Source-linked AI summary
Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit
Kaihua Qin, Liyi Zhou, Benjamin Livshits, Arthur Gervais
TL;DR
The paper investigates how flash loans and transaction atomicity affect arbitrage and attacks in the DeFi ecosystem, where flash loans provide credit without conventional default and collateral requirements. It analyzes existing attacks and formulates attack-parameter selection as an optimization problem, finding that two attacks could have been boosted to 829.5k USD and 1.1M USD in revenue.
Problem
The paper addresses the limited prior investigation of flash loans and their implications for transaction atomicity, arbitrage, and DeFi security.
Method
The paper analyzes flash-loan usage and attacks, models DeFi operations as constrained state transitions, and optimizes attack parameters over blockchain and DeFi states.
Results
829.5k USD and 1.1M USD are the optimized revenues reported for two previously executed attacks, representing boosts of 2.37× and 1.73×, respectively.
Takeaways & Limitations
Transaction atomicity and flash loans can increase arbitrage revenue and enable attacks using large, non-collateralized capital within a single transaction.
Takeaways & Limitations
The discussion identifies DeFi's vulnerability to attacks as a design-level issue and describes flash loans as a mechanism that accelerates such attacks.
Abstract
from arXiv · showhide
Credit allows a lender to loan out surplus capital to a borrower. In the traditional economy, credit bears the risk that the borrower may default on its debt, the lender hence requires upfront collateral from the borrower, plus interest fee payments. Due to the atomicity of blockchain transactions, lenders can offer flash loans, i.e., loans that are only valid within one transaction and must be repaid by the end of that transaction. This concept has lead to a number of interesting attack possibilities, some of which were exploited in February 2020. This paper is the first to explore the implication of transaction atomicity and flash loans for the nascent decentralized finance (DeFi) ecosystem. We show quantitatively how transaction atomicity increases the arbitrage revenue. We moreover analyze two existing attacks with ROIs beyond 500k%. We formulate finding the attack parameters as an optimization problem over the state of the underlying Ethereum blockchain and the state of the DeFi ecosystem. We show how malicious adversaries can efficiently maximize an attack profit and hence damage the DeFi ecosystem further. Specifically, we present how two previously executed attacks can be "boosted" to result in a profit of 829.5k USD and 1.1M USD, respectively, which is a boost of 2.37x and 1.73x, respectively.
1 Introduction
This paper examines flash loans, enabled by atomic blockchain transactions, and their implications for DeFi security, arbitrage, and attack profitability. It introduces an optimization framework and quantifies how atomicity and parameter selection affect financial outcomes.
- Flash loans: Flash loans are single-transaction loans that require repayment before transaction completion, eliminating default risk and upfront collateral requirements.They can draw on public liquidity pools, including pools exceeding 1B USD.
- Contributions: The paper is presented as the first investigation of flash loans and provides a comprehensive overview of their usage in DeFi.The analysis focuses on how flash loans can be utilized across the ecosystem.
- Contributions: Two February 2020 attacks generated approximately 350k USD and 600k USD using independent flash loans, involving pump-and-arbitrage and oracle manipulation strategies.The attacks are analyzed as existing events involving flash loans.
- Contributions: The optimization framework models exchanges, lending, and margin-trading components to identify attack parameters maximizing adversarial revenue in less than 13ms.It represents DeFi endpoints as constrained state-transition functions over blockchain and platform states.
- Contributions: 829.5k USD and 1.1M USD were identified as forgone profits in the two attacks after optimizing their adversarial parameters.The opportunity loss was experimentally validated on a locally deployed blockchain mirroring the respective attack states.
- Contributions: 123.49±1375.32 USD and 1.77±10.59 USD are the decreases in expected arbitrage reward for DAI/ETH and MKR/ETH markets, respectively, with 5,000 intermediary transactions.The result is based on an analysis of 6.4M transactions.
2 Background
DeFi uses blockchain state transitions and smart contracts to support lending, exchanges, margin trading, and other financial protocols. Flash loans exploit transaction atomicity to provide non-collateralized, risk-free lending within one transaction, enabling arbitrage and other uses.
- DeFi protocols support lending, borrowing, exchanges, margin trading, shorting, longing, and derivative assets through smart contracts.
- Automated market makers: AMM DEXs pool paired assets, with market depth represented by the quantities of each asset in the pool.
- Blockchain execution: The EVM reverts all state changes when a transaction fails, preserving the previous state.
- Flash loans: Flash loans are single-transaction loans requiring repayment before execution ends; otherwise, the transaction fails and the lender avoids default risk without collateral.
- Flash loan usage: 5,616 Aave flash loans were issued between January 8 and September 20, 2020; DAI led 13 currencies with 447.2M USD cumulatively.
- Flash loan usage: Flash loans supported arbitrage, liquidation, wash trading, collateral swapping, and flash minting, while arbitrage avoided intermediate price changes and currency volatility risk.
3 Flash Loan Post-Mortem
The paper examines two flash-loan-enabled attacks: pump-and-arbitrage and oracle manipulation. Both used complex multi-step DeFi interactions, and the authors report that alternative parameters could have produced substantially larger profits.
- Beyond 500k% ROI, flash loans enabled two attacks evaluated with the paper’s DeFi attack optimization framework.
- Pump Attack and Arbitrage (PA&A): 350k USD was earned in the pump-and-arbitrage attack, but optimized parameters could have increased profit beyond 829.5k USD.
- Pump Attack and Arbitrage (PA&A): The pump-and-arbitrage strategy distorted Uniswap’s ETH/WBTC price, then used borrowed WBTC to purchase ETH and redeem collateral through later trades.
- Oracle Manipulation Attack: 634.9k USD was earned in a single oracle-manipulation transaction, while optimized parameters could have produced 1.1M USD.
- Oracle Manipulation Attack: The oracle attack used a 7,500 ETH flash loan and swaps that lowered sUSD/ETH prices on Uniswap and Kyber, which supplied the lending platform’s price oracle.
4 Optimizing DeFi Attacks
The paper models DeFi attack actions as constrained state transitions and optimizes their parameters from a known initial blockchain state. Nested transitions represent the attack sequence, while the objective measures the final state’s revenue outcome.
- Blockchain atomicity lets an adversary predict intermediate results from a known initial state and adjust action parameters to optimize the attack outcome.
- Scope and assumptions: The system is limited to one decentralized ledger with pseudo-Turing-complete smart contracts and assumes a computationally bounded, economically rational adversary able to pay transaction fees.
- State-transition model: Each DeFi endpoint is formalized as a constrained state transition S′ = T (S; p), mapping a state and adversarial parameters to an output state.
- State-transition model: The framework defines balance states for currencies held by entities and imposes the associated balance constraint.
- Attack-vector construction: Attack vectors specify endpoint execution order across DeFi platforms, which the framework represents as chained and nested transition functions.
- Constrained optimization: The optimizer maximizes an objective derived from the initial and final states, such as the adversary’s balance increase, subject to all generated constraints.
5 Evaluation
The framework optimizes attack parameters over recorded blockchain states and validates improved profits for both analyzed flash-loan attacks.
- 5.1 Optimizing the Pump Attack and Arbitrage: The pump-attack optimization uses the initial on-chain state S0 and tunes collateral amounts for borrowing and shorting WBTC.X and Y denote ETH and WBTC, while p1 and p2 control the respective collateralized amounts.
- 5.1 Optimizing the Pump Attack and Arbitrage: 6.1ms average convergence produced 2,778.94 ETH maximum revenue for the pump attack, versus 1,171.70 ETH from the original parameters.The optimized parameters were (p1; p2) = (2,470.08; 1,456.23), compared with original parameters (5,500; 1,300).
- 5.2 Optimizing the Oracle Manipulation Attack: The oracle-attack optimization models three ETH-to-sUSD swap amounts, with five linear and two nonlinear constraints.The attack’s initial state is summarized separately, and the generated constraints include nonlinear components involving p1, p2, and p3.
- 5.2 Optimizing the Oracle Manipulation Attack: 12.9ms average convergence produced 6,323.93 ETH profit for the oracle manipulation attack using three optimized parameters.The optimizer selected (p1; p2; p3) = (898.58; 546.80; 3,517.86), yielding 1.1M USD rather than 634.9k USD.
- 5.2 Optimizing the Oracle Manipulation Attack: 11.3M gas validated the optimized oracle attack within the current 12.5M block gas limit, while the original parameters yielded 2,381.41 ETH.The validation contract produced 6,262.28 ETH with optimized parameters.
6 Implications of Transaction Atomicity
The paper compares atomic and non-atomic arbitrage by modeling intermediary transactions and holding-value effects, finding lower expected rewards as intermediary activity increases.
- Atomic and non-atomic arbitrage: Atomic execution locks involved markets against intermediate state changes, whereas non-atomic arbitrage permits intermediary transactions between its two trades.The comparison defines atomic profit as trades TA and TB executed together and non-atomic profit as TA followed by TB after i intermediary transactions.
- Holding value: Holding value measures price change during non-atomic execution and neutralizes volatility when comparing the financial advantage of atomic arbitrage.Non-atomic traders face price volatility while assets are locked; atomic traders are not exposed to this holding-value risk.
- Empirical impact: 123.49 ± 1375.32 USD and 1.77 ± 10.59 USD are the average profit differences for DAI/ETH and MKR/ETH after 5,000 intermediary transactions.The simulation inserts intermediary Ethereum transactions after TA and treats zero intermediary transactions as atomic arbitrage.
- Empirical impact: 6,398,992 Ethereum mainnet transactions provide the basis for simulating atomic and non-atomic arbitrage across 0–5,000 inserted transactions.The insertion order follows the original execution order, including transactions that may be irrelevant to the arbitrage.
7 Discussion
The discussion frames DeFi’s interconnected protocols and flash loans as creating a broad security challenge, while withholding judgment on whether flash-loan use is malicious or benign.
- Security implications: The discussion notes that entire protocols have received little-to-no security effort compared with smart contracts and market-manipulation defenses.DeFi’s organic development and addition of new protocols are presented as part of the security challenge.
- Security implications: DeFi protocols can enable both direct exploits and multi-step attacks spanning several protocols.The paper identifies the two analyzed attacks as examples of multi-step attacks using several DeFi protocols.
- Flash loans: Flash loans accelerate attacks by removing collateral requirements apart from minor gas costs, making such strategies accessible to more participants.The paper contrasts this with traditional finance, where regulations make equivalent no-collateral borrowing impossible.
- Interpretive boundary: The paper withholds a value judgment because distinguishing clearly malicious from clearly benign flash-loan use is difficult.This qualification follows the discussion of flash loans as both a DeFi mechanism and an attack vector.
8 Conclusion
The paper explores transaction atomicity and flash loans in Ethereum, analyzing existing attacks and optimizing their parameters to increase revenue.
- Conclusion: 829.5k USD and 1.1M USD are the optimized revenues for two previously executed attacks, representing boosts of 2.37× and 1.73×.The paper presents these improvements as the principal outcomes of its flash-loan attack optimization.
A Classifying Flash Loan Use Cases
An analysis of 5,615 Aave flash-loan transactions identifies the DeFi platforms most frequently involved and the concentration of loan volume. Compound and MakerDAO account for most of the total amount.
- 5,615 Aave flash-loan transactions were analyzed across DeFi platforms between January 8 and September 20, 2020.
- More than 30% of flash loans interacted with Kyber, MakerDAO, and Uniswap.
- 433.81M USD in flash loans accumulated on Compound and MakerDAO, representing 90% of the total flash-loan amount.
- Average flash-transaction consumption was 1.43M gas, while the most complex transaction consumed 6.3M gas.
B.1 Wash Trading
Flash loans reduce the capital barrier to wash trading on decentralized exchanges, making artificial volume cheaper because traders need not hold the traded assets. The paper quantifies this cost and illustrates the mechanism with an executed example.
- Flash loans remove the need for wash traders to hold real assets, reducing wash-trading costs to loan interest, trading fees, and transaction fees.
- 1,298 USD would cost an endeavor that increased Uniswap ETH/DAI 24-hour volume by 50%.
- 0.09% on Aave and 1 Wei on dYdX were the flash-loan costs used to compare wash trading on two Uniswap markets.
- 25.8% was the increase in ETH/LOOM 24-hour trading volume after two back-and-forth trades using a 0.01 ETH dYdX flash loan.
B.2 Collateral Swapping
The paper models collateral swapping and related DeFi actions as state transitions governed by balances, liquidity, prices, collateral factors, and trading constraints. It then represents an executed attack as an ordered sequence of composable endpoints.
- Flash minting: Flash minting permits an arbitrary amount of an asset to exist instantaneously for one transaction, potentially increasing liquidity temporarily.
- Flash loan: A flash loan provides borrowable asset X, charges interest on amount b, and requires Loan and Repay transitions within the modeled state.
- Constant product automated market maker: The modeled AMM tracks pool reserves and trader balances, with SwapXforY and SwapYforX changing these state variables.
- Collateralized lending & borrowing: Collateralized borrowing exchanges collateral asset X for borrowed asset Y, with borrowing limited by the collateral factor, exchange rate, and available Y liquidity.
- Collateralized lending & borrowing: A borrower can retrieve collateral by repaying the borrowed asset through CollateralizedRepay.
- Attack execution sequence: The pump-and-arbitrage attack sequence combines Loan, Compound borrowing, bZx margin shorting, Uniswap swaps, repayment, selling, and collateral repayment.
F Extended Discussion
The discussion considers disclosure, defenses, and the future of DeFi security testing while identifying boundaries of the optimization framework. The authors note both protocol-level constraints and growing search complexity.
- Responsible disclosure: Responsible disclosure is unclear because DeFi vulnerabilities and victims may not be clearly identifiable, and security standards are lacking.
- Does extra capital help: Additional collateral would not increase ROI for the two attacks because intermediate-protocol liquidity constraints limit impact.
- Potential defenses: Proposed defenses are not foolproof and could significantly hamper normal interactions.
- Generality of the optimization framework: The framework’s attack-discovery search space explodes as the number of DeFi actions increases.
- Generality of the optimization framework: The framework requires manually modeling every DeFi action, making it less handy for users unfamiliar with the mathematical formulas.
- Looking into the future: The authors anticipate higher security-testing standards and either whole-system penetration testing or analytical modeling to improve future DeFi protocols.