# Flash loan parameter validation gap

Caller-controlled params, slippage overrides, or self-transfers that let flash-loan callbacks move debt, collateral, or balances

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2025-02-08. Updated 2026-11-01._

## How it works
A flash-loan-funded path trusts something the caller supplies. The contract assumes the caller's parameters (debt tokens, amounts, swap calldata, slippage) or the token's own balance accounting are benign, and acts on them without checking them against protocol-owned state. Because the funds arrive and leave within one transaction, an attacker can supply hostile parameters, skew a price, or inflate a balance, take the profit, and repay — all atomically, so the protocol never sees a safe intermediate state.

## Where it shows up
- Functions taking user-supplied `swapData`/calldata and executing low-level calls with it [E1](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md)
- Caller-settable `amountOutMinimum` or `_slippageOverride` feeding an internal DEX swap [E2](https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance.md)
- Flash-loan request handlers that pass debt tokens/amounts straight into manipulation logic without validation [E1](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md)
- Token `transfer` logic where self-transfer or repeated transfers change balances without cost [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md)
- Reward/treasury contracts that swap on a DEX using parameters the caller controls [E2](https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance.md)

## How to review
For each flash-loan-reachable entrypoint, ask: can the caller influence any value that decides which tokens move, how much, or at what price? The invariant: every parameter that affects asset movement must be bounded by protocol-owned state or an oracle, not by caller input. Specifically check that `amountOutMinimum`/slippage is not caller-settable, that low-level calldata cannot target `transferFrom` on other users' behalf [E1](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md), and that a token's balance after N self-transfers equals its balance after one (no inflation) [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md). Trace the full call graph from the flash-loan callback to any swap or transfer.

## How finders spotted it
- Noted `_slippageOverride` exposed as a caller-controlled parameter feeding `amountOutMinimum`, making reward processing sandwichable [E2](https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance.md)
- Grepped reward/treasury contracts for user-supplied slippage or min-out parameters feeding internal DEX swaps [E2](https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance.md)
- Observed that arbitrary `swapData` executed via low-level calls could invoke sensitive functions on other users [E1](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md)
- Checked token transfer logic for self-transfer or flash-loan-induced balance inflation [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md)

## Variants seen
- Unvalidated debt/collateral/swap parameters in a deleverage connector draining ~$1.8M [E1](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md)
- Caller-set slippage override on a reward swap draining ~$3,500 [E2](https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance.md)
- Self-transfer balance inflation in a BEP-20 token netting 17.4 BNB [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md)

## Impact and severity
Ranged from ~$3,500 (slippage override) [E2](https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance.md) to ~$1.8M (parameter-driven drain) [E1](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md) and 17.4 BNB (token inflation) [E3](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md). Impact scales with how much value the reachable swap/transfer path controls and whether the flaw lets an attacker name arbitrary tokens or amounts [E1](https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md) versus only skewing one swap's price [E2](https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance.md). Flash-loan funding removes the capital barrier, so even small logic gaps become profitable.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20240712-doughfina.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250208-peapodsfinance.md
- E3: https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md