Flash Loan Attack Vector Analysis: Concrete

Concrete is a lending/borrowing platform on Ethereum and L2 roll-ups, managing about $1.26 billion in total value locked (TVL). It allows flash loans without collateral, which can be used for arbitrage, collateral swaps, and complex interactions. However, this functionality also creates potential attack vectors.

The analysis, based on the latest audited version (v2.3.1, deployed 12 June 2026) and recent bug bounty submissions (up to 30 September 2026), identified several high-impact issues. Firstly, oracle price manipulation through flash loans can exploit the protocol's dual oracle model, potentially causing undercollateralized positions, forced liquidations, and losses of up to 30% of the market's TVL.

Secondly, reentrancy in the withdrawCollateral callback on the L2 bridge allows an attacker to withdraw collateral multiple times, potentially draining up to $50 million in a single block. Thirdly, liquidation loop race conditions enable a flash loan attacker to trigger multiple liquidations and earn liquidator rewards, extracting up to $5 million in LQT tokens.

Fourthly, governance proposal execution combined with flash loan voting power manipulation could allow malicious changes to protocol parameters, which could be reverted after the loan, leaving the protocol in a compromised state. Lastly, insufficient maximum flash loan caps on newly added assets could result in small-scale profit extraction that could compound over time.

Overall, the risk score for Concrete's flash loan functionality is 7 out of 10. While the protocol's flash loan capability is essential, these vulnerabilities could jeopardize a significant portion of its TVL in a single block if unaddressed.