Flash Swap Explained in Detail
A flash swap lets a user receive tokens from an AMM pool before paying for them. The user must repay the pool, or provide equivalent value, before the transaction ends.
The flow usually depends on a callback into the borrower's contract.
Smart contract example
pool sends tokens -> borrower callback runs -> borrower repays pool
If repayment fails, the whole transaction reverts.
Flash Swap in Auditing
Flash swaps provide same-transaction liquidity and external callback control. They can be used for arbitrage, but also for oracle manipulation, reentrancy, and price-dependent exploits.
Auditors review both protocols that offer flash swaps and protocols that can be attacked using them.
Red flags in code
-
Callback does not verify the real pool sender.
-
Protocol reads AMM spot prices after a flash swap changes reserves.
-
Repayment logic ignores fees or token behavior.
-
Callback can reenter sensitive functions.
-
Pool address or token pair assumptions are weak.
How to test or review it
-
Implement a malicious callback contract.
-
Manipulate a dependent pool or oracle during the callback.
-
Test repayment success, underpayment, and revert paths.
-
Verify callback sender and token pair.
-
Combine with flash loan attack scenarios.
Keep learning this topic
Flash Loan Attack
A flash loan attack uses same-transaction borrowing to amplify an existing DeFi vulnerability, usually in pricing, collateral, governance, or accounting.
AMM
An AMM, or automated market maker, is a decentralized exchange design where smart contracts quote trades from liquidity and formulas instead of an order book.
External Call
An external call is an interaction where one smart contract calls another address, creating a trust boundary and possible control-flow risk.
Practice this in real audit scenarios
Definitions help, but auditors need reps. SCH turns concepts like Flash Swap into exploit labs, code review habits, and report-writing practice.
Start the free trial or see the full smart contract auditing course.