isContract Validation Is Unsafe and Unreliable for Flash Loan Receiver Verification

Description

• The protocol relies on isContract to verify that the flash loan receiver is a contract. However, isContract returns false for contracts during construction, making it an unreliable validation mechanism.

  An attacker or integrator can execute flash loan logic from within a constructor, causing the validation to behave unexpectedly. Additionally, this pattern breaks compatibility with smart wallets and violates best practices recommended by the Ethereum community.

  Rather than providing security, this check introduces fragility and false assumptions about caller behavior.

Risk

Likelihood:

• Constructor-based execution and advanced contract patterns are common in modern DeFi, making this scenario realistic.

Impact:

• Low — Denial of Service and Integration Failure.
  While not directly leading to asset loss, this issue prevents valid flash loan use cases and breaks composability with smart-contract wallets and advanced integrations.

Recommended Mitigation