Track 7 · The Breach Lab · lesson 9

Flash loans

25 min

You can borrow ten million dollars right now, with no collateral, no credit check, and no risk to the lender. The catch: you must repay it in the same transaction, or the whole thing reverts as if it never happened.

That is a flash loan, and it is not itself an exploit. It is a tool that makes other exploits affordable to anyone.

Because a transaction is atomic — all of it happens or none of it does — a lender can hand you any amount safely. If your transaction ends without repaying, every step including the loan is undone. The lender cannot lose.

What this removes is the last barrier to attacking: capital. An oracle manipulation that needs $10M to move a price used to require having $10M. Now it requires a $9 gas fee and a contract that borrows, attacks, and repays in one breath.

Flash loans need multiple protocols cooperating inside one transaction — a lender, a target, a market to dump into — which is why this course shows the shape rather than simulating it. The mechanism, though, is simple to follow.

The five steps

Every flash-loan attack has the same skeleton:

// The attacker's contract, all in one transaction:
function attack() external {
  // 1. borrow 10,000 ETH, no collateral
  lender.flashLoan(10_000 ether);
}

function onFlashLoan(uint256 amount) external {
  // 2. use it to move a manipulable price
  pool.swap(amount);
  // 3. exploit a victim that trusts that price
  victim.borrowAgainstInflatedCollateral();
  // 4. reverse the swap, keep the profit
  pool.swapBack();
  // 5. repay the loan — required, or everything reverts
  lender.repay(amount);
}

The victim priced collateral from a spot source and acted within one block. The flash loan supplies the capital to move that price; the attack fits in a single transaction.

The lesson underneath

Flash loans did not create these vulnerabilities. They exposed them by making capital free — every contract whose security quietly assumed "an attacker won't have millions" was suddenly wrong.

Predict

What does a flash loan fundamentally change about the threat model?

Choose one answer

Check

Why is a flash loan safe for the lender to offer with no collateral?

Choose one answer

Worth remembering

  • A flash loan is borrowed and repaid within one transaction, or the whole transaction reverts.
  • This is safe for the lender because atomicity guarantees repayment or total rollback.
  • Flash loans are not exploits — they remove capital as a barrier to other exploits.
  • They are the funding half of most oracle-manipulation attacks.
  • The only real defence is logic that is correct against an adversary with unlimited capital.