QA Report

[code423n4]

L: Insufficient protection of sensitive data

The hardhat.config.ts uses sensitive information imported from an un-committed environment file. The usage of either .env imported variables or even plain pasted keys make it easier for an attacker to compromise the keys used for monitoring, deployment, testing and even if wallet private keys are used in such way funds can be compromised.

The following data could be compromised if a leak happens or if the .gitignore file is mistakenly deleted according to the imports performed on hardhat.config.ts:

const {
INFURA,
ACCOUNT_PRIVATE_KEY,
MNEMONIC,
ETHERSCAN_API_KEY,
CI,
REPORT_GAS,
COINMARKETCAP_API_KEY,
REPORT_SIZE,
REPORT_GAS_PRICE,
} = process.env;

It is advisable to use other ways of storing sensible keys such as hardware devices in order to prevent data leaks that may lead to catastrophic issues.