Flash Loan Attacks: A Decade of Evolution, Defense, and the Rise of Post-Oracle Exploits (2017-2026)

We present the first decade-scale longitudinal analysis of flash loan attack evolution across 824 confirmed DeFi security incidents (2017-2026). We identify three distinct eras: the Spot Era (2020-2021) characterized by naive AMM price manipulation; the Oracle Hardening Era (2022-2024) where attackers pivoted to TWAP-resistant price feeds; and the Post-Oracle Era (2025-2026) introducing precision-backdoor-accounting attacks entirely independent of price manipulation. We contribute an 8-pattern taxonomy spanning flash loan amplifiers, three generations of Solidity defense code, and the Hardening Paradox: protocols that fortify against observed attacks inadvertently expose themselves to higher-order exploits.