Aave doc about flash loan warns to never store funds inside a receiver contract as it can be exposed to "griefing" attack.

So my questions are

  1. Can you give an example of this attack?
  2. How can funds be stored, when they need to be returned in the same transaction?


2 Answers 2


Developer @ Aave here, good questions.

  1. It depends on your contract. But a simple one would be:
  • Contract A has funds and the executeOperation()
  • Contract B calls flashloan(), passing in Contract A as the receiverAddress
  • Contract A now executes executeOperation()
  • Contract A repays the flash loaned amount and debt as designed

The attack would be an attacker contract also passing in Contract A as the receiverAddress.

  1. In the above example, if you are doing profitable arbitrage trades with flash loans, it is possible that you're leaving profits on Contract A. So the flash loaned amount is returned, but your profit remain in the contract (if you don't actively transfer them out).
  • 2
    Why is this an attack though? If Contract A is meant to be an arbitrage bot, then its executeOperation() should only terminate if the operation results in net positive gains, right? So even if Contract B calls flashloan(), giving Contract A's address, is there a way for Contract A to actually lose funds?
    – samlaf
    Jan 26, 2022 at 3:46
  • You could have a positive arbitrage but flashloan fees are larger than the arbitrage. Yes you can write boilerplate code to check but it wastes gas and isn't straightforward/intuitive May 11, 2022 at 7:37

I think the things is: anyone can call the function in contract A means anyone can utilize the funds inside the contract. This can finally used up the funds and it is called a griefing attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.