Flash-Loan Attack
Pronunciation: FLASH LOHN uh-TAK
Definition
A flash-loan attack uses uncollateralized, transaction-scoped borrowing to manipulate vulnerable decentralized-finance logic and extract value before atomic repayment. For Flash-Loan Attack, an attempted action, a detected indicator, a confirmed compromise, and a realized loss are separate states that require different evidence and response. Flash-Loan Attack must be evaluated through its prerequisites, entry point, affected asset or trust boundary, attacker capability, observable indicators, and possible financial or operational impact.
Overview
A flash loan allows assets to be borrowed and repaid within one blockchain transaction, with the entire transaction reverting if repayment fails. An attack combines this temporary capital with vulnerable protocols, markets, or governance mechanisms to create profitable state changes.
Common paths involve oracle manipulation, thin-liquidity pricing, reentrancy, faulty collateral valuation, governance voting, liquidation logic, or interactions across protocols with incompatible assumptions. The flash loan supplies scale but is not itself the underlying vulnerability.
Defenses include robust time-weighted or multi-source pricing, manipulation-resistant liquidity assumptions, transaction simulations, borrowing limits, invariant checks, and review of composability. Teams should model an attacker with large temporary capital and the ability to execute many operations atomically.
A flash-loan attack uses uncollateralized, transaction-scoped borrowing to manipulate vulnerable decentralized-finance logic and extract value before atomic repayment. Flash loans amplify vulnerable economic logic, so protocols must remain safe even when attackers can access large capital within one transaction.
Assessment of Flash-Loan Attack should trace the use of uncollateralized, transaction-scoped borrowing to manipulate vulnerable decentralized-finance logic and extract value before atomic repayment from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving uncollateralized should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Flash-Loan attack path should be tested against the architecture associated with uncollateralized.
Retesting for Flash-Loan Attack should reproduce the Flash-Loan attack path involving uncollateralized, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.
Key Takeaway
Flash loans amplify vulnerable economic logic, so protocols must remain safe even when attackers can access large capital within one transaction.
Sources
- NIST Documentation: Cyberframework — NIST (2026-07-30)
- FATF Documentation: Virtual Assets — FATF (2026-07-30)