Flash loan attacks in disclosed bug bounty reports
Flash loans are not the vulnerability — they are the capital that makes an otherwise theoretical economic assumption break inside one transaction.
- Reports indexed
- 19
- Total paid
- $75k
- Critical
- 0
- Largest payout
- $75k
A flash loan turns any atomic economic assumption into a testable one. Protocols that would be safe against an attacker holding one percent of supply are not safe against an attacker who can hold ninety percent of it for the duration of a single call and give it back before the block closes.
Almost every report filed under this class is really a composite: a flash loan plus a price oracle that can be moved, or a flash loan plus governance weight counted at the current block, or a flash loan plus a reward curve that pays on instantaneous share rather than on time held. The loan is the amplifier, and the finding underneath it is usually a missing time dimension.
The remediation notes in these reports are worth reading as a set, because the fixes converge: measure over time, snapshot before the transaction, or make the profitable path cost more than it returns.
What reviewers look for
- Any calculation that uses a balance sampled in the same transaction it can be changed
- Governance or reward weight counted at the current block instead of a snapshot
- Collateral valuation and liquidation happening within one atomic call
- Fee or bonus curves that scale with size without an upper bound
- Invariant checks performed before, but not after, external interaction
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Flash-loanable veToken balance inflates emissions gauge weights
A design flaw in the gauge voting system allowed real-time veToken balance checks instead of utilizing checkpointed block or epoch snapshots. An attacker could execute a flash loan to acquire governance tokens, temporarily lock them to generate veToken voting power, vote to direct reward emissions toward their target gauge, and release the lock to repay the flash loan within the same block. This enabled uncollateralized, risk-free manipulation of protocol reward distributions.
PoolTogether: A malicious user can steal other user's deposits from Vault.sol
A critical vulnerability in PoolTogether's Vault contract allowed attackers to steal funds by exploiting unsafe integer type casting. During withdrawals, the contract calculated asset transfers using a uint256 share value but incorrectly downcasted the share amount to a uint96 for the burning process. This truncation permitted users to withdraw large amounts of assets without fully burning their corresponding share balance, effectively allowing them to drain other users' deposits by redeeming the 'remainder' shares.
Olas: Changing VoteWeighting contract can result in lost staking incentives
The Dispenser contract contains a logic flaw where updating the VoteWeighting contract address can lead to the permanent loss of accrued staking incentives for nominees. By failing to migrate or safeguard the state tracking of claimed epochs, the system allows the claim history to be reset when a nominee is re-registered after a manager change. This enables malicious actors to overwrite a nominee's last-claimed epoch with the current epoch, effectively burning all unclaimed historical rewards for that user.
BadgerDAO: Staking ETH incorrectly assumes revert bubbling
The BadgerDAO zap router contracts incorrectly utilize a low-level call to interact with the Lido stETH deposit function. Because low-level calls do not automatically propagate reverts, the system fails to detect if a Lido deposit attempt is blocked by protocol pauses or staking limits. Consequently, the transaction continues as if the deposit succeeded, leading to incorrect state and collateral accounting within the eBTC leverage flow. While downstream checks may eventually catch the resulting insufficient balance, the silent failure mode represents a flaw in contract reliability and exception handling.
BakerFi: `StrategyLeverage.harvest` doesn't account flashloan fee
The BakerFi StrategyLeverage contract fails to accurately account for flash loan fees during automated position rebalancing. When the protocol repays excess debt to lower a high LTV ratio, the internal accounting fails to deduct the fee from the collateral, resulting in an incorrectly inflated assessment of the position's value. This accounting error leads to inaccurate profit reporting and potential under-collection of management fees for the protocol.
BakerFi: Vault is vulnerable to first depositor inflation attack
The BakerFi Vault is vulnerable to a first-depositor inflation attack, allowing an attacker to manipulate the exchange rate between assets and shares. By performing an initial minimal deposit and subsequently donating collateral tokens directly to the strategy, the attacker artificially inflates the vault's assets. This ensures that subsequent depositors receive minimal shares due to rounding down in the division-based minting formula, enabling the original attacker to drain a portion of the victim's deposited funds upon withdrawal.
All reports in this group
- BakerFi: `BalancerFlashLender#receiveFlashLoan` does not validate the `originalCallData`Flash loan attack$0
- BakerFi: When harvesting a strategy and adjusting the debt, all the leftover collateral that is not used to swap the withdrawn collateral from Aave for WETH to repay the flashloan will be locked and lost in the Strategy contractFlash loan attack$0
- DYAD: Attacker can frontrun user's withdrawals to make them revert without costsFlash loan attack$0
- DYAD: Inability to perform partial liquidations allows huge positions to accrue bad debt in the systemFlash loan attack$0
- Revert Lend: Due to interest rates update method, Interest-Free Loans are possible and the costs of DoS are reducedFlash loan attack$0
- Amphora Protocol: Rounding error in `WUSDA` can result in loss of user funds, especially when manipulated by an attackerFlash loan attack$0
- Spectra: All yield generated in the IBT vault can be drained by performing a vault deflation attack using the flash loan functionality of the Principal Token contractFlash loan attack$0
- Ethereum Credit Guild: Malicious borrower can decrease Guild holders rewardFlash loan attack$0
- Olas: LP rewards in `liquidity_lockbox` can be arbitragedFlash loan attack$0
- PartyDAO: The 51% majority can hijack the party's precious tokens through an arbitrary call proposal if the `AddPartyCardsAuthority` contract is added as an authority in the party.Flash loan attack$0
- Tapioca DAO: Attacker can specify any `receiver` in `USD0.flashLoan()` to drain `receiver` balanceFlash loan attack$0
- Maia DAO Ecosystem: A malicious user can front-run Gauges's call `addBribeFlywheel` to steal bribe rewardsFlash loan attack$0
- Lybra Finance: There is a vulnerability in the `executeFlashloan` function of the `PeUSDMainnet` contract. Hackers can use this vulnerability to burn other people's eUSD token balance without permissionFlash loan attack$0