Understanding Flash Loans In DeFi

In traditional banking, if you’re looking to take out a loan, there are a number of documents that need to be provided, including a formal ID, proof of income and reserves. None of this is necessary in the case of a flash loan. As the name itself suggests, such loans can be granted instantaneously, allowing users fast access to funds. Flash loans are certainly highly innovative in the crypto space, and many argue that they’re incredibly useful. But there’s a downside — they also present cyber criminals with the opportunity to exploit protocols that are poorly protected.

Let’s take a deeper dive into the flash loan concept and find out who issues them, and the risks involved.

What is a DeFi Flash Loan?

Flash loans are a relatively new form of uncollateralized loans available to traders on some decentralized finance (DeFi) protocols based on a blockchain network (Ethereum).

This type of loan allows traders to borrow unsecured loans from lenders without intermediaries. Flash loans have become popular and advantageous because they give its users the ability to arbitrage and trade in ways that weren't possible before.

What makes Flash Loans unique?

Most of us are familiar with the traditional concept of a loan. A lender loans out money and eventually they get paid back in full with some or no profit. A DeFi Flash Loan transaction is similar but some unique properties make flash loans more attractive to both the borrower and the lender, most notably the use of smart contracts.

Smart Contracts

Flash loans are smart contracts. This is a feature of blockchain technology that prevents funds from leaving one account to the other unless certain obligations have been fulfilled.

When a flash loan has been issued, the smart contract rules ensure that the borrower pays back the loan before the transaction ends. If this condition isn't met, the smart contract reverses the transaction and it's like the loan never happened in the first place.

This guarantees the safety of the funds in the reverse pool.

Unsecured Loans

In the case of a traditional lending, lenders require borrowers to have collateral to issue out loans and if they fail to meet the terms of that loan, the lender can still get their money back using the collateral. However, an unsecured loan in this case doesn't mean the lender wouldn’t get their funds back if things go south. It just means they will get it back in a different way.

» We are 10Clouds: Introducing the DeFi Developer Roadmap

Instantaneous transactions

Traditionally, there are a lot of processes involved in qualifying and acquiring a loan. If a person qualifies and is issued a loan, they will most likely pay back by depositing certain amounts steadily over months or years. In the case of flash loans in decentralized finance, the process is instantaneous. A DeFi flash loan has three main steps, the first is receiving the loan, the second is using the loan for a productive purpose, and then paying back the loan all in a rapid process.

For beginners, this might be difficult to get your head around so here's a simpler summary. For a flash loan, all you need to do is ask a lender to lend you some money - let's say $50,000 in ETH. Once they approve, $50,000 of borrowed capital will be available for you to trade with but you must use and pay back that loan in the same transaction which usually lasts for only a few seconds. This may sound bizarre but that’s because we have tailored how we think to flow with the traditional way of performing transactions.

Note that if you are unable to pay back the loan, the smart contract transaction is reversed.

Where can you use Flash Loans?

While the concept of flash loans is gaining popularity in the crypto world, it is not available to traders on every trading platform. Here are some of the DeFi platforms that allow traders to get flash loans:

AAVE

Aave is the leader when it comes to flash loans. Aave flash loans are already being used by traders with Aave v2 for swapping and/or migrating positions. They are the perfect option because:

· They arbitrage between assets without needing to have the principal amount needed to execute an arbitrage (if you are new to the subject, read more about the benefits and risks of arbitrage in DeFi)

· They allow swapping collateral of loan positions without having to pay the debt of the loan position.

Other DeFi platforms that allow flash loans include:

· DyDx

· Decentralized Exchange (DEX)

· Uniswap

Why use a Flash Loan?

Flash loans help traders make a profit without risking their money. They can be used for many things such as the following:

Arbitrage opportunities

Traders use flash loan transactions to make a profit by spotting price discrepancies across price exchanges and exploiting time. Assuming the price of a token varies on different exchanges, a trader can use a flash loan and a separate smart contract to purchase tokens from one exchange at $2,000 and sell them on another exchange for $2,500 generating $500 profit. Following that, the trader repays the loan and keeps the profit.

Collateral Swaps

In this case, one collateral is used to quickly replace the other used to secure the user’s loan.

Reduced transaction fee

Since a flash loan combines several transactions into one (in some cases), the service fee is reduced. The cost of the transaction is then charged on the loan amount so the borrower suffers lower fees.

Risks involved in Flash Loan Transactions

Over the years, there have been several attacks on flash loans which have resulted in millions of dollars in losses for vulnerable DeFi protocols. The technology behind the Etherum network and DeFi as a whole could use some improvement as malicious actors still find a way to exploit the loaning mechanism in different ways.

Smart contracts are not always built correctly and this can leave loopholes for hackers to exploit. Sometimes, the data received is inaccurate or insecure, which leaves the contract vulnerable to attack, with cyber thieves getting away with millions in loaned capital.

What is a Flash Loan attack?

Flash loan attacks are a type of DeFi attack in which cyber thieves take out flash loans from lending protocols and use them to manipulate the market in their favour. They use smart contract vulnerabilities to cheat the other party or to introduce unwanted modifications to the smart contract code. They are the most common type of DeFi attack, because they are unfortunately easy to get away with. They have also appeared to grow more rampant over the past year, with several high-profile attacks featuring in the news.

How does a Flash Loan attack work?

As mentioned above, flash loans allow users to borrow vast amounts on different exchanges even with zero capital. The loan is granted instantaneously, but you need to do something with the borrowed funds so that you’re able to pay them back.

Because decentralized lenders don’t require collateral, flash loan attackers are able to borrow a lot of funds. They can then manipulate crypto asset funds on one exchange, and resell them on another.

Perhaps the most frustrating part is that the attackers can manipulate the market while still theoretically abiding by the rules. They can also repeat the process multiple times and not leave any trace of themselves behind, and in doing so steal millions.

High-profile examples of Flash Loan Attacks

There seems to have been a recent rise in flash loan attacks. Below are just a few high profile attack examples which illustrate the ease at which these can happen.

dYdX - In the case of the dYdX flash loan attack in early 2020, the attacker used the platform to get the flash loan, then split the lended income, and used it on two different lending platforms, Compound and Fulcrum. The first part of the loan was used to short ETH against WBTC, meaning that Fulcrum had no choice but to acquire WBTC. The order was processed through Uniswap, but Uniswap’s low liquidity meant that the price of WBTC rose significantly, meaning that Fulcrum had to pay significantly more for it.

On the other hand, the attacker also took out a WBTC loan on Compound by using the remaining dYdX loan. With the growth in price, the attacker flipped the borrowed WBTC on Uniswap and generated profits from the same. Subsequently, the attacker paid back their loan to dYdX while pocketing the remaining ETH.

PancakeBunny - PancakeBunny suffered its most recent flash loan attack in May 2021 in which an exploit caused its token to plummet by more than 95% of its original value. In this attack, a large sum of BNB was borrowed through PancakeSwap and used to manipulate the price of BNB and BUNNY in PancakeBunny’s pools. A large amount of BUNNY was stolen and dumped on the market, causing its price to crash.

CREAM Finance - This protocol has also been attacked multiple times in 2021, with the largest heist involving $130 million. The cyber thieves used multiple flash loans and manipulated the pricing of the oracle. They got away with CREAM liquidity tokens to the value of millions of dollars and they’re yet to be caught.

Can you prevent Flash Loan attacks?

As flash loan attacks are still frustratingly common in the DeFi space, it’s obvious that there’s no catch-all solution for them on the market at present. However, there are several steps that can be taken to help prevent them:

Price oracles

It’s a common misconception that Flash Loans create vulnerabilities within DeFi. In reality, flash loan attacks are actually just attacks on oracles. Blockchain oracles such as ChainLink,WitNet and Provable are third-party services which connect smart contracts with the non-DeFi world. They provide a way of securely providing off-chain data to a blockchain network’s on-chain environment.

Increasingly, top DeFi protocols are using decentralized networks of oracles that account for volume and liquidity differences across multiple exchanges and across different transactions. This makes them much more protected from flash loan-funded manipulation.

DeFi security platforms

A key factor allowing cyberthieves to execute flash loans is the delay in response times from DeFi platform developers. In response to this, several security platforms have been developed, with the largest and most well-known being OpenZeppelin Defender.

OpenZeppelin Defender allows project managers to detect smart contract exploits and other unusual activity. This in turn means that they’re able to respond at a much faster pace and take action to neutralize the attacks.

You might also be interested in our article on why security audits don’t work for DeFi anymore.

A turning tide for Flash Loan attacks

It’s evident that Flash Loans themselves are a very valuable tool in DeFi. They are currently prone to numerous attacks, but the tide is beginning to change. With in depth research into the issue, better security tools and uses of pricing oracles, the severity and frequency of these attacks is likely to diminish over time.

It’s also worth remembering that Flash Loans are still currently in their infancy and their uses have yet to be fully explored. Some argue that they will be used for increasingly innovative purposes, such as borrowing funds to buy tokens with the aim of pushing through governance votes. The future holds a lot in store for Flash Loans, so let’s watch this space.

Are you looking for expert advice about blockchain implementation at your company?

Get in touch with me for a free blockchain consultation. You can contact me at dennis.vandervecht@10clouds.com or call me on +48 793 200 141