How Sui Move rethinks flash loan security

Summary: Trail of Bits analyzed DeepBookV3's flash loan implementation on Sui and found that Move's "hot potato" model enforces repayment at the language level rather than through Solidity-style callbacks and runtime balance checks. A struct with no abilities cannot be stored, copied, or dropped, so a transaction that borrows without consuming the FlashLoan object through the return function is rejected by the Move bytecode verifier before execution.
Key Takeaway: Solidity's callback model left repayment checks to developers, and the Fei Protocol's failure to follow the check-effect-interaction pattern cost $80M in 2022; on Sui, failing to repay is not a risk to be prevented but a transaction the system will not execute.

Read the original at Trail of Bits Blog ↗