Overview:

Flashloans are a DeFi cornerstone. In this article, we explore how flashloans work on Solana using Instruction Introspection, how to implement a 'look-ahead' mechanism via the Instructions Sysvar, and the critical security checklist we must verify to prevent repayment spoofing.

1. Introduction: What is Flashloan

A flashloan is an uncollateralized loan that only exists within the lifespan of a single transaction.

The core invariant is simple: the transaction must complete with the lending pool’s vault satisfying final_balance >= initial_balance + fee. If not, the transaction reverts.

2. EVM vs Solana comparison

On EVM, flashloans use callbacks. The contract sends funds to the borrower contract, triggers a specific function within that contract, and waits for the borrower's contract to return the funds.

Solana operates differently. Due to Solana's Cross Program Invocation(CPI) depth limit (currently capped at 4) and its rigid upfront account requirements, this callback implementation is impractical.

3. Solana Instruction Introspection

Instead of callbacks, Solana uses Instruction Introspection. This utilizes the Instructions Sysvar (Sysvar1nstructions11111...), built-in system account that provides a read-only view of the entire transaction.

By accessing this account, a program can effectively "look ahead" at the flattened instruction sequence. It can verify that a valid payback instruction is already bundled later in the same transaction before it releases the funds.

4. Visualizing the Execution Flow

To execute this on-chain "look ahead", a program can use two core functions from the sysvar::instruction module:

• load_current_index_checked: This fetches the index of the currently executing instruction (the "Borrow" instruction).
• load_instruction_at_checked: Using the index above. We can loop forward and load the data of each subsequent instruction.

Once the instruction is loaded, we must verify it to ensure it isn't malicious.

5. Security Checklist for Flashloans

Locating a payback instruction is only step one. If you are building or auditing a Solana flashloan, simply finding the instruction isn't enough—you must deeply inspect its contents to prevent repayment spoofing.

• CPI Guard: Ensure the program isn't being called via a Cross-Program Invocation (CPI). Check Current Stack Height == 1 to confirm the instruction is executing at the top level of the transaction, not nested inside another program's CPI call.
• Program ID & Discriminator: Ensure the instruction actually belongs to your program and matches the 8 bytes PAYBACK discriminator.
• Strict Account Validation: Verify that the instruction’s accounts exactly match the expected vault accounts.
• Amount Verification: Ensures that the repayment >= borrow amount + fee
• Global State Locks (Reentrancy Guard): Set an is_flashloan_active flag during the borrow phase. This prevents instruction-level reentrancy, ensuring an attacker cannot read or manipulate distorted pool states before the loan is repaid.
• Borrow-Repay Pairing: Ensure each borrow instruction maps to exactly one unique repay instruction. Without this, an attacker could bundle two borrows but only one repay — a naive forward scan would match the single repay to the first borrow, leaving the second borrow effectively free.

In summary: Solana flashloans use instruction introspection to look ahead. Finding a repay instruction is only the first step — without strict validation, repayment can be spoofed.

Thank you for reading! I hope it provided value. If you have feedback, questions, or insights, feel free to share them in the comments. Follow me for more technical deep dives and smart contract auditing. 🚀