Flash loan

A flash loan is credit with no collateral that has to be repaid inside the same blockchain transaction that created it. If the repayment is not there when the lender checks, the whole transaction reverts and the loan is treated as never having happened. That single property is what replaces underwriting, and it is why any amount sitting in a lending pool is available to anyone who can write a contract.

Flash loans do not create vulnerabilities. They delete the capital requirement for exploiting one, which turns every design that quietly assumed an attacker would need real money into a design with no defence at all.

Scroll to see the full diagram

Step 05 is the only security in the design. Because a revert erases steps 01 to 04, the lender never carries exposure, and the size of the loan is limited by what the pool holds rather than by anything about the borrower.

Atomicity is the collateral

A blockchain transaction either completes in full or leaves no trace. A flash loan converts that property into a credit instrument. The standard defines it as a transaction in which a lender contract lends assets to a borrower contract on the condition that the assets are returned, plus an optional fee, before the end of the transaction.¹

The lender is therefore never exposed. There is no window in which the money is out and the repayment is pending, because both happen inside one atomic unit and the failure mode is not a default but an erased transaction. Nothing needs to be assessed about the borrower because nothing about the borrower matters.

The BIS described the same instrument as loans of zero duration that are essentially risk free and require no collateral, granted only where the trade itself ensures repayment of principal and interest, and possible only because every leg settles in the same block.⁴ That is the shortest correct description of the mechanism available from an institutional source.

The standard, and what it asks of both sides

ERC-3156 standardised what had been a set of incompatible per protocol interfaces. A lender exposes three functions: how much of a token can be borrowed, what fee applies to a given amount, and the call that initiates the loan. A borrower implements a callback the lender invokes mid transaction, during which the borrower temporarily controls execution.¹

The motivation section is worth reading if you are integrating rather than theorising. It catalogues where implementations diverged: some lenders pull the principal and fee back from the receiver, others require the receiver to push it; some allow repayment in a different token; some flash mint their own token with no fee at all, making the loan bounded by computation, not by anyone's asset holdings.¹

Implementations keep moving. Aave V3 added a simplified single asset entry point that cuts gas consumption by up to 20% against the general function, and a permissioned role whose holders have the flash loan premium waived.² The same paper flags the obvious hazard in that role: if the permitted address is a proxy anyone can call, the fee is waived for everybody and liquidity providers stop being paid for the facility.²

The legitimate uses are dull, which is the point

Most flash loan volume is not an attack. It is collateral swapping, where a borrower replaces the asset backing an existing loan without unwinding it first. It is refinancing a position from one lending market to another in a single step. It is funding a liquidation so the liquidator does not need to hold the debt asset. And it is arbitrage between venues, which the BIS singles out as the canonical case: the arbitrageur acts without their own capital by borrowing the entire trade and repaying it.⁴

The scale is real even at the boring end. The BIS recorded the largest platform granting about $5.5 billion of flash loans between their emergence in mid 2020 and late 2021.⁴ Treat that as a dated figure from that review, not a current one.

The useful reframing for a founder is that flash loans made price correction across venues cheap. Whether that is good for you depends on which side of the correction your pool is on.

They do not create the vulnerability, they price it at zero

The first serious academic treatment of this analysed two attacks executed in February 2020, reporting returns on investment beyond 500,000%, then showed how the same attacks could be optimised further to produce profits of $829,500 and $1.1 million, boosts of 2.37 and 1.73 times against what the original attackers achieved.³ The paper's real contribution is the framing: finding the attack parameters is an optimisation problem over the state of the chain, which means it can be solved rather than stumbled upon.

Read that carefully, because the popular version gets it backwards. In every one of these cases the vulnerability existed independently. A spot price read from a shallow pool was manipulable before flash loans existed, but manipulating it required capital and therefore risk. Flash loans removed the capital and, because a failed attempt reverts, they removed the risk as well.

So the correct threat model changed permanently in 2020. The question is no longer whether an attacker could raise enough to move your price. It is whether your price can be moved at all within a single block, by anyone, at a cost of gas.

Every design that assumed capital is scarce is now wrong

Two design patterns fail immediately against free capital. The first is any contract reading a spot price from an onchain pool it does not control. Inside one transaction, an attacker can borrow, move that pool, act on the price your contract now believes, and restore everything before the block closes. The defence is a time weighted price that a single block cannot shift, and enough depth underneath it that a sustained move is expensive.

The second is governance that counts voting weight at the moment of the vote. If holding the token is enough to vote with it, a flash loan is a majority. The defence is measuring weight at a snapshot block taken before the proposal existed, or requiring the tokens to be locked, plus a timelock between a passing vote and execution so that a stolen outcome can still be stopped.

Neither of these is exotic and both are cheap at design time. They are expensive after launch, because changing how a live governance system counts votes requires the consent of whoever currently holds the votes.

What we check when a design touches this

Four things, and they take an afternoon. Every price a contract acts on, traced back to whether a single transaction can move its source. Every governance action, traced back to whether the weight it uses is snapshotted or live. Every function that assumes a balance cannot change between two reads inside the same call. And whether the protocol's own pools are deep enough that manipulating them costs more than the position an attacker could take against them.

That last one is a tokenomics question, not a security question, which is exactly why it falls between the two teams. Your auditor checks the code. Your launch plan sets the depth. The exploit lives at the seam.

One framing to keep. Flash loans are a permanent feature of any chain with atomic transactions. They are not going away and they cannot be blocked at the application layer, so the only real response is designing on the assumption that an adversary's capital is unlimited and their downside is zero.

Common questions

What is a flash loan and how does it work?

It is a loan with no collateral that must be repaid within the same transaction. The lender sends the assets, hands execution to the borrower's contract through a callback, then checks that principal plus any fee came back before the transaction ends.¹ If it did not, everything reverts and the loan never occurred, which is why no collateral is needed.

How can a flash loan have no collateral?

Because the lender is never actually exposed. Blockchain transactions are atomic, so a repayment failure does not produce a default, it produces a reverted transaction in which the loan was never made. The BIS describes these as loans of zero duration that are essentially risk free, granted only where the trade itself ensures repayment of principal and interest.⁴

What is a flash loan attack?

It is an exploit funded by a flash loan, usually against a contract that reads a manipulable onchain price or counts governance weight at the moment of voting. Academic analysis of two February 2020 attacks reported returns beyond 500,000% and showed the same exploits could be optimised to $829,500 and $1.1 million.³ The flash loan supplies the capital, not the vulnerability.

How much does a flash loan cost?

A protocol fee plus gas. The standard requires lenders to expose a function returning the fee for a given amount rather than fixing a rate, so it varies by venue and asset.¹ Aave V3 charges a premium that goes to liquidity providers, with a permissioned role whose holders have it waived.² Gas is the other cost and it is not trivial for a multi step transaction.

See Tokenomics Audit for how this applies in practice.

Sources

ERC-3156: Flash Loans (EIP-3156)
Ethereum Improvement Proposals, 2020
Definition of a flash loan as assets lent on the condition of return plus an optional fee before the transaction ends, the lender and receiver interfaces, and the catalogue of divergent pre-standard implementations.
Aave V3 Technical Paper
Emilio Frangella, Lasse Herskind (Aave), 2022
The simplified single-asset flash loan function reducing gas consumption by up to 20%, the flash borrower role that waives the premium, and the documented risk that a proxy holding that role waives fees for everyone.
Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit (arXiv:2003.03810)
Kaihua Qin, Liyi Zhou, Benjamin Livshits, Arthur Gervais, 2020
Analysis of two February 2020 attacks with returns beyond 500,000%, and optimised versions producing $829,500 and $1.1 million, framing attack parameter discovery as an optimisation problem over chain state.
DeFi risks and the decentralisation illusion, BIS Quarterly Review
Sirio Aramonte, Wenqian Huang and Andreas Schrimpf, Bank for International Settlements, 2021
Flash loans as zero-duration, essentially risk-free, uncollateralised instruments settled in a single block, and roughly $5.5 billion granted by the largest platform between mid-2020 and late 2021.

Last reviewed 2026-08

Related terms

Know the terms but not sure how they apply to your project? That is what an engagement is for. We design, document, and stress-test the whole token economy inside the Tokenomics Data Room.

Book a discovery call

80+ projects advised. Complete tokenomics in 4 to 6 weeks.