If you have spent any time reading about DeFi hacks, you have probably run into the phrase "flash loan attack." It sounds dramatic, and the numbers often are. But the underlying tool, the flash loan itself, is not inherently malicious. It is a normal piece of DeFi infrastructure that happens to be very good at both legitimate trading and, in the wrong hands, exploiting bugs in other protocols.
Here is what a flash loan actually is, how it works, and why it matters even if you never plan to take one out yourself.
The problem flash loans solve
Normal borrowing requires collateral. If you want to borrow $10,000 in USDC from a lending protocol, you typically have to lock up more than $10,000 worth of ETH or another asset first. That collateral protects the lender in case you never pay the loan back.
Flash loans get rid of that requirement, but only under one strict condition: the entire loan, borrow and repayment together, has to happen inside a single blockchain transaction. If the borrower has not repaid the loan (plus a small fee) by the time that transaction finishes, the whole transaction is reverted, as if it never happened. The lender either gets repaid in full or the loan never existed at all. There is no in between, and no risk of default, because a blockchain transaction either fully executes or fully fails.
This is possible because of a property called atomicity. A transaction on Base, or any EVM chain, can contain many steps: borrow funds, use them, repay them, all bundled together. If any single step fails, every step is undone. That guarantee is what lets a lender hand out millions of dollars to a stranger with no collateral and no credit check.
What people actually use flash loans for
Most flash loans are not attacks. Common legitimate uses include:
- Arbitrage. If a token is priced slightly differently on two decentralized exchanges, a trader can borrow funds, buy low on one, sell high on the other, repay the loan, and keep the difference, all in one transaction, without needing their own capital.
- Collateral swaps. Someone with a loan collateralized in ETH might want to switch that collateral to another asset without first repaying the loan out of pocket. A flash loan can bridge that gap in a single transaction.
- Self-liquidation. If a borrower's collateral is close to being liquidated by someone else (who would earn a penalty fee for doing so), the borrower can use a flash loan to close out their own position first and avoid that penalty.
None of these require the user to actually hold the borrowed amount. They only need the transaction, as a whole, to end up solvent.
On Base, the clearest example of this infrastructure is Aave's V3 market, which has a Base deployment (accessible through app.aave.com's Base market) and supports flash loans the same way Aave does on Ethereum and other networks it operates on, typically for a small fee on the borrowed amount. Uniswap's V3 pools, also present on Base, support a related mechanism called flash swaps, which let you withdraw tokens from a pool before paying for them, as long as payment lands before the transaction ends.
Why flash loans became a favorite attack tool
Flash loans did not create the vulnerabilities that attackers exploit. What they did was remove the capital requirement to exploit them. Before flash loans existed, an attacker who found a bug in a lending protocol's price logic might need millions of dollars of their own money to make the exploit profitable. Flash loans let them borrow that capital for the length of one transaction, use it to manipulate a price, an exchange rate, or a governance vote, extract the resulting profit, repay the loan, and walk away, all without ever risking their own funds.
A well documented example is the Euler Finance exploit from March 2023. An attacker used a flash loan to exploit a flaw in how Euler tracked a specific function's effect on collateral accounting, ultimately draining around 197 million dollars worth of assets from the protocol. It is worth being precise here: this happened on Ethereum mainnet, not on Base, and it targeted a bug specific to Euler's own contract logic rather than anything wrong with flash loans as a concept. Notably, the attacker later returned most of the funds. The case is widely studied because it shows the pattern clearly: the flash loan was the tool, not the vulnerability. The vulnerability was a design flaw in the target protocol.
This is also why price oracles matter so much in DeFi security. A common flash loan attack pattern involves using borrowed funds to temporarily distort the price of a token on a single exchange, then exploiting another protocol that naively reads that distorted price as truth. Protocols that rely on decentralized, time weighted, or multi source price oracles are much harder to manipulate this way than ones that trust a single pool's spot price.
What this actually means for you as a swap user
If you are swapping tokens on Base rather than building or lending into protocols, you are not directly exposed to flash loan risk in the way a lending protocol is. You are not going to accidentally "take out" a flash loan by clicking swap.
Where it becomes relevant to you is protocol due diligence. Before trusting a lending market, a yield vault, or any protocol that relies on on chain prices to make decisions, it is worth asking whether that protocol uses a robust price oracle or a single easily distorted price source. Protocols that have gone through a proper smart contract audit tend to have this checked specifically, since flash loan based price manipulation is one of the most common findings auditors look for.
The takeaway
A flash loan is simply a loan with no collateral requirement, made possible because it must be borrowed and repaid within one atomic transaction or the entire thing is undone. It is a legitimate and widely used piece of DeFi infrastructure, present on Base through protocols like Aave. It has also become the funding mechanism of choice for attackers exploiting bugs in other protocols, not because flash loans are broken, but because they remove the capital barrier that used to make large scale exploits impractical. Understanding that distinction is useful any time you are evaluating whether a DeFi protocol is worth trusting with your funds.