Flash loans operate on a fundamental property of blockchain transactions called atomicity. According to the analysis, every transaction on networks like Ethereum is all-or-nothing: either every operation inside it completes successfully, or the entire transaction fails and the chain's state reverts to what it was before. This atomicity creates a unique lending model where default is impossible by construction. The lending contract checks at the end of the transaction whether the borrowed amount plus fee has been returned. If it has, the transaction completes and everything inside it becomes permanent. If it has not, the entire transaction reverts, including the original lending step, and the pool's money never actually left.
A flash loan transaction follows a five-step process that begins with the borrower's smart contract calling a lending protocol such as Aave to request a loan. The protocol sends the full amount optimistically before any repayment, followed by the borrower's contract executing its strategy. The fourth step involves returning the borrowed amount plus fee, typically 0.05% on Aave, to the lending pool. The final step verifies the repayment, with the protocol checking whether the borrowed amount plus fee has been returned. As reported, four legitimate jobs account for the vast majority of flash-loan volume: arbitrage, collateral swaps, self-liquidation and refinancing, and liquidations themselves.
Flash loans enable arbitrage opportunities where traders can borrow millions with no collateral to execute large trades that would otherwise require substantial capital. According to the analysis, if ETH trades at $1,780 on one decentralized exchange and $1,790 on another, a trader with $500 can borrow $5 million, execute both legs, repay, and keep the difference. This mechanism keeps prices across DeFi venues closely aligned, with arbitrageurs performing these operations thousands of times daily. The profit margins are competed down to the point where infrastructure, latency, and auction strategy decide who earns them, making casual users rarely profitable.
Liquidation in DeFi operates through automated programs called keepers or liquidator bots that monitor every loan and race to repay debt when health factors cross below 1. The health factor is DeFi lending's solvency score for a loan: collateral value, weighted by each asset's liquidation threshold, divided by debt. Above 1, the loan is safe; below 1, it can be liquidated by anyone. These liquidators earn approximately 5% bonus on capital deployed, often using flash-borrowed capital to complete operations in one transaction. The competition for these yields ensures no unhealthy loans survive long, with liquidations causing price moves that create feedback loops behind many of crypto's sharpest candles.
Flash loans have been used in cumulative losses that run well into the billions across DeFi's history, with individual incidents ranging from six figures to the hundreds of millions. As reported, the crucial point is that flash loans are almost never the vulnerability; they are the funding. The vulnerability is elsewhere, usually in how protocols measure prices or count votes. The April 2022 Beanstalk governance attack exemplified this pattern, where an attacker used flash loans to momentarily acquire a supermajority of governance tokens and extracted approximately $76 million from a protocol that allowed same-block voting. The largest known flash loan was a $1 billion exploit used to manipulate the Beanstalk stablecoin protocol's governance and drain $182 million in assets in April 2022.
