Flash loans

1. TL;DR

A flash loan lets anyone borrow any amount of an asset with zero collateral, on the condition that the borrowed amount plus a small fee is repaid before the same transaction ends — if repayment fails, every step of the transaction is undone automatically, as if it never happened, so the lender can never actually lose money. That single guarantee turns flash loans into a capital equalizer: an arbitrageur, a liquidator, or a self-liquidating borrower no longer needs their own capital, just a profitable (or debt-clearing) sequence of actions. The same equalizing power is exactly why flash loans have funded some of DeFi’s most damaging attacks — bZx (February 2020), Cream Finance (October 2021, /lending/money-markets/) and others used borrowed capital not to steal it directly, but to momentarily move a price or a pool’s balance far enough to make an unrelated exploit profitable.

2. Explain it simply

Analogy

Imagine a car rental kiosk with one absolute rule: you can take any car, for free, as long as you bring it back to the same spot before the attendant blinks. If you don’t make it back in time, a magic clause instantly rewinds the entire outing — the car reappears at the kiosk and nothing you did with it in between ever happened, including any damage or any purchases you made along the way. Because the rewind is guaranteed, the kiosk doesn’t need to check your driver’s license, your income, or hold a deposit.

ELI5

Normally if you want to borrow coins, you have to leave a toy behind as security. A flash loan skips that entirely — you can borrow as many coins as you want with nothing left behind, but only if you give every coin back, plus a tiny extra fee, before you’re done with your turn. If you can’t give them all back in time, it’s like the whole turn gets erased and never happened, so the piggy bank never actually loses anything.

Step-by-step walkthrough

Scenario: an arbitrageur spots ETH trading at two different prices on two decentralized exchanges, DEX A and DEX B (illustrative numbers).

Before the transaction (state: nothing has moved). ETH trades at $2,980 on DEX A and $3,020 on DEX B. The arbitrageur owns no capital of their own beyond enough to pay gas.
Step 1 of the transaction: borrow. The arbitrageur’s contract requests a flash loan of 1,000,000 USDC. The lending pool transfers the funds immediately and calls back into the arbitrageur’s contract to let it act.
Step 2: buy low. The contract spends the 1,000,000 USDC on DEX A at $2,980/ETH, receiving roughly 335.57 ETH (before DEX A’s own price impact).
Step 3: sell high. The contract immediately sells that ETH on DEX B at $3,020/ETH, receiving roughly 1,013,421 USDC (again, before DEX B’s own price impact).
Step 4: repay. The contract repays the 1,000,000 USDC principal plus a 0.05% fee (500 USDC) — 1,000,500 USDC — back to the lending pool, all within the same transaction.
End of transaction (state: settled). The arbitrageur keeps 1,013,421 − 1,000,500 = 12,921 USDC of profit; the lending pool ends the transaction with exactly its principal plus fee intact, never having been exposed to any risk of non-repayment, because if step 5 had failed for any reason, steps 2–4 would have been reverted along with it.

Common misconceptions

Myth: Flash loans are themselves an exploit or a bug. Reality: A flash loan is a normal, intended feature — Aave’s docs call it a transaction that “allow[s] the borrowing of an asset, as long as the borrowed amount (and a fee) is returned before the end of the transaction” (Aave docs, fetched 2026-08-29); the attacks exploit something else (an oracle, a reentrancy gap, a missing check), with the flash loan only supplying capital.
Myth: Flash loans require the lender to trust the borrower. Reality: No trust is required — the “loan” only exists within one atomic transaction, which simply fails to execute if repayment doesn’t happen.
Myth: You need to be a whale to front-run or liquidate on Ethereum. Reality: As one ethresear.ch commenter put it: “Frontrunners use Flash Loan for this. They just have to have enough ETH to pay for gas, the rest is borrowed from protocols such as Aave or Compound” (ethresear.ch 10689, reply, 2021-09-11).
Myth: All flash loans charge a fee. Reality: Aave’s default is “initialized at deployment to 0.05% and can be updated via Governance Vote” (Aave docs, fetched 2026-08-29), but Jupiter Lend advertises the opposite: “Borrow and repay within a single transaction with zero fees and no collateral” (Jupiter developer docs, fetched 2026-08-29).
Myth: Flash loans are Ethereum-only because Solana has no mempool. Reality: The mechanism only depends on transaction-level atomicity, which both chains provide; Solana’s lack of a public mempool changes MEV dynamics (/mev/solana-mev/) but not whether a same-transaction loan can exist.

If you only remember one thing

A flash loan isn’t free money — it’s free capital for one transaction, refundable-or-it-never-happened, which is exactly what makes it equally useful for honest arbitrage and for funding an attack that needs a large, momentary balance sheet.

3. How it works

The atomicity guarantee

A flash loan is possible because a blockchain transaction (Ethereum) or a transaction’s instruction sequence (Solana) is all-or-nothing: either every state change inside it commits, or none do. Aave’s docs describe the execution flow directly: the borrower’s contract “requests a flash loan from the Pool contract,” the “Pool transfers the requested amounts… then calls executeOperation()” on the borrower’s receiver contract, the receiver “executes arbitrary operations with the loaned funds,” and finally repayment happens via an approval the Pool pulls — and “all of the above happens in 1 transaction (hence in a single ethereum block),” so if repayment fails, the entire transaction reverts (Aave docs, “Flash Loans,” fetched 2026-08-29).

Simple vs. multi-asset flash loans

Aave V3 offers two entry points: flashLoan(), which can draw multiple reserves at once and even optionally open an ordinary debt position instead of repaying immediately, and the gas-cheaper flashLoanSimple(), restricted to a single reserve, which cannot open debt and always requires same-transaction repayment (Aave V3 technical paper, 2022-01, §3.4; Aave docs, fetched 2026-08-29). A receiver contract must implement IFlashLoanReceiver or IFlashLoanSimpleReceiver and grant the Pool an allowance to pull back principal plus fee — the docs note the receiving contract should “never permanently hold funds due to griefing attack risk” (Aave docs, fetched 2026-08-29).

Who pays the fee, and who doesn’t

Aave V3 introduced a “Permitlist on flashloans”: governance can whitelist specific FLASH_BORROWER addresses to waive the fee entirely, intended for trusted integrations that generate other value for the protocol (Aave V3 technical paper, 2022-01, §3.4). The same paper’s own threat model flags the obvious risk of that convenience: “if the address is a proxy, it could allow anyone to call flashloans through it to waive fees for all,” eliminating the fee revenue liquidity providers would otherwise earn (Aave V3 technical paper, 2022-01, §4.7).

What flash loans are legitimately used for

Arbitrage, as walked through in §2 — capturing a price discrepancy across two venues without needing standing capital.
Collateral swaps and debt refinancing — repaying a loan on one protocol, withdrawing collateral, and re-depositing it elsewhere (or at a better rate) in one atomic step, without ever needing the capital to bridge the gap.
Self-liquidation — a borrower whose own position has crossed its liquidation threshold can flash-borrow the exact amount needed to repay their own debt, avoiding a third party’s liquidation bonus (see /lending/liquidations/).
Funding third-party liquidations — the same mechanism that funds arbitrage lets any keeper bot liquidate a position of arbitrary size without holding the repayment capital themselves, which is precisely how most liquidation bots operate in practice.

What flash loans make possible for attackers

None of this capital-sourcing power is itself malicious, but it removes the one practical constraint — “do you have enough money” — that used to bound how large a price manipulation or reentrancy drain could be. If a protocol’s own logic has a genuine flaw, a flash loan lets an attacker supply however much capital that flaw needs to be maximally exploited in a single transaction, then repay the loan out of the exploit’s own proceeds — turning even a modest bug into a total-liquidity-scale loss.

4. Worked numeric example

Extending §2’s arbitrage precisely: flash-borrow 1,000,000 USDC at Aave V3’s default 0.05% fee. Fee owed: $1{,}000{,}000\times0.0005 = 500$ USDC, so total repayment is 1,000,500 USDC.

Buy on DEX A at $2,980/ETH: $1{,}000{,}000 / 2{,}980 = 335.57$ ETH received (ignoring DEX A’s own price-impact curve for simplicity — see /exchange/cfmm-math/ for how a real AMM trade of this size would move DEX A’s own price).
Sell on DEX B at $3,020/ETH: $335.57\times3{,}020 = 1{,}013{,}421$ USDC received.
Repay: $1{,}013{,}421 - 1{,}000{,}500 = 12{,}921$ USDC net profit, realized entirely within one transaction, with zero starting capital beyond gas.

If instead the attacker’s goal were to manipulate a thinly-traded price feed rather than capture an existing spread — the bZx pattern below — the same borrowed capital could push an illiquid pool’s price out of line and borrow against the resulting inflated valuation elsewhere: same arithmetic shape, only the profit source changes from “two markets disagree” to “I just made one market disagree with reality.”

5. Where it’s used

Ethereum

Aave — flashLoan() and flashLoanSimple(), described in full above; widely regarded as the protocol that popularized flash loans as a standard DeFi primitive. Aave docs
dYdX and Uniswap — dYdX’s Solo Margin protocol and Uniswap’s flash-swap functionality (withdraw first, pay or return within the same transaction) are the other commonly cited early flash-loan-capable designs from the same 2019–2020 period bZx’s attackers exploited (background context; not independently verified against a raw primary source for this page).
Every major money market — Compound, Morpho, and others have since added comparable functionality; the mechanism has become a standard expectation of any serious lending protocol rather than a differentiator.

Solana

Jupiter Lend — advertises flash loans as “zero fees and no collateral,” per its own docs (Jupiter developer docs, fetched 2026-08-29) — a notably more aggressive fee model than Aave’s governance-adjustable default.
Kamino Lend — lists “Flash Loans” as a documented advanced feature in its own architecture docs, alongside its referral system and elevation groups (Kamino architecture docs, 2026-08 fetch) — the fetched excerpt did not include Kamino’s specific fee parameters.
marginfi (rebranded Project 0 / P0) — supports flash loans as a first-class primitive; the exact mechanics of how a flash loan’s state is tracked per-account became the subject of the vulnerability described below (Asymmetric Research, fetched 2026-08-29).

6. Risks, attacks, and incidents

bZx attacks, 14 and 18 February 2020 (Ethereum). Two attacks within four days, among the first flash-loan-funded exploits to draw wide attention. In the first (2020-02-15), a 5x-leveraged position routed 5,637 ETH through thin Uniswap liquidity for only 51 WBTC, and a logic bug meant the protocol’s own shouldLiquidate() check never triggered — a reported ~$620K pool loss (as of 2020-02), attacker profit ~$370K (secondary: palkeo.com, accessed 2026-08-29). In the second (2020-02-18), the attacker drained liquidity from two independent price sources (Uniswap and Synthetix, via Kyber) simultaneously, so bZx’s cross-source sanity check passed even though both feeds were manipulated the same direction — a reported $600–645K loss, ~2,378 ETH (secondary: palkeo.com; CoinDesk, 2020-02-19). Both used flash loans purely as the capital source; the actual vulnerabilities were a missed liquidation check and insufficiently independent oracles — see /oracles/oracle-manipulation/.
marginfi flash-loan vulnerability, disclosed 17 September 2025 (Solana) — no funds lost. Asymmetric Research found a newly added transfer_to_new_account instruction “fails to check whether the account being transferred is in the middle of a flash loan,” which would have let an attacker open a flash loan on one account, transfer the resulting liability to a fresh account, then close the original loan without repaying — stranding debt with no offsetting collateral, ~$160M in deposits at risk (as of 2025-09) had it been exploited (Asymmetric Research, fetched 2026-08-29). Found and patched pre-exploit: “this bug shows how a small and seemingly harmless change in a well-audited, carefully designed codebase can introduce a critical vulnerability” (Asymmetric Research, fetched 2026-08-29).
Cream Finance, October 2021 (Ethereum) — flash-loan-funded exploitation of Cream’s reserves; covered in /lending/money-markets/, where the deeper story is pooled-market integration risk.
Governance-power attacks. A flash loan can, in principle, briefly acquire enough governance-token voting power to pass a malicious proposal in one block if governance doesn’t require tokens held (not borrowed) across a delay — a known risk category, though this page’s sources include no primary post-mortem of a specific incident.
Self-liquidation arbitrage against liquidation bonuses. A borrower can flash-loan the exact amount to repay their own debt, front-running third-party liquidators to capture the bonus themselves — not a bug, but a redistribution described in /lending/liquidations/.

7. Open problems

Should the fix target flash loans, or the flaws they merely fund? Every incident here was actually a failure elsewhere — a missing check, an insufficiently independent oracle, an unchecked instruction — with the flash loan only supplying scale; none of this page’s sources argue for restricting flash loans themselves.
Is a fee-waiver permitlist worth its centralization risk? Aave’s threat model flags that a compromised FLASH_BORROWER proxy “could allow anyone to call flashloans through it to waive fees for all” (Aave V3 technical paper, 2022-01, §4.7) — a live governance judgment call, not a solved question.
What does zero-fee flash lending change? Jupiter Lend’s design removes the small friction Aave’s 0.05% fee imposes on flash-loan-funded attacks; whether that measurably changes attacker behavior on Solana is not addressed by this page’s sources.
How much liquidity concentration is safe given flash loans exist. Once flash loans exist, the meaningful constraint on an attacker is no longer capital but opportunity — a thinly-traded pool or a poorly-designed check (ethresear.ch 10689, 2021-09-10) — pushing the security burden onto protocol design rather than capital requirements.

8. Ethereum vs Solana

Aspect	Ethereum	Solana
Canonical implementation	Aave `flashLoan()`/`flashLoanSimple()`, dYdX, Uniswap flash swaps	Jupiter Lend, Kamino Lend, marginfi/P0
Default fee	0.05% at deployment, governance-adjustable (Aave)	0% advertised (Jupiter Lend); Kamino/marginfi fee not specified in this page’s sources
Fee-waiver mechanism	Aave’s permitlisted `FLASH_BORROWER` role	Not documented in this page’s sources
Best-documented incident	bZx, February 2020 — oracle/liquidation-check manipulation funded by flash loans	marginfi, September 2025 — flash-loan account-tracking bug, caught pre-exploit
Atomicity source	Single Ethereum transaction / block	Single Solana transaction’s instruction sequence

The underlying mechanism — atomicity guaranteeing the lender can never actually lose money — is identical on both chains; the practical difference in this page’s sources is maturity and disclosure outcome. Ethereum’s flash-loan history includes realized, successful attacks with real losses (bZx, and Cream via /lending/money-markets/) dating to the earliest days of the primitive, while the one Solana-specific flash-loan issue documented here (marginfi) was caught and patched by a security researcher before any funds were lost — though this reflects only the incidents captured by this page’s sources, not necessarily a complete history of either ecosystem.

9. Reference doc

The reference

Flash Loans — Aave documentation, fetched 2026-08-29. aave.com/docs/developers/flash-loans

Summary of the reference

The docs define a flash loan plainly: “special transactions that allow the borrowing of an asset, as long as the borrowed amount (and a fee) is returned before the end of the transaction.” The execution flow is a four-step callback pattern: the borrower’s contract requests funds from the Pool; the Pool transfers the requested amount(s) and immediately calls executeOperation() on the borrower’s receiver contract; the receiver contract runs arbitrary logic with the borrowed funds; and repayment happens through a pre-granted allowance the Pool pulls back before the transaction ends. All four steps happen in a single transaction, so a failed repayment simply reverts everything.

Two entry points are documented. flashLoan() supports multiple reserves in one call and can, for permitted borrowers, open an ordinary open-ended debt position instead of requiring same-transaction repayment. flashLoanSimple() is restricted to a single reserve, is more gas-efficient, always requires same-transaction repayment, and never waives its fee. The default premium is set at protocol deployment to 0.05% of the borrowed amount, adjustable later by governance vote, with the resulting revenue split between liquidity providers and (optionally) the protocol treasury. Receiver contracts must implement the correct interface (IFlashLoanReceiver or IFlashLoanSimpleReceiver) and are explicitly warned never to permanently hold borrowed funds, since doing so creates griefing-attack exposure for whoever built the integration.

Key quotes

“Flash Loans are special transactions that allow the borrowing of an asset, as long as the borrowed amount (and a fee) is returned before the end of the transaction.” (§What It Is)

“All of the above happens in 1 transaction (hence in a single ethereum block).” (§Mechanics, Atomicity Requirement)

“The flash loan fee is initialized at deployment to 0.05% and can be updated via Governance Vote.” (§Fee Structure)

“flashLoanSimple(): Single reserve only; more gas efficient; fee not waived; cannot open debt positions.” (§Two Options)

Your contract must “never permanently hold funds due to griefing attack risk.” (§Key Requirements)

How to read the original

Background needed: what a smart contract callback is (a function the Pool calls back into on your contract mid-transaction), and the concept of atomic transactions from /foundations/accounts-and-execution/. Nothing substantial to skip — the docs page is short and implementation-focused. The one subtlety worth pausing on is the fee-waiver mechanic: “fee waived for approved borrowers” sounds like a minor detail, but it’s the exact mechanism Aave’s own technical paper’s threat model flags as a centralization and revenue risk if the approved address is ever a shared proxy (Aave V3 technical paper, 2022-01, §4.7) — read the two documents together rather than in isolation.

What changed since

The original flash-loan attack wave (bZx, 2020) predates Aave V3’s flashLoanSimple() and permitlist features entirely — those were added specifically in response to years of observed flash-loan usage patterns, both legitimate and adversarial.
Fee models have since diverged across chains: Jupiter Lend’s zero-fee Solana flash loans (documented in this page’s §5) represent a meaningfully different design point than Aave’s governance-adjustable 0.05% default, not present anywhere in Aave’s own documented history.
The marginfi disclosure (September 2025) shows the flash-loan attack surface has moved, on Solana at least, from “flash loan funds an external protocol exploit” (the bZx/Cream pattern) toward “a flash loan’s own state-tracking logic is itself the vulnerability” — a more self-referential failure mode than anything in Aave’s documented threat model.

Secondary references

Aave V3 Technical Paper, §3.4 and §4.7 (2022-01-27) — read for the permitlist/fee-waiver design and its own threat-model callout, which the plain docs page above doesn’t cover.
palkeo.com, “bZx hacks” technical writeup (accessed 2026-08-29, secondary) — read for the most detailed step-by-step transaction analysis of both February 2020 attacks available among this page’s sources.
Asymmetric Research, “Threat Contained: marginfi Flash Loan Vulnerability” (fetched 2026-08-29) — read for a rare public example of a flash-loan-adjacent bug caught and disclosed before exploitation, rather than after a loss.

10. Sources

Flash Loans — Aave documentation — fetched 2026-08-29 — https://aave.com/docs/developers/flash-loans
Aave V3 Technical Paper — Emilio Frangella, Lasse Herskind (Aave) — 2022-01-27 — https://raw.githubusercontent.com/aave/aave-v3-core/master/techpaper/Aave_V3_Technical_Paper.pdf
Where do runners of frontbots get so much liquidity? — naddika, MetaHawq (ethresear.ch) — 2021-09-10 — https://ethresear.ch/t/where-do-runners-of-frontbots-get-so-much-liquidity/10689
Jupiter Lend developer docs — fetched 2026-08-29 — https://developers.jup.ag/docs/lend
Protocol Architecture — Kamino Lending docs — fetched 2026-08-29 — https://www.mintlify.com/kamino-finance/klend/concepts/architecture
Threat Contained: marginfi Flash Loan Vulnerability — Asymmetric Research — fetched 2026-08-29 — https://blog.asymmetric.re/threat-contained-marginfi-flash-loan-vulnerability/
bZx hacks (technical writeup) — palkeo.com (secondary) — accessed 2026-08-29 — https://www.palkeo.com/en/projets/ethereum/bzx.html
Everything You Ever Wanted to Know About the DeFi ‘Flash Loan’ Attack — CoinDesk (secondary) — 2020-02-19 — accessed 2026-08-29 — https://www.coindesk.com/tech/2020/02/19/everything-you-ever-wanted-to-know-about-the-defi-flash-loan-attack