Flash Loan

A flash loan is a loan in decentralized finance that requires no collateral but must be borrowed and paid back, with a small fee, inside the same blockchain transaction. If the borrower's code fails to return the funds by the end of that transaction, the network cancels every step of it, as if the loan had never been made. Because the lender either gets its money back or nothing happens at all, it can lend large sums to anyone without checking their identity or credit. They are often written in the plural, flash loans.

Flash loans became widely available on Ethereum in 2020, when the lending protocol Aave launched them, and similar features were offered by other protocols such as dYdX, Balancer and Uniswap, whose version was called a flash swap. They are used for arbitrage, refinancing and collateral swaps, but also in exploits; the latter are described under flash loan attack. Aave's version is covered in more detail under flash loans on Aave.

Imagine a shop that will lend anyone a thousand pounds with no questions asked, as long as the money is handed back before they walk out of the door. If the borrower tries to leave without paying, a magic rule rewinds time to the moment before the loan was made. The shop can never lose, so it does not need a credit check or a deposit.

A blockchain transaction works like that visit to the shop. A program borrows the money, uses it for some quick job, such as buying a coin cheaply in one place and selling it for more in another, and repays the loan plus a fee. All of this happens in one go, in a few seconds. If any step fails, everything is undone.

1. A user deploys or calls a smart contract that asks a lending pool for a flash loan of a given amount.
2. The pool sends the funds to the contract and hands control to the borrower's code.
3. The borrower's code carries out its plan, such as trades on several exchanges or repaying another loan, all within the same transaction.
4. The code returns the borrowed amount plus the fee to the pool.
5. The pool checks its balance. If it has been repaid, the transaction completes; if not, the whole transaction reverts and only the gas spent is lost.

This is possible because blockchain transactions are atomic: they either succeed in full or fail in full, a property also used in atomic swaps. The fee is a small percentage of the amount borrowed and goes to the pool's liquidity providers. Using flash loans requires writing or using smart-contract code, although some tools let non-programmers assemble the steps.

• Arbitrage. Traders exploit price gaps between decentralized exchanges without having their own capital, as described under flash loan arbitrage.
• Collateral swaps. A borrower can replace one type of collateral backing a loan with another in a single step, instead of repaying and re-borrowing.
• Self-liquidation and refinancing. Users can repay a loan at risk of liquidation, withdraw their collateral and sell part of it to repay the flash loan, or move a debt to a protocol with a lower rate.
• Liquidations. Liquidation bots can borrow the funds needed to repay unhealthy loans on DeFi lending platforms and collect the liquidation reward.

Flash loans make large sums of capital available to anyone for the length of one transaction. That levels the field for small traders, but it also hands attackers enough money to manipulate prices on pools with thin liquidity, influence token-weighted governance votes or exploit bugs in other contracts. Many of the largest DeFi exploits have involved flash loans, though the loans themselves are usually a tool rather than the flaw. The underlying weaknesses tend to be protocols that rely on a single exchange's spot price, or a poorly protected blockchain oracle, and governance systems that count votes held for only a moment.

Defences include using time-weighted or multi-source price feeds, requiring tokens to be held for some time before they can vote, and auditing contracts for behaviour under extreme, short-lived balances. For borrowers, the main risk is failed transactions: if a trade becomes unprofitable before execution, the loan reverts and gas fees are still lost, and profitable opportunities are often taken first by automated bots that pay higher fees for priority.

Flash loans fall in a grey area. They are offered by code rather than by licensed lenders, involve no credit check and last only seconds, so they fit poorly into lending law. Regulators have focused mainly on the wider question of how DeFi platforms should be supervised and on prosecuting people who use flash loans to commit fraud or market manipulation.

• Aave documentation