Flash Loan Attack Vector Analysis: Sky Lending

Sky Lending is a high-throughput lending protocol deployed on Ethereum and multiple L2 roll-ups, with a total value locked (TVL) of approximately $5.9 billion. Analysts have identified five key attack vectors related to flash loans that could pose significant risks to the protocol.

First, oracle price manipulation via flash loan-driven token swaps presents a high-moderate risk. By initiating a flash loan and manipulating the price of a stablecoin on a low-liquidity DEX, an attacker can create an under-collateralized loan on Sky Lending. This could lead to the loss of up to 30% of the protocol's TVL in a single transaction.

Second, re-entrancy through the withdrawRewards() callback also poses a high-moderate risk. By exploiting the Checks-Effects-Interactions pattern in the reward token's implementation, an attacker could create a malicious contract that repeatedly calls the withdrawRewards() function, potentially draining up to $150 million in reward tokens and inflating the attacker's governance voting power.

Third, a cross-L2 bridge race condition could temporarily create "ghost" liquidity on Layer 2, allowing under-collateralized borrowing. This medium-moderate risk arises when an attacker leverages a flash loan on Layer 1 to deposit assets into the L2 bridge, then opens a borrowing position on the L2 instance of Sky Lending before the bridge's finalization on Layer 2.

Fourth, liquidation-triggered flash loan sandwich attacks present a high-moderate risk. By monitoring pending liquidation calls and front-running them with a flash loan, an attacker can manipulate the collateral price and capture the liquidation bonus while the borrower's position remains healthy.

Lastly, a reward-distribution "snapshot" manipulation low-moderate risk could result in minor inflation of reward tokens (around 0.5% of the total supply). This attack could be used to create reputational risk for the protocol but is unlikely to cause significant financial harm.