Flash Loan

Atomicity is what makes an uncollateralized loan safe to offer. Borrowing and repayment happen inside a single transaction, and if repayment fails the entire transaction reverts as though it never occurred. The lender's risk is not credit risk, because there is no state in which the loan exists unrepaid.

The legitimate uses are ordinary market plumbing: arbitrage between venues, liquidating an undercollateralized position without pre-funding it, refinancing collateral in one step. What flash loans change is not what an attacker can do but who can afford to do it. An exploit that previously required $50MM of capital becomes available to anyone who can pay the gas.

Which is why describing an incident as a flash loan attack usually misidentifies the cause. The loan is the funding mechanism; the vulnerability is nearly always an oracle that can be moved within one transaction or accounting that can be manipulated mid-execution. Euler lost approximately $197MM in March 2023 to a donation and liquidation logic flaw that a flash loan merely financed. The correct remediation is fixing the price source or the accounting, never restricting the loan.