Is crypto lending safe?

DeFi lending protocols (Aave, Compound) are audited and overcollateralized, making them structurally safer than CeFi lenders. However, all lending carries smart contract risk, liquidation risk, and rate variability. Never lend more than you can afford to lose.

What are current crypto lending rates?

As of 2026, DeFi supply rates range from 2.6% to 3.8% APR on major stablecoins, while borrow rates range from 4.9% to 7.1%. CeFi platforms offer higher headline rates but carry additional counterparty risk.

category.flash_loans.label

category.flash_loans.promise

Starting path

The same $100m loan costs $50,000 at Aave and nothing at a fork of Aave.

Flash Loan Venues evaluated across single-transaction borrowable depth, loan cost in basis points, integration surface, and venue incident record.

category.flash_loans.promise Reviewed on single-transaction borrowable depth, loan cost in basis points, integration surface, and venue incident record.

Start with the smart category assistant or jump straight into quick questions. Both paths narrow to the same recommendation standard.

How we review

Recommendation first, comparison only if needed.

Reviewed and rechecked on the current cycle.

Commercial relationships disclosed before clickout.

Audit

Infrastructure

Methodology

2026.04.0

published 2026-04-27

Providers tracked

710+

across 80 categories

Last verified

2026-08-07

editorial freshness

Editorial board

4

audit-log live

Decision guide

What matters most before choosing in this category

Weighted on single-transaction borrowable depth (30), loan cost in basis points (28), integration surface (22), and venue incident record (20). This deliberately scores nothing a supply-APY comparison scores. The headline: SparkLend runs Aave v3 code - its own docs describe what it changed relative to "Upstream Aave v3" - and returns FLASHLOAN_PREMIUM_TOTAL() = 0 against Aave's 5, on a pool DefiLlama values at $4.51bn on Ethereum. On a $100m USDS or DAI flash loan, both sizes SparkLend can fund, the identical operation with the identical executeOperation callback costs $50,000 at Aave and nothing at SparkLend. What Aave's premium buys is breadth of asset and chain, not a better flash loan.

Key question

Can the venue actually fund your size, today, in the asset you need?

Key question

What is the fee in basis points - read from the contract, not the docs?

Key question

Is an incident in its record an exploit OF the venue, or one that merely used it?

Current editor lead

Dai Flash Mint (DssFlash)

ERC-3156 flash mint module that creates Dai on demand up to a governance ceiling and burns it at the end of the transaction.

Data checked Aug 2026

ERC-3156 flash mint module that creates Dai on demand up to a governance ceiling and burns it at the end of the transaction. Strongest on integration surface (10/10): The only venue in this pool that implements the actual standard rather than a house interface. This page states 'Since the Flash module conforms to the ERC3156 spec, you can just use the reference borrower implementation from the spec', and the module README at… Weakest on single-transaction borrowable depth (7/10): Uniquely in this pool, depth is not somebody's deposits — it is a mint ceiling, so it cannot be drained by other users and does not fluctuate with TVL. Read on-chain at Ethereum block 25698615 (2026-08-06) and again at block 25702344 (2026-08-07), maxFlashLoan(0x6B175474E89094C44Da98b954EedeAC495271d0F) on the module… Published price: The docs describe a fee: 'The Flash module allows anyone to mint Dai up to a limit set by Sky Governance with the one condition that they pay it all back in the same transaction with a fee', and the glossary defines it as 'Minting Fees: How much additional…

Best for

Integration surface — 10/10Venue incident record — 9/10Loan cost in basis points — 8/10

Main tradeoff

It mints Dai, and only Dai. Sky's own ecosystem has moved its centre of gravity to USDS — SparkLend's largest reserve at Ethereum block 25698729 (2026-08-06) was USDS at 274,141,154.964723 available versus 112,668,695.621999 DAI — so a strategy built on the 500m Dai ceiling depends on Dai liquidity remaining deep enough to convert into whatever the trade actually needs, on a token the issuer is steering users away from.

Verify before signup

The docs describe a fee: 'The Flash module allows anyone to mint Dai up to a limit set by Sky Governance with the one condition that they pay it all back in the same transaction with a fee', and the glossary defines it as 'Minting Fees: How much additional Dai must be returned to the Flash module at the end of the transaction. This fee is transferred into the vow at the end of a successful mint. Encoded as toll in wad units.' (page fetched 2026-08-06 and re-fetched 2026-08-07). The contract disagrees with the prose. Read directly from the DssFlash module at 0x60744434d6339a6B27d73d9Eda62b6F66a0a04FA on Ethereum at block 25698615 (2026-08-06), the ERC-3156 accessors return flashFee(DAI, 1e24) = 0 and maxFlashLoan(DAI) = 500000000000000000000000000 wad = 500,000,000 DAI; max() returns the same 5e26. Both were re-read at block 25702344 on 2026-08-07 and were unchanged. The fee a borrower actually pays today is zero on any size up to the 500m ceiling.

Weighted criteria

Single-transaction borrowable depth30%

Loan cost in basis points28%

Integration surface22%

Venue incident record20%

Leading options

Shared shortlist for this category

These providers are pulled from the same category comparison catalog used in validation, so the category page, comparison page, and provider reviews stay aligned.

Morpho (Morpho Blue)

Immutable lending primitive whose flashLoan draws on the entire token balance of the singleton contract, one asset per call.

Editor lead

Immutable lending primitive whose flashLoan draws on the entire token balance of the singleton contract, one asset per call. Strongest on loan cost in basis points (10/10): The only venue in this pool where zero is a property of the code rather than a setting. The natspec states '`flashFee` is zero.' and the implementation at raw.githubusercontent.com/morpho-org/morpho-blue/main/src/Morpho.sol lines 426-430 contains no fee term at all — the amount pulled back by safeTransferFrom is the… Weakest on integration surface (6/10): The thinnest interface in the pool. The docs describe the whole flow as 'A user contract calls morpho.flashLoan(token, amount, data)' followed by 'Morpho calls onMorphoFlashLoan(amount, data) on the caller contract', and repayment is pull-based: the borrower 'must approve Morpho to pull back the borrowed amount'. Two… Published price: Zero, and structurally so. The interface source states the fee in the natspec directly above the function, fetched 2026-08-06 and re-fetched 2026-08-07, across four consecutive comment lines: 'Warning: Not ERC-3156 compliant but compatibility is easily…

Best for: Loan cost in basis points — 10/10

Dai Flash Mint (DssFlash)

ERC-3156 flash mint module that creates Dai on demand up to a governance ceiling and burns it at the end of the transaction.

Best for: Integration surface — 10/10

SparkLend

Aave v3 fork charging zero basis points, with flash-loan-into-debt removed and per-reserve flash-loan flags documented.

Aave v3 fork charging zero basis points, with flash-loan-into-debt removed and per-reserve flash-loan flags documented. Strongest on single-transaction borrowable depth (8/10): Deep, but lopsided in a way no headline shows. The Pool at 0xC13e21B648A5Ee794902342038FF3aDAB66BE987 returned 18 reserves via getReservesList(); reading the underlying held by each spToken at Ethereum block 25698729 (2026-08-06) gives USDS 274,141,154.964723 (spUSDS 0xc02ab1a5eaa8d1b114ef786d9bde108cd4364359), DAI… Weakest on venue incident record (8/10): No record naming Spark or SparkLend appears anywhere in DefiLlama's 612-record hacks dataset read 2026-08-07 — filtering the dataset on /spark/i returns an empty list, and I looked rather than assumed. Held at 8 rather than 9-10 on two grounds visible in this session's own evidence: SparkLend is a fork of Aave v3 by… Published price: Zero, measured, against a documented mechanism that could change it. The docs state (fetched 2026-08-06, re-fetched 2026-08-07) 'The flash-loan fee is split between the LPs of the borrowed reserve and the protocol treasury. Both shares are bps and are…

Best for: Single-transaction borrowable depth — 8/10

Browse this network

Methodology

How this category is reviewed

Reviewed on single-transaction borrowable depth, loan cost in basis points, integration surface, and venue incident record.

Reviewed on: Single-transaction borrowable depth, Loan cost in basis points, Integration surface, Venue incident record.

This page is a maintained category surface, not a static marketing block. Review freshness, provider positioning, and recommendation logic should stay consistent with quiz and provider pages.

Frequently asked

Questions people ask before choosing flash loan venues

Which venue is cheapest?

Several charge zero, and the useful question is which of those can fund you. SparkLend returns FLASHLOAN_PREMIUM_TOTAL() = 0 with $4.51bn on Ethereum and 274,141,154.96 USDS plus 112,668,695.62 DAI available at the block read. Balancer V2 is the famous free venue and is now largely empty: its own live documentation still says "On mainnet the vault holds over a billion dollars worth of assets", while the Vault held 306,263.69 USDC, 1,298.08 WETH, 96,231.44 DAI and 11.79 WBTC at Ethereum block 25698583, against all-chain V2 TVL of roughly $26.4m. That is off by about 38x, on the single sentence a developer is most likely to act on. Aave v3 charges 5 bps and buys breadth rather than a better loan.

Does the flash-loan fee still go to suppliers?

At Aave, no, and the documentation has not caught up. The guide presents the split as "Fee to LP: FLASHLOAN_PREMIUM_TOTAL - FLASHLOAN_PREMIUM_TO_PROTOCOL" and reassures that "At initialization, FLASHLOAN_PREMIUM_TO_PROTOCOL is set to 0". Read on 2026-08-06, FLASHLOAN_PREMIUM_TO_PROTOCOL() returns 10000 on all five Pools checked, and the Pool reference documents that parameter as "expressed in bps" - so 10000 bps is 100%. The documented "Fee to LP" line evaluates to zero, while the same reference still describes a design where "A part is sent to aToken holders as extra, one time accumulated interest". Suppliers whose liquidity funds every flash loan now receive none of the 5 bps, and nothing on the guide says so.

Are flash loans responsible for all those exploits?

Usually they are the tool, not the hole, but the honest version is narrower than the usual defence. DefiLlama's hacks dataset carries 612 records, 93 of which name "Flashloan" as a technique - the largest being Euler V1, 2023-03-13, $197,000,000. In most of those the flash-loan venue was repaid within the transaction and lost nothing; the loss sat at whatever the borrowed capital was pointed at. But it is not true that none is a loss at a venue: CREAM, Rari, Sonne and UwU were themselves flash-loan lenders when they were exploited. When you read a venue's incident record, separate an exploit OF the venue from one that merely borrowed through it - the two say completely different things about the code you are about to integrate.

REVIEWEDApr 2026METHOD4 criteriaCATEGORYflash_loans

Not financial advice · For informational purposes only · Always do your own research

Octopus · The AI CFO that pays for itself

Audit your entire crypto stack — free.

Score concentration, fees, security, and tax complexity across exchanges, wallets, staking, and DeFi.

Not financial advice · For informational purposes only · Always do your own research