Summary

Can you get a loan from a stranger without paying any mortgage yourself? This is possible, but there is a prerequisite: the release and repayment of funds must be completed in the same transaction. This sounds strange, doesn't it? If the loan has to be paid back just seconds after it was borrowed, what else can it be used for?

In fact, you can call a smart contract within the same transaction like this. If you can earn more on the money you borrowed, you can pay off the loan in an instant and keep your earnings. But it’s not easy to implement. Read on to learn more about the latest features of the DeFi ecosystem.

Table of Contents

• Introduction
• How does a traditional loan work?
  • Unsecured Loans
  • Secured Loans
• How do flash loans work?
  • What’s the point of this?
• Flash loan attack
  • First flash loan attack
  • Second flash loan attack
  • Flash loan What are the risks?
• Summary

Introduction

In the field of digital currency, many people advocate the need to reshape the traditional financial system. However, in the blockchain field, some skeptics may not agree with this view. But there is certainly some attractive infrastructure being built in this regard.

In fact, the main goal of DeFi (decentralized finance) is to realize a permissionless, decentralized and open and transparent financial ecosystem in the blockchain network. Digital currencies have proven that this goal can be achieved through funding. Every day, systems like Bitcoin play a role in transferring value around the world.

The new wave of DeFi technology is expected to reach a higher level. Today, users can apply for digital currency-based loans, trade digital assets in a trustless manner, and store wealth in tokens with price stability similar to that of fiat currencies.

In the following, we will explain a special type of loan——Flash Loan. As we will soon see, these are unique new highlights in the evolving decentralized financial system.

How do traditional loans work?

Most people understand how a traditional term loan works. Nevertheless, this article will still give a brief introduction to facilitate subsequent comparison.

Unsecured Loans

Unsecured Loans are loans that do not require any collateral to be provided. In other words, there is no asset that you agree will go to the lender if you don't pay it back. For example, let's say you really want to buy a $3,000 gold chain decorated with the Binance logo. You don't have any cash at your disposal, but you will get paid next week.

At this time, you find your friend Bob and explain why you urgently need this gold chain, because it can increase transaction income by at least 20%. After hearing this, Bob agreed to borrow the money. Of course, the premise is that you pay it back immediately after your salary arrives.

He is a good friend of yours, so he did not charge any fees when he lent the $3,000. However, not everyone is so understanding. But then again, they don't have such an obligation, right? Bob believes that you will repay the loan as promised, but for other people who don't know you, they don't know whether you will run away with the money.

Financial institutions generally conduct a credit review before providing unsecured loans. They will look at an individual's credit record (credit score) to assess the borrower's ability to repay. If they find that you have taken out several loans and repaid them on time, they may think that this person is quite reliable and lend them money.

At this time, this institution will lend you money, but it will usually set various additional terms, that is, charge a certain interest. To get immediate access to funds, you need to repay the loan with interest in the future.

Credit card users are very familiar with this transaction model. If you fail to repay the loan on time, you must pay corresponding interest until the loan is repaid in full (including other fees).

Mortgage

Sometimes, having a good credit score is not enough. Even if you pay back all your loans on time over decades, it can sometimes be difficult to borrow large amounts of money with your personal credit rating. In this case, collateral is required upfront when applying for a loan.

If you ask someone to provide you with a large loan, they are taking a significant risk in accepting such a request. In order to reduce its own risk value, the latter will require borrowers to share risks. He will ask you to give up an asset of yours (it can be anything, such as jewelry, real estate, etc.), and if you don't pay back on time, this asset will belong to the lender. The idea behind this is that the lender can recoup some of its own loss in value. That's a mortgage in a nutshell.

Suppose you want to buy a car worth $50,000. Although Bob trusts you, he is unwilling to lend you money in the form of an unsecured loan. Instead, he requires you to provide some collateral - your collection of jewelry. Assuming you are unable to repay the loan, Bob can take your collection for himself and sell it.

How do flash loans work?

We can understand flash loans as unsecured loans, purely because the borrower does not need to provide any collateral, nor does it need to pass any credit rating or similar review. All you have to do is ask the lender if they can lend you $50,000 worth of Ethereum - and if they are willing to lend, the borrower can get the funds.

Aren’t lenders worried about whether the money will be gone or not? The repayment of the flash loan must be completed in the same transaction. This is somewhat abstract as we are used to typical transaction patterns where funds are transferred between different users. Typical examples of this model include purchasing goods and services, or depositing tokens into an exchange.

However, if you know something about Ethereum, you will know that the platform is very flexible, so some people call Ethereum a programmable currency. The "process" of a flash loan transaction can be broken down into three major steps: receiving the loan, using the loan and repaying the loan. The entire procedure is completed in instantaneous!

This all stems from the magic of blockchain technology. After a transaction is submitted to the network, these funds can be temporarily allocated to users. In the second step, users can use funds to carry out activities such as investment. As long as the repayment is made on time in the third step, there are no restrictions on the user's financial activities. Otherwise, the network will reject the transaction and the funds will be returned to the lender. In fact, as far as blockchain is concerned, the lender always owns the funds.

Because of this, the lender does not need to obtain collateral, and the smart contract program will enforce the repayment.

What’s the point of this?

After reading this, you may question why you should apply for a flash loan? If the entire process was done in one transaction, you probably wouldn't be able to use the money to buy a Lamborghini at all, right?

This is indeed not the real purpose of the loan. Now, we focus on the second step of the transaction in the previous article, which is using the loan to carry out activities such as investing. The core of this step is to put funds into a smart contract (or contract chain), thereby doubling the income, and ultimately repay the initial loan at the end of the transaction. As you know, the whole point of flash loans is to make a profit,

There are use cases where this can be achieved easily. Obviously, you won’t be able to carry out various off-chain activities during this period, but you can make more money by leveraging loans through DeFi protocols. The most popular application is arbitrage, where you can profit from price differences between different trading platforms.  

Suppose a certain token is traded at $10 on decentralized exchange (DEX) A and $10.50 on decentralized exchange B. Assuming that the transaction fee is zero, if we buy ten tokens on platform A and then transfer them to platform B to sell them, we will get a profit of $5. While you can't buy a private island this way, it proves that big deals can indeed generate revenue. If you spend $100,000 to buy 10,000 tokens and then successfully sell them for $105,000, your profit will be as high as $5,000.

If funds are obtained through flash loans (for example: through the Aave protocol), this arbitrage opportunity can be used on decentralized trading platforms. The whole process will probably look like this:

• Get a $10,000 loan
• Use the loan to buy tokens on platform A
• Resell on platform B Tokens
• Repay the loan (including interest)
• Pocket the proceeds

All in the same transaction! In reality, the profits from arbitrage are small due to transaction fees, fierce competition, high interest rates and sliding spreads. At this point, a way to eliminate the price difference must be found to ensure that the transaction can create profits. When competing against thousands of traders, good luck may not always come your way.

Flash loan attack

Digital currency and its derivative DeFi are still a highly experimental field . When there's so much money invested in it, it's only a matter of time before a hole appears. In Ethereum, we witnessed the highly representative DAO hacking incident in 2017. Since then, many protocols have also suffered 51% attacks at the economic level.

In 2020, attackers made nearly $1 million in profit from two high-profile flash loan attacks. Both attacks followed a similar pattern.

➟ Want to start a digital currency journey? Welcome to Binance to buy Ethereum!

The first flash loan attack

First, the borrower Apply for an Ethereum flash loan on dYdX (a lending DApp). They then divided the loan into tranches and transferred them to two other lending platforms: Compound and Fulcrum.

In Fulcrum (built on the bZx protocol), the attacker used part of the loan to short-sell Ethereum and exchange it for wrapped Bitcoin (WBTC), which means Fulcrum now wants to buy WBTC. This information is then passed to Kyber, another DeFi protocol, which completes the corresponding order in Uniswap, a mainstream DEX based on Ethereum. However, due to lower liquidity on Uniswap, the price of WBTC increased significantly, which meant that the Fulcrum platform paid more funds for the purchased WBTC.

At the same time, the attacker used the remaining dYdX loan to apply for another WBTC loan from Compound. As the price soared, the WBTC they borrowed successfully doubled on the Uniswap platform and reaped considerable profits. In the end, they also paid off the loan provided by dYdX and pocketed the remaining ether.

This may seem like a complex and difficult task, perhaps even difficult to understand. But most importantly, the attackers exploited five different DeFi protocols to manipulate the market. Incredibly, all of this happened within the time it took to confirm the initial flash loan.

Can you now determine where the problem lies? The answer is that Fulcrum uses the bZx protocol. By manipulating the market, an attacker can trick the market into thinking that the current value of WBTC is much higher than it actually is.

The second flash loan attack

For bZx, this week Very bad. Just days later, it was attacked again. The attacker obtained another flash loan and then converted part of the loan into stablecoin (sUSD). As you probably know, stablecoins are often tied to the price of fiat currencies. After all, it has USD in its name.

The name of smart contracts sounds smart, but the reality is not. They don’t know what the price of stablecoins should be. So when an attacker buys a large amount of sUSD (using borrowed ether), the price of sUSD in Kyber subsequently doubles.

bZx believes that sUSD is worth $2 instead of $1. The attackers then obtained an Ethereum loan that was higher than the normal limit on the bZx platform because their $1 token actually had $2 in purchasing power. Eventually, the attacker successfully repaid the initial flash loan and pocketed all the remaining funds.

What are the risks of flash loans?

Regardless of whether the behavior is legal or not, this special attack method demonstrates the attacker's "superior" means, which is impressive. Looking back at the method they used, the principle is actually not complicated. bZx should use a different price oracle to obtain its data. But the reality is that the cost of fraud in this way is very low - attackers do not need large-scale investment, and there is no financial deterrent to prevent them from carrying out attacks.

Previously, individuals or groups attempting to manipulate the market had to hold large amounts of digital currencies. With the advent of flash loans, anyone can become a whale in seconds. Additionally, as mentioned earlier, an attacker could make off with hundreds of thousands of dollars worth of ether in just a few seconds.

On the positive side, other players in this space will learn from these two attacks. So, is it possible that someone else will successfully carry out the attack again? After all, this method is already well known, isn't it? This possibility cannot be ruled out. It can be seen from the second attack that the oracle machine still has many weaknesses, and there is still a long way to go to eliminate these vulnerabilities.

All in all, this is not the fault of flash loans. Specifically, the exploited vulnerability exists in other protocols, and flash loans only provide funding for this attack. There may be many interesting examples of this form of DeFi lending in the future, especially given the relatively low risk faced by both lenders and lenders in this case.

Summary

As a new thing in the DeFi field, flash loans have left a deep impression on people. This unsecured loan is enforceable by code alone, opening up endless possibilities for the emerging financial system.

Although the current use cases are still very limited, flash loans have finally laid a solid foundation for the application innovation of decentralized finance.

Do you have any other questions about flash loans or DeFi? Please visit our Q&A platform Ask Academy, where members of the Binance community will patiently answer your questions.