Overview
TheIBorrower interface defines the contract API for borrower adapters that serve as intermediaries between CoW Protocol’s Flash-Loan Router and various lending protocols. Since different flash-loan protocols have varying callback mechanisms, each requires a dedicated borrower implementation.
Contract Details
- Source:
src/interfaces/IBorrower.sol - License: GPL-3.0-or-later
- Solidity: ^0.8.28
Functions
flashLoanAndCallBack
borrowerCallBack().
Parameters:
lender: Address of the flash loan providertoken: ERC-20 token to borrowamount: Amount of tokens to borrowcallBackData: Data to pass back to the router unchanged
- Only callable by the registered Flash Loan Router
approve
token: ERC-20 token to approvetarget: Address to approve for spending (typically the lender)amount: Amount to approve
- Only callable by the settlement contract
Approvals persist beyond individual transaction execution. Setting unlimited approvals once can save gas across multiple settlements.
settlementContract
router
Protocol-Specific Implementations
Different lending protocols require different callback mechanisms:| Protocol | Flash Loan Function | Callback Function |
|---|---|---|
| Aave V3 | flashLoan() | executeOperation() |
| ERC-3156 | flashLoan() | onFlashLoan() |
| Uniswap V2 | swap() | uniswapV2Call() |
| Uniswap V3 | flash() | uniswapV3FlashCallback() |
| Balancer | flashLoan() | receiveFlashLoan() |
IBorrower interface.
Implementation Requirements
When implementing a borrower contract:- Restrict access: Only the router should be able to trigger flash loans via
flashLoanAndCallBack() - Pass data unchanged: The
callBackDatamust be forwarded to the router exactly as received - No fund retention: The borrower should not hold funds between transactions
- Careful approvals: Manage token approvals carefully to prevent unauthorized transfers
- Implement provider callback: Handle the provider-specific callback and forward to
router.borrowerCallBack()
Security Considerations
flashLoanAndCallBack()must only be callable by the authorized routerapprove()must only be callable by the settlement contract- Callback data integrity must be maintained throughout the execution flow
- Token approvals should be managed with care to prevent exploitation