# Introduction to the Flash Loan Pattern and its security considerations

**URL:** <https://forum.openzeppelin.com/t/introduction-to-the-flash-loan-pattern-and-its-security-considerations/2331>\
**Category:** Guides and Tutorials\
**Tags:** flash-loan\
**Created:** [February 21, 2020, 5:01pm UTC](https://forum.openzeppelin.com/t/introduction-to-the-flash-loan-pattern-and-its-security-considerations/2331 "2020-02-21T17:01:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Austin-Williams](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/austin-williams/32/830_2.png) [@Austin-Williams](https://forum.openzeppelin.com/u/Austin-Williams)\
**Post date:** [February 21, 2020, 5:01pm UTC](https://forum.openzeppelin.com/t/introduction-to-the-flash-loan-pattern-and-its-security-considerations/2331/1 "2020-02-21T17:01:19Z")

</div>

![The Flash Loan Pattern](https://us1.discourse-cdn.com/flex022/uploads/zeppelin/original/2X/f/f00eecf3a1d69a7f0cb97ad176b6e7deaf32c80a.png)

# Introduction to the flash loan pattern and its security considerations

Hello everyone,

A few weeks ago I gave a presentation discussing the “flash loan” pattern and some of its security considerations.

This is a powerful DeFi primitive and it is good to know how it works and what to watch out for when auditing implementations of this pattern,

We don’t discuss “macro” vulnerabilities (like the recent pump and dump “hack”) because those aren’t really intrinsic to the flash loan pattern – any whale or coalition of attackers can do the same thing. Here we discuss only the security considerations that are intrinsic to flash loans. (Perhaps we can do a separate presentation on “macro” DeFi vulns that are available to whales, coalitions, and flash borrowers.)

A recording of the presentation can be found here:  
[The Flash Loan Pattern - Presentation video](https://zoom.us/rec/play/7pAtce-tqG83H9XG4QSDUfd-W9W-eqqs1ncdrPYIyR6zVXYGZwLzZuNAZuJgcsNtpSAiLR49LrDsHI_0?continueMode=true)

And the slides can be found here:

> **[The Flash Loan Pattern](https://docs.google.com/presentation/d/1a81S2j9driYKYry734eTvZ2rGDmbvEd3a_x5xlBxX6E/edit?usp=sharing)**
>
> The Flash Loan Pattern And its security considerations Austin Williams

---

<div class="post-metadata">

**Author:** ![Austin-Williams](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/austin-williams/32/830_2.png) [@Austin-Williams](https://forum.openzeppelin.com/u/Austin-Williams)\
**Post date:** [February 21, 2020, 5:05pm UTC](https://forum.openzeppelin.com/t/introduction-to-the-flash-loan-pattern-and-its-security-considerations/2331/2 "2020-02-21T17:05:31Z")

</div>

One important security consideration I didn’t mention in the video: It is important that when the `flashloan` function hands control over to the borrower, the Lending contract only ever calls the `execute` function on `msg.sender`.

If the borrower can make the Lending contract call any arbitrary function on any arbitrary contract during the `flashloan`, then they can (among other things) drain the Lending contract of all of its ERC20 tokens.

So always check that, during the `flashloan` function, the Lending contract only ever calls the `execute` function on `msg.sender`.

---

<div class="post-metadata">

**Author:** ![fiiiu](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/fiiiu/32/85_2.png) [@fiiiu](https://forum.openzeppelin.com/u/fiiiu)\
**Post date:** [February 28, 2020, 9:12pm UTC](https://forum.openzeppelin.com/t/introduction-to-the-flash-loan-pattern-and-its-security-considerations/2331/3 "2020-02-28T21:12:15Z")

</div>

@Austin-Williams linking here for reference [your implementation](https://github.com/Austin-Williams/safer-flash-loans) of safer flash loans, hope you don’t mind!

---

<div class="post-metadata">

**Author:** ![banescusebi](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/banescusebi/32/1845_2.png) [@banescusebi](https://forum.openzeppelin.com/u/banescusebi)\
**Post date:** [March 6, 2020, 5:45pm UTC](https://forum.openzeppelin.com/t/introduction-to-the-flash-loan-pattern-and-its-security-considerations/2331/4 "2020-03-06T17:45:44Z")

</div>

@Austin-Williams thanks a lot for the presentation. Great stuff!

Could you please help clarify how the borrower could drain the Lending contract of all of its ERC20 tokens, if the Lending contract can call any arbitrary function on any arbitrary contract during the `flashloan`?

---

<div class="post-metadata">

**Author:** ![inia-gold-bond](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.openzeppelin.com/inia-gold-bond/32/7713_2.png) [@inia-gold-bond](https://forum.openzeppelin.com/u/inia-gold-bond)\
**Post date:** [July 19, 2021, 1:23am UTC](https://forum.openzeppelin.com/t/introduction-to-the-flash-loan-pattern-and-its-security-considerations/2331/5 "2021-07-19T01:23:15Z")

</div>

Thanks for excellent Info abt Flashloan