flashloan

Detects flash loan attack patterns in Solidity smart contracts during security audits.

66|17|Updated Jan 21, 2026
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill flashloan-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: flashloan
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/vulnerability-patterns/flashloan
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill flashloan-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Smart contract auditors need systematic knowledge to identify flash loan vulnerabilities, where attackers borrow unlimited capital in a single transaction to manipulate prices, governance votes, collateral values, or rewards. ## Core Features & Use Cases - Attack Pattern Detection: Provides vulnerable Solidity code patterns for price manipulation, governance manipulation, collateral manipulation, reward manipulation, and oracle manipulation, each with grep-based detection commands. - Protection Patterns: Documents mitigation techniques including snapshot/checkpoint patterns, TWAP oracles, same-block checks, and minimum lock periods. - Audit Checklist & Severity Classification: Supplies a review checklist and severity ratings (Critical/High/Medium) to triage findings. - Use Case: During a DeFi lending protocol audit, use this Skill to check whether liquidation logic relies on manipulable AMM spot prices and whether governance voting uses balance snapshots. ## Quick Start Audit this Solidity codebase for flash loan vulnerabilities, checking for spot price usage, balance-based voting, and missing same-block protections.

Frequently Asked Questions about flashloan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect flash loan vulnerabilities in Solidity contracts?▼

Flash loan vulnerability detection involves grepping for dangerous patterns like getReserves, slot0, and balanceOf used in voting or reward logic. This Skill provides specific grep commands and vulnerable code patterns for each attack category.

What are the main types of flash loan attacks on DeFi protocols?▼

The five main categories are price manipulation via AMM spot prices, governance manipulation via balance-based voting, collateral manipulation via instant deposits, reward manipulation via balance-based distribution, and oracle manipulation via on-chain DEX prices.

How do I protect a smart contract against flash loan attacks?▼

Use snapshot or checkpoint patterns for voting and rewards, TWAP oracles with periods of at least 30 minutes instead of spot prices, same-block action checks, and minimum lock periods for deposits and withdrawals.

Is a short TWAP period safe against oracle manipulation?▼

No, TWAP periods under 10 minutes are classified as High severity because attackers can still manipulate the average within a profitable window. The Skill recommends a minimum TWAP period of 30 minutes for manipulation resistance.

Which flash loan sources do attackers commonly use?▼

Common flash loan sources include AAVE V3 with a 0.05% fee, dYdX and Balancer with zero fees, Uniswap V3 with pool fees, and Maker for DAI. Each provides liquidity up to the available pool balance.