How can a DEX protect itself against flash loan attacks?

I've seen this code inside a function:

require(msg.sender == tx.origin, "probably a flash loan tx")

Is it effective?

Are there other ways?

  • That require will ensure that the caller is indeed a human and not a contract by ensuring that the origin is the sender. Though this will also exclude multisig users. And sometimes you'd want other protocols to be able to interact with your dex (that can be something valuable in web3)
    – lain
    Jan 14 at 22:10
  • @lain can you elaborate? examples?
    – Okkun
    Jan 15 at 12:41
  • With that require, the address that calls your contract must also be the origin (the sender that initiated the transaction call). User1 -> Your Contract will be a valid call, User1 -> Contract A -> Your Contract will fail.
    – lain
    Jan 15 at 14:06
  • @lain -> I know.
    – Okkun
    Jan 15 at 17:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.