/Reach - Diff 1

The `hardhat.config.ts` file exposes the team's API keys for mainnet, Sepolia, and Goerli as well as the etherscan's API key. The impact could include a DoS through financial loss since an attacker could use the keys to consume the team's Infura account balance.

A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker front-runs the victim trade by also buying asset Y, lets the victim execute the trade, and then executes another trade after the victim by trading back the amount gained in the first trade. Intuitively, one uses the knowledge that someone’s going to buy an asset, and that this trade will increase its price, to make a profit. The attacker’s plan is to buy this asset cheaply, let the victim buy at an increased price, and then sell the received amount again at a higher price afterward. The swap performed in `swapTokensForETH()` currently accepts any amount of ETH in return, making it vulnerable to sandwich attacks. Additionally, there have been cases with similar token contracts. If the token is listed in DEXs, an attacker could force the token contract to swap its balance in one pool which would lower its price, buy the token low in that pool, and sell it high in the second pool.