Summary

The buyOrder function accepts ETH as payment for the ERC20s. It makes a few checks to ensure that the amount sent is enough to cover the cost and the fees. However, it never addresses that the amount sent could be more than needed. That would leave some additional ETH to sit in the contract. Unfortunately, this ETH can never be claimed as there is no logic in the contract to retrieve it.

Impact

ETH will be stuck in the contract forever

Tools Used

Manual review

Recommendations

Return the remaining ETH back to the buyer in the same function.