The Growing Problem of Flash Loan Attacks and How to Neutralize Them

Flash loans have become immensely popular in the last couple of years. Just like any other disruptive innovation, it has attracted the attention of malicious actors. The cyberthieves have been exploiting vulnerabilities in DeFi protocols to carry out flash loan attacks. 

Since flash loans take place in the same blockchain transaction and don’t require any collateral, they enable investors to take advantage of arbitrage opportunities. But they also allow hackers to carry out flash loan attacks without any financial deterrent.

Flash loan attacks don’t cost the attacker much, but the rewards are massive for them. An attacker needs only a bit of ingenuity, an Internet connection, and a computer to carry out a flash loan attack. In contrast, the 51% attacks require massive computing resources.

There have been numerous flash loan attacks in the last few months. Most of the targeted DeFi protocols are based on the Binance Smart Chain. For instance, the multi-chain incubator Impossible Finance posted on social media on June 21 that it suffered a flash loan attack resulting in a loss of around 230 ETH. 

Belt Finance, Pancake Bunny, BurgerSwap, Meerkat Finance, and SafeMoon are a few other victims of flash loan attacks. Pancake Bunny suffered a massive attack resulting in the loss of 700,000 BUNNY and 114,000 BNB tokens.

According to recent estimates, a staggering $167 million worth of tokens were siphoned off from the Binance Smart Chain protocols by perpetrators in May 2021 alone. The money DeFi protocols lose in flash loan attacks is lost forever.

Fortunately, the DeFi protocols could take a series of preventive measures to avoid the risk of such attacks. Protocols like Hoard Market, which recently launched its flash loan feature, aren’t letting their guards down. Hoard Market CEO Radek Zagorowicz says:

“Hoard puts a lot of effort into securing our Flash Loan feature. For example, borrowers can not manipulate the interest level set by lenders. We also leave no room for flash loan attacks on other Hoard Market contracts i.e. Loan or Stake by implementing market proven solutions.”

A quick primer on flash loans

Obtaining loans without collateral is incredibly difficult in traditional finance. But in DeFi, you can take an uncollateralized flash loan and repay it with a small fee as long as everything happens within the same transaction on the Ethereum blockchain. In short, you get unsecured loans without credit checks, credit limit or collateral.

Marble protocol was the first to introduce the uncollateralized flash loans. But the lending protocol Aave has made it popular. Many other DeFi protocols such as Hoard Market have also launched the flash loan functionality. 

An Ethereum blockchain transaction involves multiple atomic operations. All the operations have to happen successfully, otherwise the entire transaction will be rolled back and none of the steps would occur. As simple as that.

DeFi protocols charge a tiny fee for providing you flash loans. For example, Hoard Market charges just 0.01% for flash loans in HRD tokens and 0.02% in other tokens. Borrowers must repay the loan within the same transaction. So, there is no risk of borrowers defaulting on their loans.

You can take a flash loan to exploit the arbitrage opportunities or swap the collateral. If you are using HRD tokens as collateral to borrow DAI tokens on the Hoard Market, you can swap the collateral from HRD to another token that the marketplace supports.

What are flash loan attacks?

It’s worth pointing out that the flash loan attacks don’t create vulnerabilities in DeFi protocols. They just expose the existing vulnerabilities. But they have definitely brought our attention to integrity and security in DeFi because more than $54 billion worth of assets are locked in DeFi protocols.

In a flash loan attack, the cybercriminal takes a flash loan from a lending protocol just like a regular borrower. Then they combine it with a few other tricks to manipulate the market in their favor without violating the blockchain rules.

The cyberthieves use vulnerable centralized oracles to temporarily become a whale, gaining the capital and leverage they need to manipulate the market. It means protocols relying on a sole price oracle are easy targets of flash loan attacks. 

In most attacks, the hacker tricks the lending pool into believing that they have repaid in full, even though they haven’t in reality. The attackers pull it off by temporarily manipulating the price of the token to repay the loan.

In the case of Pancake Bunny, the flash loan attack caused its BUNNY token to decline more than 95% in value. Since there is no limit to how much you can borrow, the attackers borrowed massive amounts of the BNB token on PancakeSwap. They used the borrowed BNB to manipulate the prices of USDT/BNB and BUNNY/BNB token pairs. 

It enabled the attackers to steal massive amounts of the BUNNY token, which they dumped on the market. The token’s price subsequently plummeted more than 95%. The attacker then repaid the flash loan on PancakeSwap and walked away with approximately $3 million in profit. 

Experts believe that such issues will disappear as the technology matures and DeFi protocols keep fixing vulnerabilities. But some argue that these attacks will continue to haunt DeFi protocols.

Is there a way to prevent flash loan attacks?

Flash loan attacks are a recent phenomena, so there is no straightforward way to prevent them yet. But DeFi protocols could take a series of steps to up their defenses. Here are a few of them:

• Enabling interconnectivity of centralized exchanges will ensure that the oracles rely on multiple exchanges rather than just one. It will also provide increased volume and greater liquidity differences to protect DeFi protocols against flash loan attacks.
• Forcing transactions to go through at least two blocks also strengthens the protection, according to Dragonfly Research. But most DeFi protocols avoid it because it could make the user interface messier.
• Using the flash loan attack detection tools such as OpenZeppelin Defender allows DeFi protocols to detect unusual activities and smart contract exploits. The protocols can act swiftly to neutralize the attacks.
• Using decentralized pricing oracles rather than relying on a single DEX for price feed will also make it more difficult to manipulate prices and reduce the probability of flash loan attacks.

Conclusion

Even though flash loan attacks have become increasingly common, there are measures that DeFi protocols can put in place to dramatically reduce the risk or neutralize the attacks. Since the DeFi technology is still in the early stages, new vulnerabilities will continue to be exposed and fixed.