Flash Loan Attacks Explained, With Real Examples

By the Guardian team Updated November 2026 6 min read

Quick answer. A flash loan attack borrows capital with no collateral, exploits a bug and repays in one transaction. The loan is the funding, not the flaw: it lets anyone exploit a weak price, vote or accounting rule at scale.

Watch: Flash Loan Attacks Explained, With Real Examples 1:38

Video transcript

Flash loans put millions in anyone's hands for one transaction. So any bug that needs capital to exploit is open to anyone.

Flash loans need no collateral and must be repaid in the same transaction, or everything reverts. OWASP calls them a legitimate DeFi primitive. The loss comes from an underlying bug.

Most attacks follow one pattern. Borrow big, distort a price, vote or balance, exploit the distortion, repay with the fee, and keep the difference.

bZx used DEX prices as its oracle. PancakeBunny priced rewards from pool reserves. Beanstalk let a vote execute in the same transaction, Euler skipped a health check, and Bunni repeated a rounding error at scale.

At Beanstalk, the attacker flash-borrowed about one billion dollars from Aave to buy a voting majority.

Each bug existed without flash loans. The loan supplied scale, for a spot price oracle, a governance majority, an accounting flaw or a rounding error.

Design as if every attacker can borrow vast sums. Use robust oracles, add same-block limits, delay governance, fuzz invariants with huge balances, and check flash loan callbacks.

In a critical issue that was later resolved, Guardian found a Synthetix vault callback that only checked the caller was the Aave pool, so anyone could force it to unwind and pay the fee.

Read the full article for all five cases, or talk to Guardian about an audit at guardian.security.

Flash loans put millions in anyone's hands for one transaction. Any bug that needs capital to exploit is open to anyone.

OWASP's 2026 Smart Contract Top 10 ranks flash loan facilitated attacks fourth. Here is how they work, five real cases and the controls that stop them.

What a Flash Loan Is

A flash loan exists only inside one transaction. Aave describes borrowing "without collateral, as long as the borrowed amount and a fee are returned before the end of the same transaction."

If the money is not back by the end, the transaction reverts. The lender takes no default risk, so it can lend its whole pool.

The main sources:

Aave V3: borrow from one or more reserves for a 0.05% fee at deployment, which governance can change.
Uniswap V2 flash swaps: withdraw up to a pool's full reserves, then pay in the other token or return them with a small fee.
Balancer V3: borrow from the Vault and settle before the transaction ends.

Between borrowing and repaying, the borrower's contract can run any logic. That is where attacks happen.

Why Flash Loans Enable Attacks

OWASP calls flash loans "a legitimate DeFi primitive" that attackers use to amplify an underlying vulnerability.

Without them, a bug that needs $100M is out of reach for most attackers. With them, the capital costs a fee. Most attacks follow five steps:

Borrow a large amount with no collateral.
Distort something the protocol trusts: a pool price, a vote count or a balance.
Exploit the distortion: borrow, mint, withdraw or pass a proposal.
Unwind the distortion and repay the loan with its fee.
Keep the difference.

Remove the bug and step 3 fails: the loan buys nothing.

Five Real Flash Loan Attacks

Attack	Date	Loss	Root cause
bZx	Feb 15 and 18, 2020	About $350k and $635k profit	Skipped equity check; DEX prices as oracle
PancakeBunny	May 19, 2021	About $45M	Rewards priced from pool reserves
Beanstalk	Apr 17, 2022	$181M drained (Rekt); $77M of user assets (Beanstalk)	Vote and execution in one transaction
Euler	Mar 13, 2023	About $197M	Donation with no health check
Bunni	Sep 2, 2025	About $8.4M	Withdraw rounding, repeated at scale

bZx, February 2020

Qin and colleagues documented two attacks on bZx, three days apart.

February 15: a 10,000 ETH dYdX flash loan funded a 5x short on bZx that pumped Uniswap's WBTC price. Profit: 1,193.69 ETH.
February 18: a 7,500 ETH flash loan from bZx itself pumped the price of sUSD on Uniswap and Kyber about 2.5 times.

Those two markets were the oracle bZx used, so the attacker borrowed ETH against overvalued sUSD. Profit: 2,381.41 ETH.

The first attack worked because a negative-equity check existed in bZx's code but "was not invoked properly," the authors found.

PancakeBunny, May 2021

PancakeBunny minted BUNNY rewards from LP token values it read off PancakeSwap's own pool prices, Rekt reports.

The attacker flash-borrowed WBNB from PancakeSwap pools and USDT from ForTube, skewed those reserves and claimed an inflated reward.

DefiLlama records about 7M BUNNY minted and 114,631 WBNB taken, about $45M.

Beanstalk, April 2022

On April 17, 2022, an attacker flash-borrowed about $1B from Aave, plus BEAN and LUSD, to buy governance power.

Beanstalk's emergencyCommit path let a proposal with two-thirds of the vote execute while voting was still open. Voting and execution fit in one transaction.

Rekt puts the drain at $181M, of which the attacker kept about $76M. Beanstalk's own figure is about $77M of non-Beanstalk user assets stolen.

Euler, March 2023

Euler added a donateToReserves function to patch an earlier bug. Euler later wrote that "the function lacked a health check."

On March 13, 2023, the attacker flash-borrowed about $30M in DAI from Aave, per Chainalysis. Donating made its own account unhealthy; it then self-liquidated.

The liquidation bonus beat the cost of the donation. About $197M left the protocol, and Euler says 100% was recovered after negotiations.

Bunni, September 2025

Bunni's withdraw function rounded an idle balance down, which the team had assumed was safe.

On September 2, 2025, the attacker flash-borrowed 3M USDT, moved the pool price, then made 44 tiny withdrawals that compounded the error.

About $8.4M was lost across Ethereum and Unichain, Bunni's post-mortem says. The team plans broader fuzzing and an invariant testing framework.

Bugs Flash Loans Amplify

Every case above had a bug that existed without flash loans. The loan supplied the scale.

DefiLlama even files Euler as a donation attack and Bunni as a rounding error.

Bug class	What the loan buys	Case	Go deeper
Spot price oracle	A distorted price for one transaction	bZx, PancakeBunny	Oracle manipulation
Governance	A voting majority for one transaction	Beanstalk	Governance attacks
Accounting and liquidation	Size to make a self-inflicted loss pay	Euler	Business logic
Rounding	Capital to repeat a tiny error	Bunni	Rounding errors

How Protocols Defend

Design as if every attacker can borrow vast sums for one transaction, as OWASP advises.

Use robust oracles

Never price collateral from spot reserves or a raw balanceOf. OWASP advises aggregating sources, rejecting stale prices and adding circuit breakers.

Our oracle manipulation guide covers TWAPs and their limits.

Add same-block protections

A flash loan lives inside one transaction, so limits that span blocks defeat it.

Rate-limit high-impact actions per block or epoch.
Cap position size, borrowing and slippage per interaction.
Limit how much state can change in a single transaction.

Delay governance

Count votes from a past snapshot fixed when the proposal becomes active, as OpenZeppelin's Governor does.
Never let a vote and its execution share a transaction, emergency paths included.
Execute through a timelock, which OpenZeppelin says lets users exit before a decision takes effect.

Test invariants

Write the protocol's rules as invariants. Then fuzz long call sequences with balances as large as the biggest lending pool.

An invariant that no action leaves its caller's account unhealthy targets exactly what Euler missed. Bunni's error needed 44 calls, so sequences matter.

Check flash loan callbacks

A callback should verify both the lender and who started the loan. In a Synthetix vault, Guardian found the callback checked only that the caller was the Aave pool.

Anyone could aim a flash loan at the vault and force it to unwind its position and pay the fee (C-01, Critical, resolved). The fix: require the vault itself as initiator.

How Guardian Tests for This

Guardian's smart contract audit runs three passes. A design review covers economic assumptions and failure modes before code hardens.

An invariant suite fuzzes solvency, accounting and rounding. Senior researchers then attack protocol logic, integrations, privileged flows and economic assumptions with proof-of-concept depth.

See all audits and pentests, or the wider risk map in our OWASP Smart Contract Top 10 guide.

Frequently Asked Questions

What is a flash loan attack?

An exploit funded by a flash loan, which is borrowed with no collateral and repaid in the same transaction. The attacker distorts a price, vote or balance, profits from a bug, then repays. If any step fails, everything reverts.

Are flash loans a vulnerability?

No. OWASP calls them a legitimate DeFi primitive. The loss comes from an underlying bug, such as a manipulable oracle, same-transaction voting or flawed accounting.

Does a TWAP oracle stop flash loan attacks?

Only against price manipulation. A TWAP ignores a price set and undone inside one transaction. It does nothing for governance, accounting or rounding bugs, which drove three of the five cases above.

How do you prevent flash loan attacks?

Price from aggregated feeds or TWAPs, not spot reserves. Snapshot voting power and delay execution. Rate-limit and cap high-impact actions per block. Verify flash loan callbacks. Fuzz invariants over long call sequences with huge balances.

Sources

Find the bug before someone borrows a billion to hit it

Guardian tests your oracles, governance and accounting against attackers with unlimited capital for one transaction.

Talk to Guardian Explore audits and pentests