Can an Attacker Cause Both an Overflow and an Underflow in a Single Transaction?

Yes, an attacker can cause both an overflow and an underflow in a single, complex transaction, especially if the smart contract uses unchecked arithmetic and performs multiple sequential operations. For example, a transaction could first cause an underflow in a user's debt calculation (wrapping to a massive positive number) and then use that massive number in a subsequent calculation that causes an overflow (wrapping back to a small number).

This combination of wraps can be used to bypass multiple internal checks.