Since the last flashloan article, a few people have asked for an example of how a flashloan can be used to exploit a contract.
Let’s just use the most trivial and basic example:
Let’s just use the most trivial and basic example:
In this example, the ImprovedUniswapOracle contract uses Uniswap V2 to determine the price of a specific token pair. This pair is hard-coded into the contract during its initialization. The contract's functionality primarily revolves around the getLatestPrice method, which, given an input amount for tokenA, calculates the corresponding amount of tokenB that could be obtained.
This calculation is performed using the getAmountsOut function from the Uniswap V2 Router. This function leverages Uniswap's liquidity pool mechanics to provide an estimated output amount based on current liquidity and prices within the pool.
But what has this to do with a flashloan?
If you take a look at the UniswapV2 library, you will see this code:
This code-snippet basically (including the slippage logic) returns reserveOut / reserveIn, which is reflected as the current price of the pair. A malicious user can now take out a flashloan and purchase a large amount of one token from the pair, which then falsifies the ratio and returns a manipulated price.
Unfortunately, these attacks still happen to date, increased awareness for web3 security already greatly decreased these most basic exploit vectors.
