Aave doc about flash loan warns to never store funds inside a receiver contract as it can be exposed to "griefing" attack.

So my questions are

  1. Can you give an example of this attack?
  2. How can funds be stored, when they need to be returned in the same transaction?



Developer @ Aave here, good questions.

  1. It depends on your contract. But a simple one would be:
  • Contract A has funds and the executeOperation()
  • Contract B calls flashloan(), passing in Contract A as the receiverAddress
  • Contract A now executes executeOperation()
  • Contract A repays the flash loaned amount and debt as designed

The attack would be an attacker contract also passing in Contract A as the receiverAddress.

  1. In the above example, if you are doing profitable arbitrage trades with flash loans, it is possible that you're leaving profits on Contract A. So the flash loaned amount is returned, but your profit remain in the contract (if you don't actively transfer them out).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.