I looked into the details of the attack on sDOLA LlamaLend, and it’s a pretty good demonstration of what can go wrong with flash loans.

Basically, the attacker managed to manipulate the sDOLA price by using flash loans combined with donations. The exchange rate jumped from 1.189 DOLA to 1.353 DOLA — a sharp increase that tricks account health algorithms. Several positions in the crvUSD controller suddenly went below zero.

Where it gets sneaky is that the attacker positioned themselves as a liquidator. While everyone else looked away, they claimed liquidation rewards, resold them, repaid their flash loan, and walked away with about $240,000 in profit. This kind of attack shows why price oracles and liquidation mechanisms remain vulnerable points.

The interesting part is that this isn’t a new vulnerability — flash loans have been known for a long time. But it highlights how important it is to carefully design protections when managing a lending protocol. Cases like this help us understand why security audits and stress testing are critical in this space.