Cross-DEX Flash Loan Arbitrage

A Solidity-based DeFi arbitrage system that uses Aave V3 Flash Loans to capture price differences between two constant-product AMMs.

The system borrows WETH from Aave, swaps it for USDC on the more favorable DEX, swaps USDC back to WETH on the second DEX, repays the flash loan plus premium, and keeps the remaining amount as profit.

⚠️ Deployed and tested on Ethereum Sepolia. This project is for educational and experimental purposes.

Features

• Aave V3 Flash Loans
• Cross-DEX arbitrage
• Constant-product AMM (x * y = k)
• Configurable swap fees
• Slippage protection
• Profitability validation
• SafeERC20
• Foundry fuzz testing
• Foundry invariant testing
• Token conservation checks
• Reserve/accounting invariants
• Sepolia deployment and contract verification

Architecture

             Aave V3
                │
          Flash Loan WETH
                │
                ▼
       FlashLoanReceiver
                │
         WETH → USDC
                │
                ▼
              DEX2
                │
         USDC → WETH
                │
                ▼
              DEX1
                │
                ▼
       Repay Aave + Premium
                │
                ▼
              Profit

Arbitrage Setup

The project uses two decentralized exchanges (DEXs) with different liquidity reserves, creating a price imbalance that can be exploited through arbitrage.

DEX1

Token	Liquidity
WETH	0.10 WETH
USDC	20 USDC

DEX2

Token	Liquidity
WETH	0.10 WETH
USDC	40 USDC

Both DEXs use a 0.30% (30 BPS) swap fee.

Arbitrage Path

The price imbalance allows the following arbitrage path:

WETH → USDC on DEX2 → WETH on DEX1

The arbitrage transaction is designed to execute atomically using an Aave V3 Flash Loan.

---

Sepolia Deployment

The contracts have been deployed on the Ethereum Sepolia Testnet.

Contract	Address
DEX1	0x374557E198FF3ee8356048562927845D14631391
DEX2	0x84DB392D4daeC54Da768a64f6278E2a6343b582c
FlashLoanReceiver	0x635F5887Cb8fAE5210Ea420903C0fe7B0eDB1F65
WETH	0xC558DBdd856501FCd9aaF1E62eae57A9F0629a3c
USDC	0x1c7D4B196Cb0C7B01d743Fbc6116a902379C7238

Aave V3 Sepolia PoolAddressesProvider

0x012bAC54348C0E635dCAc9D5FB99f06F24136C9A

Network: Ethereum Sepolia

---

Testing

The project uses Foundry for comprehensive smart contract testing.

The test suite includes:

• Unit testing
• Fuzz testing
• Invariant testing

---

Running the Project

1. Clone the Repository

Clone the repository from GitHub:

git clone https://github.com/ArashGandomkar/flashloan-arbitrage.git

2. Install Dependencies

Install the project's Foundry dependencies:

forge install

3. Build the Project

Compile all Solidity contracts:

forge build

4. Run Tests

Run the complete test suite:

forge test

---

Environment Variables

Create a .env file in the root directory of the project:

SEPOLIA_RPC_URL=your_rpc_url
PRIVATE_KEY=your_private_key
ETHERSCAN_API_KEY=your_etherscan_api_key

Load the environment variables into your current terminal session:

source .env

You can verify that the RPC URL is loaded with:

echo $SEPOLIA_RPC_URL

⚠️ Never share your PRIVATE_KEY or API keys publicly.

---

Deployment

Before deploying, make sure that:

• The project builds successfully with forge build
• All tests pass with forge test
• The .env file is configured
• The deployer wallet has enough Sepolia ETH for gas
• The private key belongs to the intended deployment wallet

Simulate Deployment

Run the deployment script without broadcasting a transaction:

forge script script/DeployArbitrageSystem.s.sol:DeployArbitrageSystem \
    --rpc-url $SEPOLIA_RPC_URL \
    --private-key $PRIVATE_KEY \
    -vvvv

Deploy to Sepolia

Broadcast the deployment transaction:

forge script script/DeployArbitrageSystem.s.sol:DeployArbitrageSystem \
    --rpc-url $SEPOLIA_RPC_URL \
    --private-key $PRIVATE_KEY \
    --broadcast \
    -vvvv

⚠️ Always verify the target network and deployment addresses before broadcasting transactions.

---

Contract Verification

After deployment, contracts can be verified on Etherscan using Foundry.

Example:

forge verify-contract \
    <CONTRACT_ADDRESS> \
    src/<CONTRACT_FILE>.sol:<CONTRACT_NAME> \
    --chain sepolia \
    --etherscan-api-key $ETHERSCAN_API_KEY

For contracts with constructor arguments, the encoded constructor arguments must also be provided.

---

Tech Stack

• Solidity ^0.8.20
• Foundry / Forge
• Aave V3
• OpenZeppelin
• Ethereum Sepolia
• ERC20
• Constant Product AMM
• Flash Loans

---

Security Notes

⚠️ This project has not been professionally audited and should not be used with real funds.

This project is intended for educational and experimental purposes.

Before using a similar system in production, additional security reviews, testing, and auditing would be required.

Potential production improvements include:

• MEV protection
• Gas-aware profitability calculations
• Automated arbitrage opportunity detection
• Oracle integration
• Slippage protection
• Minimum profit thresholds
• Comprehensive security auditing

---

License

This project is licensed under the MIT License.