Flash Loans Expose Growing Gap in DeFi Insurance

Flash loan attacks are not common — but their consequences are dire.

Most recently, decentralized finance (DeFi) lending and borrowing protocol Euler Finance booked a $197 million loss in a flash loan attack.

The attacker exploited a vulnerable code, Euler Labs, the team behind the Euler Finance protocol, said in a tweet, tricking it into believing there were fewer collateral tokens than debt tokens.

“As a result, the attacker was able to liquidate these underwater accounts and profit from the liquidation bonuses,” the company tweeted. 

Hugh Karp, the founder of Nexus Mutual, a smart contract insurance company, told Blockworks that flash loans themselves —  where traders are able to borrow cryptocurrencies without any collateral and return assets within the same transaction — are not the problem.

“Flashloans sound sexy, but all flash loans do is allow a hacker to conduct the attack without having spare funds lying around,” Karp said. “The attack would have been exploitable without the use of flash loans.”

Blockworks Research analyst Ren Yu Kong said that, ultimately, a fundamental vulnerability exists within the smart contract for a flash loan attack to happen. 

“Flash loan attacks are as preventable as any other attack vector, and at the day it still requires developers to go through various security audits and take into account flash loans as an attack vector when writing the code,” Kong said.

The real problem, though, according to Karp, is whether humans are capable of creating secure software free of defects. 

“While that’s possible, it is quite difficult as even the most security-focused teams, such as NASA and teams within the aviation industry, struggle with this,” Karp said.

Even if DeFi security continues to improve, the possibility of failure is rather inevitable — at some point. 

“DeFi cover providers have to be very careful with their risk selection and in their risk management practices, like setting exposure limits and adequately pricing risk. There are no shortcuts,” Karp said.

Jesse Pollack, Coinbase’s protocol lead, said in a tweet that in order to prevent further attacks, “better insurance primitives and coverage need to be a part of the solution.”

Existing DeFi insurance is underpriced, according to Kong — considering it’s often marketed as yield, though the costs associated with an insurance premium could potentially outweigh the downside protection it provides.

“That’s a combination of exploits in DeFi generally being all or nothing — if a protocol gets exploited, more often than not everything is gone — and a much higher percentage chance of an exploit occurring than insurance underwriters price,” Kong said. 

Another solution, a Twitter user who goes by Duncan said, is bringing in more audits to cover soft exploits, adding that there are a “ton of different examples right now” along those lines.

---

Get the news in your inbox. Explore Blockworks newsletters:

• Blockworks Daily: The newsletter that helps thousands of investors understand crypto and the markets, by Byron Gilliam.
• Empire: Start your morning with the top news and analysis to inform your day in crypto.
• Forward Guidance: Reporting and analysis on the growing intersection of crypto and macroeconomics, policy and finance.
• 0xResearch: Alpha directly in your inbox. Market highlights, data, degen trade ideas, governance updates, token performance and more.
• Lightspeed: Built for Solana investors, developers and community members. The latest from one of crypto’s hottest networks.
• The Drop: For crypto collectors and traders, covering apps, games, memes and more.
• Supply Shock: Tracking Bitcoin’s rise from internet plaything worth less than a penny to global phenomenon disrupting money as we know it.