically because flash loans let an attacker temporarily command far more capital than they actually own, without needing any meaningful capital of their own at risk, dramatically lowering the practical barrier to attempting a price-manipulation attack that would otherwise require genuinely large capital reserves. Defenses include using manipulation-resistant price sources like a TWAP oracle (see Kaavon's "TWAP Oracle" glossary definition) rather than an instantaneous spot price, and designing protocol logic that doesn't trust any single transaction's price data in isolation.
Examples
- A flash loan attack might briefly borrow an enormous sum to distort a thinly liquid price feed, triggering a mispriced loan or liquidation elsewhere before repaying the flash loan within the same transaction.
- Using a TWAP oracle rather than an instantaneous spot price is one of the main defenses against flash loan attacks, since manipulating a time-weighted average requires sustained distortion rather than a single transaction's price spike.
Learn more
Flash Loan
Read the Flash Loan glossary definition
Oracle Manipulation
Read the Oracle Manipulation glossary definition
TWAP Oracle
Read the TWAP Oracle glossary definition
Governance Attacks Compared: Beanstalk's Flash Loan vs. Slow Whale-Accumulation Capture
Read the research article