The essence of the flash loan attack is actually an Oracle attack
Original author: Adelyn Zhou
Original translation: Olivia
Original source: Encryption Valley
Since the beginning of the year, the decentralized finance (DeFi) ecosystem has grown rapidly to over $12 billion in total value locked. With this exponential growth, the incentive for malicious actors to manipulate and attack vulnerable DeFi protocols increases, often at the expense of ordinary users.
One of the tools that has been used in many DeFi attacks recently is the Flash Loan - a new type of financial primitive that allows users to open unsecured Loans, the only stipulation is that the loan must be repaid in the same block or it will be repossessed. This is very different from traditional DeFi loans, which often require users to over-collateralize the loan in the early stage.
The novelty of the flash loan is that it can temporarily make anyone in the world a very well-funded trader, with the potential to suddenly manipulate the market. In a recent spate of attacks, we’ve seen malicious actors use flash loans to instantly borrow, swap, deposit, and re-borrow large amounts of tokens so they can artificially manipulate token prices within a DEX. This sequence of operations itself is compliant, so it also allows attackers to use the DEX for abnormal pricing.
The term "flash loan attack" is the trending crypto of the week when flash loans are used as part of a malicious scheme to manipulate the protocol and steal funds the term. Media outlets and Twitter influencers alike follow the operation of flash loans, dissecting every step malicious actors take in a transaction from one token to another and from one protocol to another.
But the term "flash loan attack" doesn't capture the full picture. Flash loans don’t create vulnerabilities within DeFi — they just reveal vulnerabilities that already exist. "Flash loan attacks" are often just attacks on oracles, where oracles are middleware that connects on-chain DeFi applications and off-chain data, such as the fair market price of an asset. The real systemic risk in the DeFi ecosystem revolves around centralized oracles, not flash loans.
For bystanders watching the attack take place, there is something fascinating about flash loans. The idea that anyone can suddenly control vast sums of money and configure it in novel and even malicious ways demonstrates how this technology can empower individuals and unlock entirely new financial tools. Instead of analyzing the ultimate function and goals of Flash Loans, we marvel at the ingenuity of its creators and the sophistication of its attacks. As a result, flash loans are increasingly being characterized as a dangerous DeFi innovation.
As DeFi protocol Aave's Marc Zeller puts it, flash loans are just a tool: they allow you to act like a whale during a transaction . Any attack performed via flash loans can also be performed without flash loans by well-funded holders. What a flash loan can do is temporarily make anyone in the world a well-capitalized holder, because there are no permits required to obtain a flash loan, and there are no pre-collateral requirements.
Of course, having this kind of funding publicly available greatly increases the number of people who can carry out this kind of attack. But even in a world without flash loans, the adoption of more blockchain technology will continue to provide us with faster access and access to more liquidity.
Focus on what's wrong
We need to focus on what these malicious actors are doing with their newfound funds do what. A clear pattern has emerged: malicious parties using flash loans to manipulate DeFi protocols that rely on a single decentralized exchange (DEX) as the protocol’s only price oracle. They used flash loans to manipulate and distort the price of one or more assets on a DEX, resulting in inaccurate price data being provided to DeFi applications using that DEX-based price oracle.
Malicious attackers will then take the opportunity to gain profits at the expense of directly harming the interests of ordinary users. In obsessing over the specific tools used in the exploit, our industry is ignoring the real lesson of these attacks: DeFi protocols that rely on price oracles sourcing data from a single trading venue can be compromised by participants with large sums of money.
These are Oracle attacks whose attack vectors have not only been predicted but have occurred before. The focus on flash loans has distracted us from the larger problem that DeFi protocols with hundreds of millions and sometimes as much as $1 billion in TVL still rely on price feed oracles from a single exchange. As we have seen, a single exchange can be subject to all kinds of volume changes and whale manipulation. For another protocol that relies on centralized price feeds, the consequences are clear.
Today, many of TVL's top DeFi dApps use a decentralized oracle network to asynchronously account for transactions across multiple exchanges in multiple different transactions Differences in volume and liquidity make them insensitive to manipulation of flash loan funds. As more and more users are attracted by the financial convenience and opportunities of this ecosystem and DeFi protocols absorb more and more value from the global market, it is the responsibility of the maintainers of these protocols to adopt decentralized oracle solutions , to protect users from currently known and preventable attacks.
So next time you hear the words "flash loan attack" think twice. Flash loans were likely used to target a specific vulnerability in the system: a price oracle with no market coverage. An oracle should be an authoritative source of truth for a protocol — about the price of an asset, about the state of the market. As we have seen, whoever can manipulate this source can reap enormous benefits. The truth behind flash loan attacks: their funding source is flash loans, but they are price oracle attacks.
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia
Related Articles
