Crypto Flash Loans: How Uncollateralized DeFi Loans Work

Most loans start with a question about trust. The lender wants collateral, a credit history or both, because there is always a chance the borrower walks away with the money.

A crypto flash loan skips that question entirely. You can borrow millions of dollars in stablecoins or ETH with nothing posted up front, on one condition: the money has to come back, plus a small fee, before the same transaction finishes.

That sounds like a trick, and in a way it is one. It only works because of how blockchains like Ethereum process transactions, and it has become both a useful tool for traders and a favourite instrument for attackers.

What a crypto flash loan actually is

A flash loan is an uncollateralized loan that is borrowed and repaid inside a single blockchain transaction. There is no repayment schedule and no interest rate in the usual sense. The loan exists for a fraction of a second, between the first step of the transaction and the last.

The idea went mainstream with Aave, which launched flash loans as part of its lending protocol in January 2020. Today the same pattern shows up across DeFi: lending pools, some decentralized exchanges and specialised vaults all let smart contracts borrow their idle liquidity this way.

The important word is "smart contracts". You don't take out a flash loan from a website form. You write, or use, a contract that borrows, does something with the money and pays it back, all in one go.

How a flash loan works, step by step

On Ethereum, a transaction is atomic. Either every step inside it succeeds, or the whole thing is reverted as if it never happened. Flash loans are built on that guarantee.

A typical flow looks like this:

1. Your contract asks the lending pool for, say, 1,000,000 USDC.
2. The pool sends the tokens and calls a function in your contract.
3. Your contract runs whatever logic it was written for: swaps, repayments, collateral moves.
4. At the end, the pool pulls back the loan plus the fee.
5. If the money isn't there, the entire transaction reverts.

Step five is what makes the lender comfortable. If the borrower can't repay, the loan simply never happened. The pool's funds never really left, and the only thing the borrower loses is the gas they paid to try.

That also means flash loans are not a way to keep borrowed money. Nothing leaves the transaction unless the debt has been settled.

What people use flash loans for

A flash loan is just temporary capital. Its value comes from what you can do with a large balance for one transaction. The most common legitimate uses are fairly technical.

Arbitrage. If ETH trades at a different price on two DEXs, a contract can borrow stablecoins, buy on the cheaper venue, sell on the dearer one and repay the loan, keeping the spread minus fees. This kind of trade competes with other bots, which links flash loans closely to MEV and transaction ordering.

Collateral swaps. Someone with a loan backed by ETH who wants to switch to wrapped bitcoin would normally need to repay the debt first. A flash loan can repay the debt, release the ETH, swap it, post the new collateral and reopen the loan in one transaction.

Self-liquidation and refinancing. A borrower close to liquidation can use a flash loan to close their own position on better terms than a liquidator would offer, or move a loan to a protocol with a lower rate.

Liquidations. Liquidation bots often use flash loans to repay someone else's undercollateralized debt, claim the discounted collateral and repay the flash loan from the proceeds.

In each case the borrower doesn't need the capital overnight. They need it for one atomic operation, and a flash loan is cheaper than tying up their own funds.

Crypto flash loan providers and their fees

Only protocols that hold a lot of idle liquidity can offer flash loans, so the list of crypto flash loan providers is short and dominated by big DeFi names.

Aave. The best known source. On Aave V3 the flash loan fee was set at 0.05% of the borrowed amount when the protocol launched, and governance can change it. Aave V2 charged 0.09%. Some approved borrowers have the fee waived.

Uniswap. Uniswap calls its version flash swaps. You can receive tokens from a pool before paying for them, as long as you return them or pay with the other token by the end of the transaction. The normal swap fee applies, which was 0.3% on Uniswap V2 pools.

Balancer and others. Balancer vaults and several lending markets also allow flash borrowing, each with its own fee rules set by governance.

Fees are small in percentage terms, but they add up on large loans. Borrowing $1 million on Aave V3 at 0.05% costs $500 before gas, so a strategy has to earn more than that to be worth it.

Flash loan attacks: how the money gets lost

The same features that make flash loans useful make them dangerous in the wrong hands. A flash loan gives anyone, however small their own balance, temporary control over a huge amount of capital. If a protocol has a weakness that only becomes exploitable with lots of money, a flash loan removes that barrier.

It is worth being precise here. In most "flash loan attacks" the flash loan isn't the bug. The bug is somewhere in the victim protocol, and the loan is the lever used to pull it.

The most common pattern is price manipulation. A protocol that reads prices from a single DEX pool can be fooled: the attacker uses borrowed money to push the pool price up or down, then borrows against or liquidates positions at the false price. This is why lending markets moved towards decentralized price feeds such as Chainlink oracles, which are much harder to move within one transaction.

Another pattern is governance capture. If voting power depends on token balances at the moment of voting, a flash loan can buy a temporary majority.

Real flash loan attack examples

bZx, February 2020. Two attacks on the bZx lending platform within days of each other used flash loans to manipulate prices on thin markets. They were among the first to show the technique in the wild.

Beanstalk, April 2022. An attacker borrowed close to $1 billion in assets, including from Aave, and used it to gain about two-thirds of Beanstalk's voting power. They passed a malicious proposal through an emergency function and drained the protocol. Losses were put at about $182 million, with the attacker keeping roughly $76 million to $80 million in ETH.

Euler Finance, March 2023. A flash loan was used to exploit a flaw in Euler's donateToReserves function across several pools, taking about $197 million. In an unusual ending, the attacker returned the recoverable funds after negotiations a few weeks later.

None of these protocols failed because flash loans exist. They failed because their logic could be broken by someone who briefly held a lot of money, and flash loans made that someone easy to become.

Risks for ordinary users

Most people will never call a flash loan contract. The practical risks for everyday DeFi users are indirect.

If you deposit into a protocol that relies on a single pool for prices, or lets voting power be borrowed, your funds can be drained by someone who never had to own much. Checking how a protocol sources its prices, whether it has been audited, and how its governance handles sudden voting power is more useful than worrying about flash loans themselves.

Be wary of anything sold as a "flash loan bot" that promises easy profits. Real flash loan arbitrage is a crowded, technical game run by professional searchers. Scams that ask you to fund a contract, or to connect your wallet to "activate" a flash loan strategy, are a well-known way to lose money.

Do flash loans make DeFi better or worse?

Flash loans make capital more efficient. Anyone who can write the code gets the same access to liquidity as a large fund, which tightens prices across exchanges and makes refinancing and liquidations smoother.

They also mean every protocol must assume an attacker can hold the whole pool's worth of money for one transaction. Teams that design with that in mind, using robust oracles, time delays on governance and careful accounting, tend to be fine. Teams that don't are tested very quickly.