Many people think flash loans are simple, but this is where it’s easy to get things wrong:
The borrowed funds and fees must be returned to the liquidity pool before the transaction ends. Otherwise, the entire transaction is reverted, as if it never happened.
Flash loans work without collateral because of transaction atomicity: the entire transaction either succeeds or fails, so borrowed funds can never go unpaid.
When evaluating a protocol, pay attention to where its prices come from: protocols that rely only on the spot price of a single DEX pool are more vulnerable to flash loan attacks.
The lending protocol Aave behind $AAVE supports flash loans.