What Are Flash Loans in DeFi, And Are They Dangerous?

The world of blockchain is filled with many strange, complex things that cannot exist outside of it, and one of the least understood is the controversial ‘fash loan’ that is issued by Decentralized Finance (or ‘DeFi‘) lending/borrowing apps. DeFi exploded into popularity with the invention of cryptocurrency lending/borrowing apps.

Crypto holders have the ability to borrow stablecoins (cryptocurrencies valued at one dollar) against their crypto holdings, as well as take out loans denominated in other cryptocurrencies, which can be used for setting up short positions. In return, depositors of cryptocurrencies and stablecoins earn the interest paid by the borrowers. These apps rely on “liquidity pools” to function, where users deposit their crypto into a pool with other users, which the app draws from to issue loans to borrowers.

Related: What To Expect From Aave’s New GHO Stablecoin

Normally, taking out a crypto loan requires depositing collateral that can be liquidated if the loan goes bad, but flash loans operate differently. As Decrypt explains, the entire amount of the loan must be returned at the end of the transaction or else the transaction will be reversed, which eliminates the need for collateral. Blockchain smart contracts are used to call a flash loan, allowing the borrower to use the loan across many other DeFi apps throughout the loan’s short lifespan. The most common use for flash loans is arbitraging price differences between decentralized exchanges (often called ‘DEXes‘) like Uniswap. Arbitraging with flash loans is a win-win for all parties involved, as the trader makes low-risk profits while the ecosystem benefits from price stability between DEXes, but it is also highly competitive and difficult to pull off without the use of bots. Flash loans are also used by non-traders for “collateral swapping,” allowing them to swap out their crypto loan’s collateral asset for something else, potentially averting liquidation of their loan.

Flash Loans Can Be Weaponized

While flash loans are invaluable for DeFi, they are extremely dangerous to projects that didn’t prepare for their capabilities during development. For example, decentralized autonomous organizations or DAOs that use token-based voting mechanisms can be exploited by flash loans if they aren’t designed properly. DeFi stablecoin lending protocol Beanstalk suffered this kind of attack in April 2022, where the attacker used a flash loan to obtain enough DAO governance tokens to pass their own proposal to withdraw roughly $77M of assets from the community treasury.

The DeFi industry learned the hard way that flash loans can be used to manipulate prices on DEXes, which can open opportunities or attack vectors on decentralized applications (commonly called “dApps“) that rely on DEX price feeds. As DappRadar reported in February 2020, one of the most controversial and infamous flash loan attacks in DeFi involved the DyDx…