What are Flash Loans (instant loans)?

Instant loans or flash loans (from English Flash Loans) is a feature in a number of popular DeFi protocols that allows you to borrow cryptocurrency assets without collateral, with the condition that the debt will be returned in the same transaction block.

Flash loans have become one of the most significant developments in the world of decentralized finance in 2020, bringing profit to some market participants and losses to others.

How and When did Flash Loans Appear?

Since the beginning of the development of decentralized lending, all loans in crypto assets required the provision of excess collateral (collateral) by the borrower. The situation changed in January 2020, when the British lending company Aave launched a decentralized lending protocol based on liquidity pools. For third-party developers of DeFi applications, the function of instant unsecured loans has been opened.

The basic requirement for a flash loan is simple: transactions for obtaining and repaying a loan, as well as any intermediate transactions with disbursed funds, must occur within a single block of transactions. For this reason, it takes only a few seconds from borrowing to repaying a loan. At the same time, the size of an instant loan can reach tens of millions of dollars, and the commission for issuing it is only 0.09% of the amount (in addition to gas costs for accessing smart contracts).

Developers of DeFi applications realized the huge potential of instant loans almost immediately after Aave opened the documentation for this feature. However, they became really in demand after a few months, with a multiple increase in the number of users of DeFi services and the subsequent increase in commissions in the Ethereum network. Conventional transactions with DeFi protocols were too expensive, and the use of strategies based on instant loans allowed to significantly reduce transaction costs and find new opportunities for generating profit.

At the end of 2020, the Aave lending platform processed $2 billion in flash loans, and by the end of the first half of 2021, this amount grew to $4.2 billion. According to AaveWatch, the largest instant loan was $195 million.

In the first half of 2020, the flash loans feature became available to users of the dYdX decentralized marketplace. An analogue of instant loans can be considered the flash swaps function, which was offered in May 2021 by the popular decentralized crypto exchange Uniswap in the protocol version v2.

Users now have the ability to lend without collateral over 100 tokens that can be used for arbitrage trades (e.g. between Uniswap and SushiSwap) and other strategies. Access to this function is possible only through smart contracts, since there is no user interface. The cost of the loan is 0.3% (excluding gas fees and Uniswap fees).

How to use instant loans?

Initially, the instant loans feature was only open to developers. There was no public user interface, and access to this function was possible only through smart contracts. However, in 2020, third-party services appeared that provided access to flash loans to users who did not own Solidity.

Why are Flash Loans Dangerous?

The benefits of instant loans began to be used not only by developers and crypto traders, but also by attackers. In February 2020, two attacks were carried out on DeFi protocols using flash loans with a total damage of $1 million. They used a vulnerability in the bZx protocol, which allowed them to manipulate the prices of crypto assets and artificially inflate them for profit. The instant loans themselves had no vulnerabilities, but served as a very cheap source of funding for attacks.

During 2020, flash lending attacks have become one of the most used methods for stealing funds from various DeFi protocols. Most of the attacks exploited vulnerabilities related to the unreliability of the price oracles used and the possibility of manipulating asset prices.

In the spring of 2021, instant loans became available on several EVM-compatible networks at once, and this launched a whole series of attacks on DeFi protocols, primarily on the Binance Smart Chain (BSC) network.