A flash loan lets anyone borrow a large sum with no collateral and no credit check. The mechanism that makes this safe for the lender is settlement, not trust.
Atomicity replaces collateral
A blockchain transaction either completes in full or has no effect. There is no partial outcome and no state left half-changed.
A flash loan uses that property. The protocol lends funds, hands control to the borrower's contract, and checks the balance at the end of the same transaction.
If the amount plus a fee has not returned, the whole transaction reverts and the loan is unwound as though it never happened.
The borrower must be a contract
Everything has to happen within one transaction, so a human clicking through steps cannot do it. The borrow, the intermediate operations and the repayment are written into code beforehand.
That code executes atomically, which means the borrower is committing to a plan rather than reacting to what they find. If any step returns an unexpected result, the transaction fails and the only cost is the fee.
The fee is charged whether the plan succeeds or not, so unprofitable attempts are cheap but not free, and the strategy has to be right often enough to cover the failures.
The legitimate uses are mostly plumbing
Arbitrage is the clearest one. If the same asset is priced differently on two venues, borrowed capital buys on the cheap side and sells on the expensive side within one transaction.
Collateral swaps are another. A borrower can repay a loan, withdraw the collateral, exchange it for a different asset and reopen the position without finding the cash to close out first.
Liquidators use them to seize undercollateralised positions without holding a large inventory of the repayment asset.
Why they appear in so many exploits
Flash loans do not create vulnerabilities, but they remove the capital requirement for exploiting one.
A design that is only safe because manipulating it would require enormous funds is not safe in a system where enormous funds are available to anyone for the length of a transaction.
Wealth stops being a gatekeeper, and the only remaining barrier is whether the sequence of steps is profitable when it is forced to settle in one go.
What they expose about protocol design
Most flash loan incidents trace back to a price read from a source that can be moved within a single transaction, such as the instantaneous ratio of a thin pool.
Protocols that price from time-weighted averages or from independent oracle networks are harder to distort this way, because a momentary imbalance does not immediately become the reference price.
The broader lesson is that assumptions about who can afford to attack a system do not hold where capital can be rented for a few seconds.