Solana can't seem to stay out of the news and not in a way you want to be featured. Around $3.5 million was exploited from the Nirvana Finance platform due to a flash loan exploit. Nirvana Finance is a DeFi protocol on Solana. As far as I know it, Nirvana Finance is not owned by Solana team and is a third-party project.
What is a flash loan?
A flash loan is similar to any other unsecured lending in the crypto space except for the fact the entire lifecycle is in a single transaction. That means a user will borrow and pay back funds immediately. This is only possible using platforms that support smart contracts.
The main reason to use flash loans is to take advantage of an arbitrage opportunity with more leverage.
Because flash loans are handled by a smart contract, they are generally considered safe for both parties. However if you exploit the price of one of the tokens in the transaction to make it seems as though the loan is repaid, you can come out with millions in profit.
Nirvana Finance exploit
This is how Nirvana Finance was exploited. A user took out a flash loan for $10 million dollars worth of USDC and minted $10 million worth of ANA. This increased the price of ANA in excess of $10 million dollars allowing the attacker to return fewer ANA tokens than they minted.
In this case, they were able to make around $3.5 million dollar profit. The price of ANA dropped around 90% as a result of this.
Flash loan attacks are not new and the largest known flash loan attack happened on Ethereum for over $182 million dollars.