Neko / Trove LabsAirdrop Script Security Review

      await fs.writeFile(        join(__dirname, "..", "data", listName + ".json"),        JSON.stringify(list),      );       resolve();    } catch (e) {      console.log("Retrying Transfer to ", id);      resolve();    }  });  index++;  promiseArray.push(promise);}await Promise.all(promiseArray);

            const accountData = await nearConnection.connection.provider              .query(`account/${id}`, "")              .catch(async (_accountError) => {                console.log("Invalid account Id:", id);                await fs.appendFile(                  join(__dirname, "..", "error", listName + ".txt"),                  `${id}:${transferAmount.toString()} `,                );                delete list[id];                await fs.writeFile(                  join(__dirname, "..", "data", listName + ".json"),                  JSON.stringify(list),                );              });

import { connect, Contract, keyStores, utils, transactions } from "near-apijs";import inquirer from "inquirer";import fs from "fs/promises";import os from "os";import path from "path";import { fileURLToPath } from "url";import BN from "bn.js";// Custom types =====================type TokenMethod = {  ft_balance_of: (args: { account_id: string }) => Promise<string>;  storage_balance_of: (args: { account_id: string }) => Promise<any>;  ft_transfer: (args: {    args: { receiver_id: string; amount: string };    amount: string;  }) => Promise<void>;  storage_deposit: (args: {    args: { account_id: string; registration_only: boolean };    amount: string;  }) => Promise<string>;}; type TokenContract = Contract & TokenMethod;type List = {  [walletId: string]: number;};// ============================// Global variables ==========================const __filename = fileURLToPath(import.meta.url);const __dirname = path.dirname(__filename);const homedir = os.homedir();const CREDENTIALS_DIR = ".near-credentials";const credentialsPath = path.join(homedir, CREDENTIALS_DIR);const myKeyStore = new keyStores.UnencryptedFileSystemKeyStore(credentialsPath);const finishedList: List = {};// ==========================// Configs ===============const CONFIG = {  networkId: "mainnet",  nodeUrl: "https://rpc.mainnet.near.org",  walletUrl: "https://wallet.mainnet.near.org",

  helperUrl: "https://helper.mainnet.near.org",  explorerUrl: "https://explorer.mainnet.near.org",  keyStore: myKeyStore,};const contractId = "ndc.tkn.near";const PROMPT_MESSAGES = {  accountId: "Enter Account Id used for shooting Token:",  listName: "Enter the json file name:",  amount: "Enter the amount of TOKEN per NFT to shoot:",  confirm: (listName: string) =>    `Start Shooting Token to the list [ ${listName} ]?`,}; // ==========// Helper methods =================async function promptUser(  message: string,  type: string = "input",  name: string = "input",): Promise<string> {  const { [name]: value } = await inquirer.prompt([{ type, name, message }]);  return value;}async function getContract(account: any): Promise<TokenContract> {  return new Contract(account, contractId, {    viewMethods: ["ft_balance_of", "storage_balance_of"],    changeMethods: ["ft_transfer", "storage_deposit"],  }) as TokenContract;}async function readJsonFile(  filePath: string,): Promise<{ [walletId: string]: number }> {  try {    const data = await fs.readFile(filePath, "utf-8");    return JSON.parse(data);  } catch (error) {    console.error("Error reading JSON file:", error);    throw error;  }}

async function writeJsonFile(filePath: string, data: object): Promise<void> {  try {    await fs.writeFile(filePath, JSON.stringify(data, null, 2));  } catch (error) {    console.error("Error writing JSON file:", error);    throw error;  }}async function appendToFile(filePath: string, content: string): Promise<void> {  try {    await fs.appendFile(filePath, content);  } catch (error) {    console.error("Error appending to file:", error);    throw error;  }}async function moveFile(source: string, destination: string): Promise<void> {  try {    await fs.rename(source, destination);  } catch (error) {    console.error("Error moving file:", error);    throw error;  }}// =================

            async function processTransfers(              account: any,              contract: TokenContract,              listName: string,              amount: BN,            ): Promise<void> {              const listFilePath = path.join(__dirname, "..", "data", `${listName}.json`);              const list: List = await readJsonFile(listFilePath);              const signerPubKey = await account.connection.signer.getPublicKey(                account.accountId,                CONFIG.networkId,              );              const accessKey: any = await account.connection.provider.query(                `access_key/${account.accountId}/${signerPubKey}`,                "",              );              let nonce = accessKey.nonce + 1;              for (const [walletId, balance] of Object.entries(list)) {                try {                  const transferAmount = new BN(balance).mul(amount);                  // Check if the account exists                  try {                    await account.connection.provider.query(`account/${walletId}`, "");                  } catch (error) {                    console.log("Invalid account Id:", walletId);                    await appendToFile(                      path.join(__dirname, "..", "error", `${listName}.txt`),                      `${walletId}:${transferAmount.toString()}`,                    );ß                    delete list[walletId];                    await writeJsonFile(listFilePath, list);                    continue;}

                    console.log("Valid account Id:", walletId);                    console.log("Checking Storage Balance...");                    const storageBalance = await contract.storage_balance_of({                      account_id: walletId,                    });                    const actions = [];                    if (!storageBalance) {                      console.log("Registering Storage", walletId);                      actions.push(                        transactions.functionCall(                          "storage_deposit",                          { account_id: walletId, registration_only: true },                          new BN("30000000000000"),                          new BN(utils.format.parseNearAmount("0.00125")!),                        ),                      );                    }                    actions.push(                      transactions.functionCall(                        "ft_transfer",                        { receiver_id: walletId, amount: transferAmount.toString() },                        new BN("30000000000000"),                        new BN("1"),                      ),                    );                    const recentBlockHash = utils.serialize.base_decode(accessKey.block_hash);                    const transaction = transactions.createTransaction(                      account.accountId,                      signerPubKey,                      contractId,                      nonce++,                      actions,                      recentBlockHash,                    );

                    console.log("Transferring to", walletId);                    const signedTransaction = await transactions.signTransaction(                      transaction,                      account.connection.signer,                      account.accountId,                      CONFIG.networkId,                    );                    await account.connection.provider.sendTransaction(signedTransaction[1]);                    finishedList[walletId] = list[walletId];                    delete list[walletId];                    await writeJsonFile(listFilePath, list);                  } catch (error) {                    console.error(                      `Error processing transfer to wallet :              ${walletId} with error:`,                      error,                    );                  }                }                if (Object.keys(list).length === 0) {                  const finishedFilePath = path.join(                    __dirname,                    "..",                    "finished",                    `finished_${listName}.json`,                  );                  await writeJsonFile(finishedFilePath, finishedList);                  console.log("✔️✔️✔️✔️✔️✔️✔️✔️✔️ DONE ✔️✔️✔️✔️✔️✔️✔️✔️✔️");                } else {                  console.log(                    "========================== Partially Done ==============================",                  );                  await processTransfers(account, contract, listName, amount);}}

                  async function main() {                    const nearConnection = await connect(CONFIG);                    const accountId = await promptUser(PROMPT_MESSAGES.accountId);                    const account = await nearConnection.account(accountId);                    const contract = await getContract(account);                    const listName = await promptUser(PROMPT_MESSAGES.listName);                    const amount = new BN(await promptUser(PROMPT_MESSAGES.amount));                    const confirmTransfer = await promptUser(                      PROMPT_MESSAGES.confirm(listName),                      "confirm",                    );                    if (!confirmTransfer) {                      console.log("Okay, bye!");                      return;                    }                     await processTransfers(account, contract, listName, amount);                  }                  main().catch((error) => {                    console.error("Error in main:", error);                    process.exit(1);                  });

            const accountData = await nearConnection.connection.provider              .query(`account/${id}`, "")              .catch(async (_accountError) => {                console.log("Invalid account Id:", id);                await fs.appendFile(                  join(__dirname, "..", "error", listName + ".txt"),                  `${id}:${transferAmount.toString()} `,                );                delete list[id];                await fs.writeFile(                  join(__dirname, "..", "data", listName + ".json"),                  JSON.stringify(list),);});              ...