Flash Loan Attack Vector Analysis: Portal

1. Portal is a cross-chain liquidity hub focusing on flash-loans, leveraged yield farming, and AMM pools on Ethereum L1 and L2 roll-ups. Its flash loan feature drives revenue but also creates a significant attack surface.

2. The analysis concentrates solely on flash loan attack vectors, exploring ways an attacker can exploit the protocol using flash loans.

3. Key findings reveal four major attack vectors, each with varying likelihood, potential impact, and overall risk scores.

4. The highest risk vector is oracle price manipulation, with a likelihood of high, potential impact of up to ~30% TVL loss, and an overall risk score of 9/10. An attacker can push the TWAP price outside market equilibrium, manipulate the price during the flash loan window, and profit by triggering under-collateralized liquidations or flash loan fees.

5. Re‑entrancy through callback-enabled flash loan receiver contracts poses a medium risk, with a potential impact of draining up to 5% of the flash loan pool. Attackers can exploit the lack of non-reentrancy guards in core contracts, allowing them to withdraw more assets than they're entitled to after manipulating the borrower's balance.

6. A "flash loan liquidation sandwich" attack vector is medium-high risk, with a potential loss of 2-8% TVL per event. Attackers can front-run liquidations after a flash loan-driven price swing, stealing collateral from vulnerable borrowers.

7. Governance takeover via flash loan-funded token voting has a low-medium risk, depending on token distribution, and could alter protocol parameters, posing systemic risk.

8. Cross-chain replay and bridge manipulation combined with flash loans have a low risk but could result in temporary loss of assets on specific L2 bridges.