Flash Loans initially appeared on the crypto market in 2018 but did not really stand out. By the time it was launched on the Ethereum network in 2020, this form of lending was gradually being applied more widely and diversely. Let's find out what flash loans are and how they work, as well as the advantages and disadvantages of flash loans in the article below.

What are flash loans in cryptocurrency?

Flash loans are an instant loan in the crypto world, borrowed and paid back in the same block of transactions. Borrowers must implement a profitability or maximum exploitation value (MEV) strategy to ensure this loan makes sense.

*MEV is the maximum value that a miner or validator of transactions on a blockchain can earn by re-ordering, inserting, or removing transactions in a block*

Flash loans do not require the borrower to hold capital and the lender bears limited financial risk, as the contract code only enforces a guarantee that the loan will be repaid, including service fees.

DeFi services that offer flash loans will check if the borrower has paid back the funds within the same block. If the transaction does not pay back, the contract will not release capital in the first place. Borrowers must take immediately profitable actions, such as running MEV bots, arbitrageurs, and protocol mining to ensure sufficient profits to repay the original loan.

How to make flash loans?

Flash loans are performed by MEV bots and users have the ability to program complex transactions to borrow and return money in a single transaction.

Flash loans can be invoked from various DeFi protocols such as MakerDAO's DssFlash (loan DAI) or AAVE (loan any token deposited into AAVE). These contracts only accept function call flash loans if the caller returns the money in the same block, so users often have to set up a separate Smart Contract to customize to perform multiple actions at the same time.

Most MEV bots will wrap all of their functions in a single transaction. This means that loan and return transactions will appear on the same transaction page on analytics tools like Arkham. During that period, they will make profitable trades, allowing observers to see exactly what steps the MEV bot took to profit from the flash loan.

Do you have to pay back flash loans?

Flash loans are created and repaid instantly within the same block of transactions, so the borrower does not actually keep the borrowed capital. Unlike other DeFi loans, flash loans do not require collateral. This means that if there are no return transactions in the same block, the flash loan contract will reject the request, preventing the borrower from taking the money without paying it back.

Therefore, you must return the flash loan as soon as you receive it. If the flash loan request is not accompanied by a return transaction in the same block, the loan will never occur. This ensures that no one can borrow money that cannot be paid back immediately, and without the risk of liquidation like other DeFi loans.

Flash loans provide great flexibility to MEV Searchers and programmers looking for arbitrage opportunities, allowing them to work with virtually unlimited capital while operating on-chain. The only cost is the gas fee for activating the flash loan.

How are Flash loans used?

Flash loans are popular among MEV users because they allow users to exploit opportunities to leverage large sums of capital for instant profits in a single transaction. As you can imagine, there are a lot of people who want risk-free profits! This makes the flash loan landscape quite competitive. Flash loans are most commonly seen when MEV bots liquidate protocol users – for example, when loan positions go into liquidation mode on AAVE or MakerDAO. Often these positions will have to be sold across multiple liquidity pools – so flash loans allow MEV Bots to have more capital to work with when taking on and liquidating these DeFi positions.

Flash loans are sometimes used by MEV Bots to execute transactions, pay gas fees – and then repay the loan with profits from an arbitrage trade. Some MEV users use flash loans to fund new wallets with gas, simply by programming an effective arbitrage strategy and using the flash loan profits to pay transaction fees.

Are flash loan attacks still effective?

Flash Loan Attacks refer to the use of flash loans as part of a protocol attack or market manipulation for profit. Typically, flash loan attacks occur through a re-entrancy bug or an oracle manipulation bug.

Re-entrancy is when a certain DeFi Function Call (e.g. “Borrow” or “Repay” function) is manipulated and ‘re-entered’ to trick the protocol's contracts into performing the wrong function. For example, one of the most famous attacks in crypto, The DAO hack in 2016, was a re-entrancy bug. The attacker exploited a bug in the withdraw function to 'withdraw' all assets, before The DAO's contracts updated his internal balance. This means that an attacker can continuously ‘loop’ this withdrawal function without the contract realizing that he has withdrawn more ETH than his total deposit.

Oracle manipulation occurs when an attacker convinces a DeFi protocol to trade or lend its assets at a false price, and exploits this to drain the protocol's valuable assets at an unprofitable price. . For example, an attacker manipulated Alpha Homora contracts in early 2021 to withdraw millions of dollars from Cream's Iron Bank, a bank that conducts protocol lending. The attacker convinced Alpha Homora contracts to issue sUSD without incurring protocol debt. This resulted in the attacker borrowing millions of dollars from the protocol at the wrong price – and withdrawing $37 million from Iron Bank.

Since flash loans are completely neutral in the way they are made, the borrower only needs to make a transaction that yields any type of profit. On-chain contracts do not differentiate between profiting from legal arbitrage or illegal withdrawals from users – so attackers will continue to use these strategies to hack protocols. The only defense is for developers to ensure their code is resistant to bugs and exploits before they accept user funds.

How to make money with flash loans?

It is possible to make money with flash loans by looking for an arbitrage opportunity or profitable action that can be taken within a block of trades. It is also necessary to include a function to return the flash loan amount in the original transaction. This can be done by creating a custom smart contract that can do at least three things – borrow transaction, arbitrage, and return the amount.

Of course, the current MEV landscape is very competitive. To seriously compete with the top searchers and arbitrageurs, you will need to connect directly with validators to submit your trades. This is because transactions submitted directly via mempool can be seen by every participant – and often other MEV participants will be able to see and execute the profitable strategies you have found in advance . That's why you often see MEV bots 'bribing' validators - or including a transaction to send a percentage of profits to validators. This is to ensure that the MEV bot's trades are prioritized over their competitors, and thus they can execute and profit from an arbitrage opportunity.

Case study: flash loan attack vào Beanstalk Finance

Beanstalk Finance is an on-chain stablecoin protocol that was exploited via a flash loan attack on its governance mechanism. The attacker used a flash loan to collect a large amount of Beanstalk's governance token, STALK, to immediately approve and execute a malicious proposal to drain the protocol's assets. Since Beanstalk uses on-chain governance, it relies entirely on other users to recognize and vote against a given proposal. The attacker needs to wait 7 days before implementing their proposal – but during that time, no user of the protocol has examined the contract code to see what it actually does.

The attacker created two proposals: Proposal 18 would steal all the funds in the protocol, and Proposal 19 would donate $250,000 to the Ukrainian crypto donation address. However, proposal 19 was named Bip18 – intended to mislead any viewers into believing that proposal 18 was simply donating $250,000 from the protocol to Ukraine.

Once the review period had passed, the attacker was able to make the actual 18th offer, withdrawing more than $180 million from Beanstalk contracts. To do this, they had to flash loan $1 billion in various stablecoins from AAVE – they then used this money to buy all available STALK (Beanstalk's governance token) on decentralized exchanges central. With the accumulated STALK, they could vote through the malicious proposal, sell the remaining STALK, and profit over $70 million after paying back AAVE's flash loans. End game for Beanstalk.

Beanstalk Finance Attack Transaction Kết luận

While flash loans can be used for a variety of purposes, the most common is to maintain the benefits of the DeFi ecosystem – with arbitrage and liquidation performed by MEV bots that can execute code to manage positions and pools. Well-known ‘flash loan’ attacks on protocols are much rarer. Currently, the flash loan ecosystem has matured to the point where MEV bots, the most popular takers of flash loans, actually have to bid for opportunities to use them and often pay block validators heavy fees to get them. the right to exercise arbitrage or liquidation.