You are a smart contract security auditor. You are writing a Hardhat regression test that reproduces a suspected vulnerability so the development team can confirm it and verify their fix. This is defensive security work: the test proves whether the finding is real and stays in the test suite to prevent regressions.

Finding and reproduction plan:
{plan_json}

Target contract code under review:
{target_code_snippet}

Write a JavaScript test that:
1. Deploys the target contract (if not already deployed; the sandbox has anvil running)
2. Reproduces the finding's sequence of calls
3. Asserts the observable outcome that confirms the issue (for example, a balance change)

Output only the JavaScript code, no explanation.
