Price manipulation: why a flash loan fakes the number

#The price a contract cannot trust

A decentralised exchange holds two tokens in a pool and prices them by their ratio. That is elegant and it is also the weakness: the price is whatever the current balances say it is, and a large enough trade changes the balances, so a large enough trade changes the price. If another contract reads that price at the wrong instant and lends against it, or mints against it, or liquidates against it, the reader can be fed a number the attacker chose.

This is the single most costly bug class in DeFi. It is not a coding slip like a missing modifier; it is a design mistake about which numbers can be trusted, and it has drained hundreds of millions across dozens of protocols.

#Why a flash loan removes the "you'd need to be rich" defence

The instinct is that moving a large pool's price would take enormous capital, so only a whale could do it. A flash loan removes that objection entirely. It lends you an arbitrary amount with no collateral, on one condition: you repay it, plus a fee, before the transaction finishes. If you cannot, the whole transaction reverts as if it never happened, so the lender is never at risk. The attacker borrows millions, uses them for the length of one transaction, and repays from the profit, all atomically.

#The vulnerable read

The tell is a contract that derives a price from a pool's live balances, right now, and acts on it in the same call.

// Price = how much USDC the pool holds per token. Moves with every trade.
function spotPrice() public view returns (uint256) {
    uint256 tokenReserve = token.balanceOf(address(pool));
    uint256 usdcReserve  = usdc.balanceOf(address(pool));
    return (usdcReserve * 1e18) / tokenReserve;
}

function borrowAgainst(uint256 collateralTokens) external {
    uint256 value = collateralTokens * spotPrice() / 1e18;
    _lend(msg.sender, value);   // lends against a price the caller can move
}

The attacker flash-borrows, swaps a huge amount into the pool to spike spotPrice(), calls borrowAgainst to borrow far more than their collateral is really worth, swaps back to unwind the price, and repays the flash loan. The protocol is left holding collateral worth a fraction of what it lent.

#The fix: do not read a price you can move in one block

The defence is to price against something that cannot be shoved within a single transaction. There are two standard answers, and serious protocols use both.

// Read a value that is not the instantaneous balance of one pool.
function priceUSD() public view returns (uint256) {
    // A decentralised feed returns a recent, aggregated, signed price.
    (, int256 answer, , uint256 updatedAt, ) = priceFeed.latestRoundData();
    require(answer > 0, "bad price");
    require(block.timestamp - updatedAt < 1 hours, "stale price");
    return uint256(answer);
}