Flash Loan
A flash loan is an uncollateralized cryptocurrency loan that is borrowed and fully repaid within a single blockchain transaction, enabling users to access large amounts of liquidity without capital provided they return the funds — plus a small fee — before the transaction concludes.
Flash loans exploit the atomic nature of blockchain transactions: either every step in a transaction succeeds and the entire sequence is committed to the blockchain, or any single failure causes the entire transaction to revert as if it never happened. This atomicity guarantee makes uncollateralized lending viable at the protocol level — if the borrower fails to repay within the same transaction, the loan itself never legally occurred from the blockchain's perspective. The lending protocol bears zero credit risk as long as its smart contract logic is correct.
Aave, launched in 2020, popularized flash loans as a standalone primitive. Uniswap V2 introduced a similar concept through flash swaps, which allow traders to receive tokens and pay for them by the end of the same transaction. The fee for a flash loan is typically a fraction of a percent of the borrowed amount, making them cheap relative to the capital accessed.
Legitimate use cases for flash loans are numerous. Arbitrageurs use them to simultaneously buy an asset on one decentralized exchange where it is underpriced and sell it on another where it is overpriced, capturing the spread without needing capital of their own. Liquidators in lending protocols use flash loans to purchase a borrower's collateral at a discount and immediately sell it to repay the flash loan, profiting from the liquidation bonus. Self-liquidation allows sophisticated borrowers to repay their own debt positions using a flash loan, avoiding external liquidation penalties. Portfolio rebalancing, collateral swaps, and leverage unwinding are other common applications.
However, flash loans have also been used as attack vectors. By combining a flash loan with price oracle manipulation on a low-liquidity asset or with a vulnerability in a protocol's accounting logic, attackers have drained hundreds of millions of dollars from DeFi protocols since 2020. Notable examples include the bZx attacks in 2020, the Cream Finance exploit in 2021, and numerous others. In many cases the attacker returned no funds — the transaction reverted cleanly and they simply profited from the price differential they had manufactured.
From a regulatory standpoint, flash loans exist entirely on-chain and involve no custodian, no creditworthiness check, and no legal agreement in the traditional sense. This makes them genuinely novel from a financial regulation perspective. US regulators have not issued specific guidance on flash loans, though activity involving manipulation of markets — even purely on-chain — could potentially be characterized as market manipulation under the Commodity Exchange Act or securities laws if the affected assets are deemed securities or commodities. For participants in DeFi, flash loans represent both a powerful tool and a reminder that smart contract composability creates systemic risk pathways that traditional risk frameworks do not fully capture.