Cyber Defense eMagazine January Edition for 2022

Consequences of flash loan attacks
Depending on the scale of the attack, consequences can vary. But one thing is certain, the reputational
damage is great, and the other protocol users pay the adverse effects. Seemingly never out of the
spotlight, C.R.E.A.M. has been attacked three times in 2021, two of which were flash loan attacks. In the
case of flash loans, lightning can and does strike the same place twice.
The primary and most important consequence is the impact that flash loan attacks can have on other
users. DeFi would be nothing without the loyalty and money of the users who are all key players in an
intricate autonomous ecosystem. It is presumptuous to assume that victims have available cash to put
back into a system that has failed to protect their assets adequately.
Questions about whose responsibility it is to ensure that flash loan attacks don’t occur will continue
to rise and protocols will rightfully be expected to defend themselves. Is taking preventative
measures enough to adequately prove that the platform isn’t responsible if an exploit occurs? A
prudent protocol or exchange should also consider a post-exploit action plan, if the worst is to
occur.
5 Steps for protocols to take to minimize the likelihood and impact of flash loan exploits
The recommendations here align with the three pillars of cyber security: security, vigilance and
resilience.
1. Design of the protocol matters
Complexity comes with risk. While developing a large smart contract or building a dApp it is difficult to
pinpoint loopholes. Therefore, all external calls should be located, to explore if these could serve as a
path for the malicious actors in the contracts. In older versions of Solidity, even reading a public field
could lead to unsafe external calls that can be easily manipulated. Therefore, developers should always
use the stable and updated versions of Solidity.
2. Use a decentralized oracle
Oracle manipulations are the biggest cause of flash loan attacks. Smart contracts heavily rely on oracles
which provide an effective interface between the contracts and the external source to push the required
data. Decentralized Oracles like Chainlink, gather data about prices from multiple sources, which reduces
the likelihood of a single data point influencing the oracle. If a platform relies solely on the data of one
particular DEX, then its data is at risk of being flawed. Mal Intended users could directly manipulate the
price of the singular DEX where the loan price is based off, resulting in loans issued with an inaccurate
average price. On the other hand, limited data could form an inaccurate representation of the average
market price and thus promote excessive slippage exploitation.
Cyber Defense eMagazine – January 2022 Edition 84
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.