Flash Loans: How DeFi Lets You Borrow Without Collateral

Flash loans are one of the most technically innovative — and misunderstood — tools in decentralized finance. They let anyone borrow any amount of liquidity with zero collateral, as long as the borrowed funds come back within a single blockchain transaction. No credit checks, no identity verification, no waiting period. Just code, atomicity, and a window measured in milliseconds.

“Smart contracts will replace lawyers.”

— Andreas Antonopoulos

To understand why this is even possible, you need to understand how blockchain transactions actually work.

How Flash Loans Work: Atomicity Is the Key

A blockchain transaction is atomic. It either completes entirely or reverts entirely — there's no in-between. Flash loans exploit this property by encoding a borrow, use, and repay cycle inside a single transaction. If the final repayment step fails, the entire transaction reverts as if nothing happened. The lender's funds never meaningfully leave their possession.

The execution flow goes like this:

1. You request a flash loan from a lending pool (e.g., Aave)
2. The pool sends the funds to your contract
3. Your contract executes arbitrary logic — arbitrage, liquidation, collateral swap
4. Your contract repays the loan plus a small fee in the same transaction
5. If step 4 fails, everything from step 1 onward is reverted

This is fundamentally different from standard DeFi lending, where protocols like Compound or Aave require overcollateralization. You have to deposit more value than you borrow, which ties up capital and limits who can participate. Flash loans remove that requirement entirely, replacing it with the atomicity guarantee.

A Simple Solidity Example

Here's what a minimal flash loan receiver contract looks like using the Aave V3 interface:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import {IFlashLoanSimpleReceiver} from "@aave/core-v3/contracts/flashloan/interfaces/IFlashLoanSimpleReceiver.sol";
import {IPoolAddressesProvider} from "@aave/core-v3/contracts/interfaces/IPoolAddressesProvider.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";

contract FlashLoanExample is IFlashLoanSimpleReceiver {
    IPoolAddressesProvider public immutable ADDRESSES_PROVIDER;

    constructor(address provider) {
        ADDRESSES_PROVIDER = IPoolAddressesProvider(provider);
    }

    function executeOperation(
        address asset,
        uint256 amount,
        uint256 premium,
        address initiator,
        bytes calldata params
    ) external override returns (bool) {
        // Your custom logic goes here:
        // arbitrage, liquidation, collateral swap, etc.

        // Repay the loan + fee
        uint256 totalRepayment = amount + premium;
        IERC20(asset).approve(msg.sender, totalRepayment);

        return true;
    }
}

The premium is the fee — on Aave V3 it's 0.05% of the borrowed amount. If executeOperation returns false or the approval is insufficient, the transaction reverts.

Practical Use Cases

Flash loans aren't primarily an attack tool. They're a powerful instrument for sophisticated DeFi operations that would otherwise require serious starting capital.

Arbitrage

Price discrepancies between DEXes like Uniswap and Curve are usually small and short-lived. A flash loan lets a trader borrow millions of dollars, execute the arbitrage across two or more pools, pocket the spread, repay the loan, and walk away with profit — all without owning any starting capital. The profit just needs to exceed the flash loan fee plus gas for the trade to make sense.

Liquidations

In overcollateralized lending protocols, when a borrower's collateral drops below the liquidation threshold, anyone can liquidate that position by repaying their debt. Flash loans let liquidators do this without needing upfront capital. You borrow, liquidate, sell the seized collateral, repay the flash loan, and keep the liquidation bonus.

Collateral Swaps

Say you have ETH deposited as collateral on Aave and want to switch to WBTC without closing your position. A flash loan can fund the repayment of your existing debt, free your ETH collateral, swap ETH to WBTC, redeposit WBTC, reborrow, and repay the flash loan — all in one atomic transaction. Doing this manually would require a large amount of free capital sitting around.

Self-Liquidation

If your collateral ratio is creeping toward liquidation and you want a clean exit without paying the penalty, you can flash loan the debt amount, repay your loan, withdraw your collateral, sell enough to cover the flash loan repayment, and keep the rest. You avoid the liquidation penalty and stay in control of how you exit.

Flash Loans vs. Traditional DeFi Lending

Compare this to staking, where you lock assets for yield over time. Flash loans are the opposite — no lock-up, no time dimension at all, just instantaneous capital access.

Flash Loans and Protocol Security

Flash loans have been used to attack DeFi protocols, and that's where their reputation for danger comes from. Most exploits follow the same pattern: borrow a huge sum to temporarily distort a price oracle or liquidity pool, exploit a protocol that trusts that manipulated price, then repay the loan.

The bZx attacks in early 2020 used flash loans to manipulate on-chain price oracles and drain funds. The Cream Finance exploit in 2021 used recursive flash loans to drain over $130 million. These are real, painful examples.

But the flash loan itself isn't the vulnerability — it's the protocol's reliance on manipulable price sources. The fix is using time-weighted average price (TWAP) oracles like Uniswap V3's built-in oracle, or decentralized oracle networks like Chainlink, which resist single-block manipulation. Well-audited protocols treat flash loans as a given threat and design their systems accordingly.

Flash Loans and Liquid Staking

There's an interesting intersection worth knowing about between flash loans and liquid staking protocols like Lido, Rocket Pool, and Frax ETH. These protocols issue derivative tokens — stETH, rETH — that represent staked assets and accrue yield. Because they're composable, you can use them as collateral in lending protocols.

This opens the door to leveraged staking strategies. You deposit stETH as collateral, borrow ETH, stake that ETH to get more stETH, and repeat. Flash loans can bootstrap this entire looping process in a single transaction instead of making you repeat the cycle manually dozens of times. Protocols like Instadapp and DeFi Saver have built automated tools on exactly this pattern.

The catch is real, though. When the stETH/ETH peg briefly broke in mid-2022, leveraged positions faced rapid liquidation. Flash loans make entry fast. They don't make the exit risk-free.

Risks and Limitations

Flash loans aren't without risk for the person executing them. A few things can go wrong.

Gas costs are the most immediate. Complex flash loan transactions can run hundreds of dollars in gas on Ethereum mainnet during congestion, and a failed transaction still burns gas.

Execution risk is baked in by design. If any step in your logic fails, the entire transaction reverts. Debugging on-chain logic is slow and expensive — you're paying for every mistake.

MEV exposure is a real concern. Profitable flash loan transactions are visible in the mempool, which means MEV bots can front-run or sandwich your trade before it settles.

Protocol liquidity can also trip you up. The lending pool you're borrowing from needs to have enough of the asset you want. If it doesn't, the transaction fails immediately.

Flash Loans on L2