Flash Loans Explained: What They Are and How They Work

# Flash Loans Explained: What They Are and How They Work

Flash loans are one of the most unusual financial instruments ever created. They exist only in decentralized finance, have no equivalent in traditional banking, and allow anyone to borrow millions of dollars with zero collateral — as long as the loan is repaid within the same blockchain transaction.

That sounds impossible. In traditional finance, it would be. But the unique properties of blockchain transactions make flash loans not only possible but practical. They are used for arbitrage, liquidation, collateral swaps, and — unfortunately — exploits.

This guide explains how flash loans work at a technical level, what they are used for, the risks they introduce, and why they matter for the future of DeFi lending.

Risk Warning: Flash loans are an advanced DeFi concept. They require smart contract programming knowledge to use directly. Flash loan exploits have resulted in hundreds of millions of dollars in losses across DeFi protocols. This article is educational — not a guide to executing flash loan strategies.

What Is a Flash Loan?

A flash loan is an uncollateralized loan that must be borrowed and repaid within a single blockchain transaction. If the borrower fails to repay the loan (plus any fees) by the end of the transaction, the entire transaction reverts — meaning it is as if the loan never happened.

The Key Properties

• No collateral required. Unlike every other form of lending in both traditional finance and DeFi, flash loans require zero upfront capital.
• Atomic execution. The borrow, use, and repay must all happen in one transaction. There is no time delay — the loan exists for the duration of a single block's transaction execution.
• Automatic reversal. If repayment fails, the entire transaction is rolled back by the Ethereum Virtual Machine (EVM). The lender loses nothing because the loan effectively never occurred.
• Permissionless. Anyone can execute a flash loan. There is no credit check, no application, and no approval process.

Why This Only Works on a Blockchain

In traditional finance, a loan exists over time. You borrow money on Monday and repay it on Friday. During that time, the lender is exposed to credit risk — the risk that you will not repay.

On a blockchain like Ethereum, transactions are atomic. Either every step within a transaction succeeds, or the entire transaction fails and all state changes are reversed. This atomicity is what makes flash loans possible. The lender is never actually at risk because the EVM guarantees that if repayment does not occur, the borrow never happened.

How Flash Loans Work: Step by Step

A flash loan transaction typically follows this sequence:

1. Borrow — The user's smart contract calls a flash loan provider (like Aave or dYdX) and requests a loan of a specific token amount.
2. Execute logic — Within the same transaction, the borrowed funds are used for some purpose — arbitrage, collateral swap, liquidation, or another operation.
3. Repay — The smart contract returns the borrowed amount plus a fee to the flash loan provider.
4. Validation — The flash loan provider's contract checks that it has been fully repaid. If yes, the transaction completes. If no, the entire transaction reverts.

All four steps happen in a single Ethereum transaction. From the outside, it looks like one operation. The entire sequence either succeeds completely or fails completely.

The Fee Structure

Flash loan providers charge a small fee, typically:

• Aave V3: 0.05% for standard flash loans (reduced from the original 0.09%)
• dYdX: No explicit fee (uses a different mechanism where you must leave slightly more than you borrowed)
• Uniswap V3/V2: 0.3% (technically flash swaps, not flash loans, but similar in function)
• Balancer: Flash loan functionality with no fee on the flash loan itself

These fees are paid to liquidity providers or the protocol treasury, depending on the provider.

What Flash Loans Are Used For

Flash loans have several legitimate and widely-used applications.

1. Arbitrage

Arbitrage is the most common use case. If the same token is trading at different prices on two decentralized exchanges, a flash loan can be used to:

1. Borrow a large amount of the token (or the token used to buy it).
2. Buy the token on the cheaper exchange.
3. Sell it on the more expensive exchange.
4. Repay the flash loan plus fees.
5. Keep the profit.

Without flash loans, this arbitrage would require significant upfront capital. Flash loans democratize access — anyone who can write or use the smart contract can capture the arbitrage, regardless of their existing capital.

Important note: Arbitrage opportunities on major DEXs are extremely competitive. Professional arbitrage bots using sophisticated MEV (Maximal Extractable Value) strategies dominate this space. Casual users should not expect to find easy arbitrage opportunities.

2. Collateral Swaps

If you have an open lending position (say, ETH collateral backing a USDC loan on Aave) and you want to switch your collateral to a different asset (say, wstETH), you would normally need to:

1. Repay your entire loan.
2. Withdraw your collateral.
3. Swap it for the new collateral.
4. Redeposit and re-borrow.

With a flash loan, this can be done in one transaction:

1. Flash borrow USDC to repay the loan.
2. Withdraw the ETH collateral.
3. Swap ETH for wstETH.
4. Deposit wstETH as new collateral.
5. Borrow USDC against the new collateral.
6. Repay the flash loan with the newly borrowed USDC.

This saves gas costs (one transaction instead of four), avoids temporary exposure to price movements, and eliminates the need to hold extra capital for the swap.

3. Self-Liquidation

If your lending position is approaching liquidation and you want to avoid the liquidation penalty, you can use a flash loan to:

1. Flash borrow enough to repay your debt.
2. Repay the debt, freeing your collateral.
3. Withdraw the collateral.
4. Sell enough collateral to repay the flash loan.
5. Keep the remaining collateral.

This can be significantly cheaper than being liquidated by a third party, which typically involves a 5-10% penalty.

4. Liquidating Other Users

Liquidators use flash loans to liquidate undercollateralized positions on lending protocols. The liquidator:

1. Flash borrows the debt token.
2. Repays the borrower's debt on the lending protocol.
3. Receives the borrower's collateral at a discount (the liquidation bonus).
4. Sells the collateral for the debt token.
5. Repays the flash loan.
6. Keeps the profit (the liquidation bonus minus the flash loan fee and gas).

This is a critical function for DeFi lending — liquidators keep protocols solvent by ensuring that undercollateralized positions are closed.

5. Yield Optimization and Refinancing

Flash loans can be used to move positions between protocols, refinance debt at lower rates, or restructure complex positions — all in a single transaction.

Flash Loan Exploits: The Dark Side

Flash loans have been used in some of the largest DeFi exploits in history. The ability to borrow enormous sums without collateral amplifies attack vectors that might otherwise be impractical.

How Flash Loan Attacks Work

Most flash loan attacks exploit vulnerabilities in other protocols — not in the flash loan mechanism itself. Common attack patterns include:

• Price oracle manipulation: The attacker uses a flash loan to execute a massive trade on a DEX, temporarily moving the price. If a lending protocol uses that DEX as a price oracle, the manipulated price can be exploited to borrow more than the collateral is worth, or to trigger unfair liquidations.
• Governance attacks: Flash-borrowed tokens can sometimes be used to vote on governance proposals within the same transaction (though most protocols now have safeguards against this).
• Reentrancy exploits: The flash-borrowed funds are used to trigger reentrancy bugs in vulnerable contracts.

Notable Flash Loan Exploits

Several major incidents illustrate the scale of damage:

• bZx (February 2020): Two attacks in the same week exploited price oracle weaknesses. The first attack netted approximately $350,000; the second approximately $600,000. These were among the first flash loan attacks and exposed vulnerabilities in DeFi oracle design.
• Harvest Finance (October 2020): An attacker used flash loans to manipulate Curve Finance pool prices, exploiting Harvest's reliance on those prices. The exploit resulted in approximately $34 million in losses.
• Pancake Bunny (May 2021): A flash loan attack manipulated PancakeBunny's price calculations, resulting in approximately $45 million in losses.
• Cream Finance (October 2021): A flash loan attack exploiting price oracle manipulation resulted in approximately $130 million in losses — one of the largest flash loan exploits to date.
• Euler Finance (March 2023): While not purely a flash loan attack, flash loans were used as part of the exploit that drained approximately $197 million from the protocol. (Most funds were eventually returned.)

These exploits highlight a critical reality: Flash loans do not create vulnerabilities, but they amplify existing ones by giving attackers access to virtually unlimited capital within a single transaction.

How Protocols Defend Against Flash Loan Attacks

After years of exploits, the DeFi ecosystem has developed several defenses:

• Time-weighted average price (TWAP) oracles resist single-block manipulation by averaging prices over multiple blocks.
• Chainlink and other external oracles provide price feeds from multiple sources, making manipulation much harder.
• Governance timelocks prevent flash-borrowed tokens from being used to vote on proposals within the same transaction.
• Borrowing caps limit the maximum amount that can be flash-borrowed from a single pool.
• Block-delay mechanisms require users to wait at least one block before using deposited assets, preventing within-transaction exploitation.

Flash Loans vs. Traditional Lending

| Feature | Flash Loans | Traditional Loans | DeFi Collateralized Loans | |---------|------------|-------------------|--------------------------| | Collateral required | None | Yes | Yes (typically 150%+) | | Duration | Single transaction | Days to years | Open-ended | | Credit check | None | Yes | None | | Maximum amount | Limited by pool liquidity | Limited by lender | Limited by collateral | | Risk to lender | Zero (atomic reversal) | Credit/default risk | Liquidation mechanism | | Accessibility | Requires coding ability | Requires credit history | Anyone with collateral | | Use case | Arbitrage, liquidation, swaps | General purpose | Leverage, liquidity |

Who Can Use Flash Loans?

Flash loans require interaction with smart contracts. You cannot execute a flash loan through a standard wallet interface. To use them directly, you need:

• Solidity programming knowledge — You must write or deploy a smart contract that implements the flash loan logic.
• Understanding of DeFi protocols — You need to know how DEXs, lending protocols, and other contracts work at the code level.
• Gas optimization skills — Complex flash loan transactions can be expensive. Inefficient code may make the operation unprofitable.

No-Code Flash Loan Tools

Several tools have emerged that allow less technical users to execute flash loan strategies without writing code:

• Furucombo — A drag-and-drop interface for building DeFi transactions, including flash loans.
• DeFi Saver — Offers automated position management tools that use flash loans under the hood for collateral swaps and self-liquidation.

These tools lower the barrier to entry but still require a solid understanding of what you are doing. Incorrect configuration can result in failed transactions (which still cost gas) or unintended outcomes.

Flash Loan Providers

The major flash loan providers as of 2026:

• Aave V3 — The most widely used flash loan provider, deployed on Ethereum, Arbitrum, Optimism, Polygon, Avalanche, Base, and other chains. Charges a 0.05% fee.
• dYdX — Offers flash loan functionality through its margin trading system. No explicit fee.
• Uniswap V3 — Supports flash swaps, which function similarly to flash loans. The fee depends on the pool's fee tier (0.01%, 0.05%, 0.3%, or 1%).
• Balancer — Provides flash loan functionality through its vault architecture.
• MakerDAO — Offers flash minting of DAI (flash loans of newly minted DAI that must be burned within the same transaction).

The Bigger Picture: Why Flash Loans Matter

Flash loans represent something genuinely new in finance. They demonstrate that blockchain's atomic transaction model enables financial operations that are impossible in traditional systems.

For DeFi health: Flash loans improve market efficiency by enabling arbitrage (which keeps prices consistent across exchanges) and liquidations (which keep lending protocols solvent).

For financial access: They eliminate the capital barrier to certain financial operations. A developer with no capital can execute the same arbitrage as a hedge fund — if they can write the code.

For security: They force DeFi protocols to be more robust. Any protocol that can be exploited with unlimited capital within a single transaction has a design flaw. Flash loans expose these flaws, which ultimately makes the ecosystem stronger — though often at significant cost to early users.

Risks and Limitations

• Technical complexity. Direct flash loan use requires smart contract development skills.
• Transaction costs. Failed flash loan transactions still cost gas fees, which can be substantial on Ethereum mainnet.
• Competition. Profitable flash loan opportunities (especially arbitrage) are dominated by sophisticated MEV bots.
• Exploit amplification. While flash loans do not create vulnerabilities, they provide the capital to exploit them at scale.
• Regulatory uncertainty. Flash loan exploits exist in a legal gray area. Whether they constitute theft, market manipulation, or simply clever use of permissionless protocols remains unresolved in most jurisdictions.

Bottom Line

Flash loans are a uniquely DeFi innovation — uncollateralized loans that are risk-free for lenders because of blockchain's atomic transaction model. They serve important functions in the ecosystem, from keeping markets efficient through arbitrage to enabling capital-efficient position management.

They also carry real risks, primarily for the broader ecosystem rather than the borrower. Flash loan exploits have cost DeFi protocols hundreds of millions of dollars and have driven significant improvements in oracle design, governance security, and smart contract architecture.

For most users, flash loans are something to understand conceptually rather than use directly. But understanding how they work gives you a clearer picture of how DeFi lending actually functions — and why security and oracle design matter so much in this space.

Disclaimer: This article is for educational and informational purposes only and does not constitute financial, investment, or tax advice. Flash loans involve significant technical risk, and their use in exploitative strategies may carry legal consequences. Always conduct your own research and consult appropriate professionals before engaging with DeFi protocols.

*Bill Rice is a fintech consultant with over 15 years of experience in the lending industry. He writes about crypto lending, DeFi, and digital asset strategies at CryptoLendingHub.com.*