How can a DEX protect itself against flash loan attacks?

I've seen this code inside a function:

require(msg.sender == tx.origin, "probably a flash loan tx")

Is it effective?

Are there other ways?

  • That require will ensure that the caller is indeed a human and not a contract by ensuring that the origin is the sender. Though this will also exclude multisig users. And sometimes you'd want other protocols to be able to interact with your dex (that can be something valuable in web3)
    – phaze
    Jan 14, 2022 at 22:10
  • @lain can you elaborate? examples?
    – Okkun
    Jan 15, 2022 at 12:41
  • With that require, the address that calls your contract must also be the origin (the sender that initiated the transaction call). User1 -> Your Contract will be a valid call, User1 -> Contract A -> Your Contract will fail.
    – phaze
    Jan 15, 2022 at 14:06
  • @lain -> I know.
    – Okkun
    Jan 15, 2022 at 17:24


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.