What Are Flash Loans? How They Work, How to Use Them, and How Attackers Exploit Them

Flash loans represent a relatively new means of financing that eliminates the deficiencies of centralized and even blockchain-based solutions. 

Such platforms as Aave, Compound and Celsius make it possible to get some liquid currency such as ETH in a few clicks of a mouse. And yet, they come with their own limitations. To get funds, you still have to pledge collateral to prove your solvency and thus freeze the money until you pay back the loan.

Flash loans on blockchain take a step further and eliminate the necessity to submit any collateral at all. How does this innovation work and what pitfalls can await those who rely on this method?

Let’s take a closer look.

What is a Flash Loan?

A flash loan is a type of uncollateralized loan that is borrowed and fully repaid within a single atomic blockchain transaction. If repayment does not occur before the transaction closes, the entire operation is automatically reversed by the smart contract as if it never happened. There is no ‘minutes’ window — the loan lives and dies within one block.

Similar to the TradFi processes, a flash loan implies borrowing assets and returning them with an interest in a risk-free manner.

However, there are a few features that make this process different:

• Instant transactions. A borrower doesn’t need to submit any documents and wait for the approval. With flash loans, one gets the funds and returns them instantly within a single transaction. 
• Smart contracts. These are special tools that help to ensure that all the conditions of a deal are met before transferring funds from one party to another. With flash loans, it’s not the borrower who repays the loan but the code of the program. 
• Unsecured loan. Unlike traditional loans, flash loans do not require any collateral to ensure the repayment of debt. Thanks to smart contracts and the short time of the whole operation, borrowers return the funds straight away.

Flash Loan Platform Comparison

Not all flash loan platforms are equal. Here is how the three major platforms compare on the metrics that matter most to borrowers:

👉 Quick takeaway: Aave V3 offers the deepest liquidity and broadest chain coverage for most flash loan use cases. dYdX charges zero flash loan fees, making it the lowest-cost option for Ethereum arbitrage. Uniswap V3 flash swaps are best when arbitrage or collateral swaps happen within the same DEX ecosystem.

Aave V3 is the most widely used platform for flash loans as of 2026, with multi-chain deployment across more than eight networks and a reported daily flash loan volume of approximately $2 billion across major platforms. Aave’s governance approved the V4 hub-and-spoke liquidity architecture in March 2025, which is designed to consolidate cross-chain liquidity into a single unified pool, reducing gas costs and deepening available liquidity for flash loan borrowers.

Use Cases of Flash Loans

Here comes the next logical question. What use can one make of such a loan that implies returning the funds so quickly? The key use cases include the following:

• Arbitrage. Due to the overall inconsistency of the crypto market, assets may have different values on different exchanges. Traders who discover such opportunities may use flash loans to make profits on these differences.
• Collateral swaps. Flash loans enable traders to swap their collaterals in a single block of transactions.
• Self-liquidation. Users can save their funds from liquidation by closing their collateralized debts with flash loans.

Regardless of the case, the process in general looks as follows:

1. A trader takes a flash loan in some liquid currency, e.g. DAI.
2. He or she uses the funds for closing positions or for exchanging cryptocurrencies.
3. Once the goal is achieved, the trader automatically returns the funds to the pool.

As mentioned earlier, all of these transactions happen almost instantaneously one after the other. It is impossible to perform all these transactions manually in such a fast manner. This is where smart contracts come to help once more. 

Developers with specific technical knowledge can build contracts that would make flash loans on their behalf. Those who don’t have the required skills can rely on out-of-the-box solutions such as Collateral Swap or DeFi Saver that can help to perform flash loans without coding.

How to Execute a Flash Loan

For users who want to execute flash loan strategies without writing Solidity, several no-code tools make this accessible. Here is the general process using DeFi Saver as an example:

Step 1: Connect your Web3 wallet (MetaMask or equivalent) to DeFi Saver at defisaver.com. Ensure you have enough ETH or the relevant network’s gas token to cover transaction fees.

Step 2: Navigate to the ‘Recipes’ or ‘Smart Savings’ section. DeFi Saver allows you to build multi-step flash loan transactions visually, including collateral swaps and self-liquidation protection.

Step 3: Define your action sequence. For a collateral swap, you would specify: (a) the asset to borrow via flash loan, (b) the collateral to swap out, (c) the collateral to swap in, and (d) the repayment source.

Step 4: Simulate the transaction. DeFi Saver shows you the expected outcome before you sign. Review the net position change and ensure the math works (repayment amount must be less than the value captured).

Step 5: Sign and submit. The entire sequence executes atomically — if any step fails, the whole transaction reverts and you lose only the gas fee.

For developers, Aave V3’s IFlashLoanSimpleReceiver interface is the standard entry point for custom flash loan contracts. Aave’s developer documentation provides the canonical implementation reference.

Cost to be aware of: Aave V3 charges 0.05% of the borrowed amount as a flash loan fee. On a $100,000 flash loan, that is $50. Gas costs on Ethereum mainnet vary from $20 to $200+ depending on network congestion; on Arbitrum or Optimism, gas is typically under $1.

What is Flash Loan Arbitrage?

Flash loan arbitrage is a strategy in decentralized finance (DeFi) that takes advantage of temporary market inefficiencies using flash loans. The idea is to borrow a large amount of funds for a very short period of time, typically just a few seconds or minutes, and use that capital to take advantage of price discrepancies in the market.

Here is how a real arbitrage transaction works with actual numbers:

1. A price gap opens: ETH is trading at $3,000 on Uniswap and $3,045 on SushiSwap — a 1.5% discrepancy.
2. You take a flash loan of 100 ETH from Aave V3. Aave charges a 0.05% fee = 0.05 ETH (approximately $150 at current price).
3. You buy 100 ETH on Uniswap at $3,000 = $300,000 spent.
4. You immediately sell 100 ETH on SushiSwap at $3,045 = $304,500 received.
5. You repay the flash loan principal plus the 0.05% fee.
6. Gross profit before gas: $4,500. After Aave fee ($150) and estimated gas costs ($20–$80 on L2), net profit is approximately $4,270–$4,330.

Important: This only works if the price gap exceeds your total costs (protocol fee + gas). On Ethereum mainnet, gas costs alone can exceed $100–$200 during congestion, wiping out smaller arbitrage opportunities. This is why most flash loan arbitrageurs now operate on L2 networks like Arbitrum or Optimism where gas costs are a fraction of mainnet.

Aave V3 and V4: What Changed for Flash Loan Borrowers?

Aave V3, launched in 2022, introduced several improvements relevant to flash loan users: multi-chain deployment across Ethereum, Arbitrum, Optimism, Polygon, Avalanche, and other networks; improved capital efficiency through eMode (Efficiency Mode) for correlated assets; and portal features enabling cross-chain liquidity.

The most significant upcoming change is Aave V4, whose hub-and-spoke liquidity architecture was approved by Aave governance in March 2025. Under this model, liquidity is consolidated into a single cross-chain hub rather than fragmented across separate pool deployments. For flash loan borrowers, this means:

• Deeper available liquidity in a single transaction without needing to source funds from multiple pools
• Reduced gas overhead from cross-chain coordination
• A unified liquidity layer that makes large flash loan strategies more capital-efficient

A Bank of Canada staff paper published in early 2026 analyzing Aave V3 lending activity found zero non-performing loans in 2024, attributing this to automated over-collateralization requirements and liquidation mechanisms.

The same analysis noted a trade-off: while risk controls are robust, over-collateralization reduces capital efficiency compared to uncollateralized models. Flash loans, being atomically self-collateralizing, sit outside this trade-off entirely — but they do expose the broader protocol to smart contract exploit risk.

Flash Loan Attacks

Flash loan attacks remain one of the most significant threat vectors in DeFi. Unlike most exploits that require the attacker to have capital at risk, flash loans allow attackers to temporarily control enormous sums — sometimes hundreds of millions of dollars — to manipulate markets, exploit governance mechanisms, or drain liquidity pools, all within a single transaction with zero upfront capital.

Ongoing formal verification work by firms like Certora and Veridise reflects how seriously the industry takes this attack surface.

Some of the largest flash loan attacks in the history of cryptocurrencies include the following cases.

👉 Quick takeaway: All three exploits share a common root: flash loans were used to temporarily control enough capital or voting power to manipulate a system that assumed no single actor could move that much at once. The fix in each case required decoupling sensitive actions from single-block capital positions.

Common pattern: 80%+ of flash loan exploits involve either (a) price oracle manipulation — reading a single DEX spot price that can be moved within one block — or (b) governance manipulation — using flash-loaned tokens to temporarily acquire voting rights. Protocols that have addressed both vectors through TWAP oracles and time-locked governance have significantly reduced their attack surface.

How To Prevent Flash Loan Attacks?

For developers, there are five evidence-backed ways to reduce flash loan attack surface in 2026:

1. Formal verification and smart contract audit. Third-party audits remain the baseline, but leading protocols now go further with formal mathematical verification of contract properties. Certora’s formal verification of Aave V3’s Risk Steward contract (published 2025) is an example of the current standard. Veridise has similarly published formal audit reports for DeFi lending components. A standard audit finds bugs; formal verification proves the absence of entire classes of bugs.
2. Decentralized pricing oracles. Most flash loan attacks manipulate spot prices within the transaction window. Decentralized oracles with time-weighted average prices (TWAPs) are significantly harder to manipulate because they average prices over multiple blocks rather than reading a single spot price.
3. Reentrancy guards and checks-effects-interactions patterns. Many flash loan exploits leverage reentrancy vulnerabilities. Modern Solidity best practice requires reentrancy guards on all external calls and strict adherence to the checks-effects-interactions pattern.
4. Bug bounty programs. DeFi protocols running active bug bounty programs on platforms like Immunefi create economic incentives for white-hat researchers to disclose vulnerabilities before attackers find them.
5. Cross-chain analytics monitoring. New event-driven data infrastructure covering Aave V3 across multiple chains (50M+ records as of 2025-2026) enables real-time anomaly detection for unusual flash loan activity patterns that may indicate an exploit in progress.

Flash Loan Regulation: What You Need to Know

Flash loans occupy an unusual regulatory position. Because they are uncollateralized and atomically self-settling, they do not fit neatly into traditional lending regulation. However, the broader DeFi regulatory environment is tightening in ways that affect flash loan users and protocol developers.

United Kingdom: The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, published in February 2026, establishes a regulatory framework for cryptoasset services operating in or targeting UK markets. While flash loans themselves are not explicitly named, DeFi protocols offering these services to UK users may fall within scope depending on their structure and whether they have identifiable operators.

European Union: The Markets in Crypto-Assets (MiCA) regulation is now in full implementation across EU member states. MiCA primarily targets crypto-asset issuers and service providers (CASPs), but its reach into DeFi is evolving. The European Parliament is actively monitoring emerging risks in crypto-assets including DeFi lending primitives. Protocols with identifiable governance structures or front-end operators may face compliance obligations.

What this means for you:

• If you are a developer building flash loan strategies, document your smart contract’s purpose and ensure audit trails exist
• If you are a protocol operator in the UK or EU, seek legal counsel on whether your service falls within CASP definitions
• If you are a retail user executing flash loans, the atomic self-settling nature of these transactions means standard consumer lending protections do not apply — you bear full smart contract execution risk