Myth Buster #9: Defaulted Debts Can’t Bankrupt a Lending Protocol — Flash Loans Can

How 2024's Highest $9.75B Flash Loans Tanked UwU

🦄 Myth

Lending Protocols’ Biggest Risk Is Bad Debts.

Most users believe that lending protocol risk is primarily related to borrower behavior, including collateral ratios, liquidation thresholds, and missed repayments.

However, this case reveals a deeper truth: Flash loans render repayment irrelevant.

Because in modern DeFi, the biggest threat isn’t a borrower who defaults—it’s an attacker who repays.

---

🧠 What Happened

Within a single transaction, an attacker drew $3.49 B in flash liquidity—part of three attack transactions totaling $9.75 B, the highest of 2024—to warp the Curve USDE pool, misleading UwU Lend’s sUSDE price-oracle. The oracle overvalued the attacker’s collateral, allowing them to borrow aggressively, drain the pool, repay every flash loan atomically, and walk away with $19.3M in profit—all without ever breaching repayment rules.

---

🔬Microstructure

We selected the transaction that borrowed $3.49B via a flash loan, and here is its token flow chart with a simplified illustration focusing on flash-loan-related transfers.

---

🧬 Key Steps Breakdown

The previous chart shows that the attacker took flash loans from Balancer, Uniswap, Morpho, Spark, AAVE, and Sky(MakerDAO), with the total amount reaching $ 3.49 B.

Using these assets, the attacker precisely arranged the following steps.

• The attacker exchanged massive amounts of liquidity in Curve’s USDE pool.

• This manipulated the price oracle for sUSDE, UwU Lend’s synthetic stablecoin.

• The result? The attacker tricked the protocol into overvaluing collateral.

• Then they drained the pool, all within one atomic block.

The final haul: $19.3 million—extracted without ever violating repayment conditions.

This post from SlowMist would help you fully understand the exploit.

---

🧑‍🤝‍🧑Key Entities

• Spark is MakerDAO's decentralized lending protocol, offering features such as competitive interest rates, flash loans, and integration with the DAI stablecoin.

• Morpho is a decentralized lending protocol that optimizes rates by matching lenders and borrowers peer-to-peer, while falling back to Aave or Compound, enabling better yields and flash loan support.

• UwU Lend is a decentralized lending protocol that allows users to borrow and lend assets using overcollateralized positions, leveraging synthetic stablecoins and DeFi liquidity pools. The protocol was paused due to the exploits and later relaunched with security patches, but its reputation remains affected.

---

🔁 Not a Fluke

According to the Bank of Canada, over $2 trillion in flash loans were issued on EVM chains in 2024 alone. And they’re not just being used for arbitrage.

A report from Blockthreat confirmed flash loans were used in 5 of the 10 most exploited DeFi vectors last year:

• Price Oracle Manipulation

• Function Parameter Validation

• Reward Manipulation

• Reentrancy Attacks

• Governance Attacks

In total? $357 million in losses across 115 incidents—all powered by instant, uncollateralized capital.

The old model assumed attackers had to build up capital or collateral. Flash loans broke that. They allow anyone with a smart contract to simulate, fund, and execute an attack without persistence or exposure.

---

⚠️ Your Takeaway

• If you design protocols assuming capital friction, you’re building on sand.

• In DeFi today, the most dangerous borrower could be the one who pays you back immediately.

---

Read all MEV Myth Buster series here:

You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.

Follow us via these to dig more hidden wisdom of DeFi:

EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram

---