SMART CONTRACTS, DEFI & WEB3 SECURITY - Chapter 7, Exercise 3 Solution ========================================================== Why the Attacker Can Reliably Repay the Flash Loan and Keep the Profit PROBLEM ------- Using this chapter's own oracle manipulation flow, explain precisely which real property from Chapter 4 makes step 4 (repaying the flash loan and keeping the profit) reliably possible for the attacker, rather than a risky gamble that might leave them owing an unpaid loan. SOLUTION -------- The key property is transaction atomicity, which Chapter 2 first established and Chapter 4 applied directly to flash loans: an entire Ethereum transaction either completes in full, or every state change it attempted is reverted, as if none of it had ever happened. Chapter 4's own flash loan flow builds directly on this: borrowing, using the funds, and repaying are all forced into ONE single atomic transaction. Applied to this chapter's own oracle manipulation sequence, every one of the four steps - taking the flash loan, distorting the AMM price, exploiting the vulnerable protocol's mispriced reading, and reversing the trade to repay the loan - all happen inside that exact same single transaction. This is precisely why the attacker isn't taking a real gamble at all. If, for whatever reason, step 3 or step 4 failed to produce enough value to repay the flash loan in full, the entire transaction - every single step, including the original loan and the price manipulation itself - would simply revert, exactly as Chapter 4's own flash loan flow describes. The attacker would be left exactly where they started, having paid only the real gas cost of the failed attempt, never actually owing an unpaid loan, since the loan itself would never have taken effect at all in the chain's own final, recorded state. This is exactly what makes the exploit both attractive and dangerous in practice: the attacker can attempt it with essentially no real financial risk beyond gas costs, since atomicity guarantees the attempt either succeeds profitably or effectively never happened at all. ANSWER: Transaction atomicity (Chapter 2, applied to flash loans in Chapter 4) is what makes this reliable rather than risky - because the entire sequence, from borrowing through repaying, happens inside one single atomic transaction, any failure at any step reverts the whole thing, including the original loan. The attacker can never end up owing an unpaid flash loan; either the exploit succeeds and they keep the profit, or the whole attempt is undone as if it never happened, at the cost of only the gas spent attempting it. ---- WHY THIS WORKS AS AN ANSWER This correctly identifies atomicity, established in Chapter 2 and applied to flash loans in Chapter 4, as the specific mechanism removing the attacker's own real financial risk, rather than describing the exploit's profitability without explaining why it's reliably safe for the attacker to attempt.