- Short answer: a flash loan is a loan that exists only inside one blockchain transaction and must be repaid by its end, otherwise the whole transaction is reverted. That means no default risk, no collateral, and loan size up to a whole pool, which was above USD 1 billion on Aave in September 2020.
- The first academic study of flash loans (Qin, Zhou, Livshits, Gervais) dissects two February 2020 attacks on the bZx platform that earned about USD 350 thousand and USD 600 thousand, with returns on invested capital above 500,000%.
- In the first, a 10,000 ETH flash loan helped push a small Uniswap pool so that bZx bought WBTC at 109.79 ETH per WBTC against a market price of 36.55. In the second, trades in thin pools moved the price feed used by bZx from 268.30 to 108.44 sUSD per ETH.
- These are historical events on specific contracts that have been fixed or retired. The lesson is the pattern: a price read from a thin pool can be moved inside one transaction, and anything that trusts it can be fooled.
Short answer. A flash loan is a loan that lives and dies inside one transaction. You borrow, do things, and repay before the transaction ends; if you cannot repay, the blockchain reverses everything as if the loan never happened. Since the lender cannot lose, no collateral is needed, and the size can be a whole pool. In February 2020 two traders used this to profit from the bZx platform, and an academic paper dissected how.1
What is a flash loan, and why is it possible?
The paper defines it: a loan that is only valid within one atomic blockchain transaction and fails if the borrower does not repay before the end. Three properties follow: no debt default risk for the lender, no collateral, and size limited only by the pool. As of September 2020, the largest flash loan pool, on Aave, offered over USD 1 billion.1
The authors also show that atomicity increases arbitrage revenue, because a trader can act on a price gap with capital borrowed for that one transaction. So the technique is neutral; what matters is what the borrowed capital is used for.
What happened in the first bZx attack, 15 February 2020?
The paper reconstructs the transaction. The trader borrowed 10,000 ETH from dYdX. Part of it, 5,500 ETH, went as collateral to Compound to borrow 112 WBTC. Then the trader opened a 5x short on ETH against WBTC on the margin platform bZx, with 1,300 ETH of its own collateral. bZx executed the trade on Uniswap, swapping 5,637.62 ETH for only 51.35 WBTC at 109.79 ETH per WBTC, while the market price was 36.55: the liquidity providers behind bZx overpaid by nearly three times. The Uniswap pool was small (about 2,817 ETH), so the trade moved its price a lot.1
After repaying the flash loan the trader was ahead by 71.41 ETH and held a 112 WBTC debt secured by 5,500 ETH. Over the next two days the trader bought the 112 WBTC in small pieces and redeemed the collateral, for a total gain of 1,193.69 ETH. The paper calculates the loan providers’ loss at 2,330.86 ETH and notes that the check that would have blocked the trade, for negative equity of the margin position, existed in the bZx code but was not invoked properly.1
What happened in the second attack, 18 February 2020?
The second used a bZx flash loan of 7,500 ETH and exploited a different weakness: the price source. The lending platform bZx took the sUSD per ETH price from Uniswap and a Kyber reserve. The attacker converted part of the ETH into sUSD in these thin markets, which pushed the price from 268.30 to 108.44 sUSD per ETH, while other DeFi platforms remained at 268.30. With the platform’s own view of the price distorted, the attacker locked the purchased sUSD as collateral and borrowed far more ETH than the real value allowed. The paper puts the attacker’s gain at 2,381.41 ETH, and the lenders’ loss at about 2,699.97 ETH.1
How big were these attacks, and what did the authors add?
The authors estimate the two attacks earned about USD 350 thousand and USD 600 thousand, and note returns on invested capital above 500,000%. They then formulate finding attack parameters as an optimization problem, and show that the two attacks could have been “boosted” to profits of 829.5 thousand and 1.1 million USD. We do not describe the optimization. It is a warning to platform designers: once such an attack is known, the best version is mathematically searchable.1
What a trader or user can take from this
- A price on a DEX is a number in a pool, not the market. The first attack moved a small Uniswap pool by a large factor inside one transaction. Pool size matters: see slippage and price impact.
- Liquidators and bots live on the same blockchain. The way liquidations and other bots compete, and who profits, is in how DeFi liquidations work on Aave and Compound and what MEV is and how bots front-run DEX trades.
- Liquidity providers are the victims. In both attacks the losses fell on lenders or liquidity providers. How liquidity providers lose to informed flow even without attacks is in do liquidity providers lose money to arbitrageurs?.
- Know what the protocol trusts. If it reads its price from one thin pool, assume that price can be moved.
- These are historical events. The platforms and contracts have changed since; do not treat the numbers as a description of today’s DeFi.
This article describes published research for education. It is not a guide to attacking any system.
This is educational material, not investment advice.
Footnotes
-
Qin, K., Zhou, L., Livshits, B., Gervais, A., “Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit”, arXiv:2003.03810v4 (20 March 2021); full text of the PDF read. Abstract and introduction: definition, three properties, Aave pool above USD 1 billion in September 2020, atomicity and arbitrage revenue, ROI above 500,000%, attacks of about USD 350 thousand and USD 600 thousand, boosted profits of 829.5 thousand and 1.1 million USD (2.37 and 1.73 times). Section 3.1 (pump and arbitrage of 15 February 2020): dYdX 10,000 ETH loan, Compound 5,500 ETH collateral and 112 WBTC, bZx 5x short with 1,300 ETH, 5,637.62 ETH swapped for 51.35 WBTC at 109.79 ETH per WBTC against 36.55, Uniswap pool 2,817.77 ETH, 71.41 ETH after the flash loan, redemption with 4,377.72 ETH, adversary gain 1,193.69 ETH, loan provider loss 2,330.86 ETH, the unused negative-equity check. Section 3.2 (oracle manipulation of 18 February 2020): bZx 7,500 ETH flash loan, oracle from 268.30 to 108.44 sUSD per ETH on Uniswap and Kyber, adversary gain 2,381.41 ETH, lender loss about 2,699.97 ETH. ↩ ↩2 ↩3 ↩4 ↩5 ↩6
Frequently asked questions
What is a flash loan?
A flash loan is a loan that is valid only within one atomic blockchain transaction and must be repaid before the end of that transaction; if it is not, the transaction is reverted. According to the paper this brings three properties absent in traditional finance: no debt default risk for the lender, no need for collateral, and loan sizes up to a whole liquidity pool.
Why do flash loans need no collateral?
Because the lender is guaranteed to be repaid. A blockchain transaction can be reverted during its execution if the condition of repayment is not satisfied, so a flash loan that cannot be repaid is simply never granted.
How did the first bZx attack in February 2020 work?
On 15 February 2020 a trader took a 10,000 ETH flash loan from dYdX, put 5,500 ETH as collateral on Compound to borrow 112 WBTC, and opened a 5x short ETH position on bZx. bZx swapped 5,637.62 ETH on Uniswap for only 51.35 WBTC, at 109.79 ETH per WBTC against a market price of 36.55. The paper’s calculation gives the adversary a total gain of 1,193.69 ETH, about USD 350 thousand.
What is oracle manipulation?
It is distorting the price source that a lending platform relies on. In the second bZx attack, on 18 February 2020, the attacker’s trades moved the sUSD per ETH price on Uniswap and a Kyber reserve, which bZx used as its price oracle, from 268.30 to 108.44, while other platforms stayed at 268.30. The paper puts the adversary’s gain at 2,381.41 ETH.
Are flash loans themselves illegal or dangerous?
The paper treats them as a neutral technique: they also increase arbitrage revenue by letting traders act with capital they do not own. The danger comes from applications that trust prices which can be moved within a single transaction. The attacks described are historical and the platforms involved have changed since.
Sources
- Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit. Kaihua Qin, Liyi Zhou, Benjamin Livshits, Arthur Gervais. arXiv:2003.03810v4 [cs.CR], 20 March 2021 (full text read), 2021
This article is research, not investment advice. Results on history do not guarantee future results.