In DeFi, Flash Loans were the first uncollateralized loan option available and were originally designed for developers. Simply put, a Flash Loan allows a borrower to easily and quickly obtain a loan without providing collateral with the condition the liquidity is returned to the loan pool within one Ethereum transaction block. While most of the loans in the DeFi space are required to be over collateralized, a Flash Loan requires no up front capital at its inception. This lack of a capital requirement essentially removes the barriers to entry to the DeFi space making Flash Loans an extremely attractive and useful tool for everyone, angel and devil alike.
There are basically four uses for Flash Loans: arbitrage, wash trading, collateral swapping and flash minting. Anything further than identifying these uses within this article is beyond the scope thereof. But there is one specific nefarious use of a Flash Loan that demonstrates the risks of such Loans within the DeFi system. Just ask anyone associated with Harvest Finance what this is as it cost Harvest Finance upward of $34 million in value and sent the value of the Harvest token tumbling some 65%. Yes, the devilish Flash Loan attack. The attacker in the Harvest Finance case performed an arbitrage attack using a large Flash Loan to target Harvest's liquidity pools.
While the Flash Loan provides a new source of profit in the DeFi space, a Flash Loan likewise provides opportunity for malicious and nefarious actors to manipulate prices within the DeFi markets and the various pools therein. Such was the case in the Harvest Finance hack, which was initiated by the attackers sourcing 50,000,000 USDC and 18,300,000 USDT Flash Loans from Uniswap. By using the Y Pool in Curve Finance, the attackers were able to manipulate the price of USDC and USDT for their benefit and profit (The USDC and USDT obtained by the Flash Loan drove down the price of the assets allowing the hacker to exploit the resulting impermanent loss thereby producing the profit. With the excess funds the Flash Loan was repaid and a tidy profit pocketed). Of course, this is an oversimplification of the Harvest attack but suffice it to say it brings into focus the risks inherent of Flash Loans in the DeFi Space.
It should be noted here that Harvest Finance distributed the returned funds ($2,500,000 from the hackers) pro-rata to its victims and launched a $100K bounty for those who might help return the funds. Furthermore, the Harvest Finance team is taking the necessary steps to protect itself from future Flash Loan attacks. The team investigated using price oracles from Chainlink and Maker but found them not to be a solution to the problem (if there is a price differential between the oracle and the liquidity pool, the vault can be exposed to Flash Loan and arbitrage attacks). But, by requiring deposits of value and withdrawals of value to be recorded in separate transactions, Flash Loan attacks are rendered infeasible. This dual requirement means higher gas fees must be paid as a trade off for reduced risk of this type of attack. And finally, the Team could increase the economic cost of launching Flash Loan attacks by setting a lower threshold for stricter deposit arbitrage checks.
In my opinion, utilizing Flash Loans is not an investment tool for the new investor and/or the faint of heart. The processes involved require knowledge developed over time and varied experiences in investing. But if you are researching Cryptocurrencies and land upon Flash Loans I hope this article provides a simplified basic explanation of what they are and the inherent risks associated therewith.
I am merely an ordinary small investor who likes to share what I've learned through research into the Crypto World. I am not in any way a financial advisor and as such, do your own research before investing. If you enjoyed this article please like it, comment and/or tip. Feedback is always welcome here.
