ERC20 代币从智能合约中被盗

Question

我在 bscscan 上创建了两个代币，还创建了一个用于抵押和交换这些代币的智能合约，但有人调用了交换功能并从这里窃取了代币并转移到另一个智能合约。请帮我找出合同的问题。

交换功能：

function swapGNRtoGRO(uint256 gnrQty) public payable
    {
         require(buyOnGRO,"Buy Stopped.");
         require(!isContract(msg.sender),"Can not be contract");  
         uint256 totalGRO=(gnrQty*1e18)/getGROPrice();  
         groToken.transfer(msg.sender , totalGRO);
         gnrToken.transferFrom(msg.sender, address(this), gnrQty);
         emit TokenDistribution(address(this), msg.sender, gnrToken, groToken, gnrQty, totalGRO);                   
     }


    function swapGROtoGNR(uint256 groQty) public payable
    {
         require(sellOnGRO,"Sell Stopped.");
         require(!isContract(msg.sender),"Can not be contract");    
         require(groQty<=MaximumSell,"Invalid Quantity!");     
         uint256 ded=(groQty*groTognrFee)/100;         
         uint256 restToken = groQty-ded;
         uint256 totalGNR = (restToken*getGROPrice())/1e18;
         gnrToken.transfer(msg.sender,totalGNR);
         groToken.transferFrom(msg.sender,address(this),groQty);
         if(ded>0)
         groToken.transfer(marketingAddress, ded);
         emit TokenDistribution(msg.sender, address(this), groToken,  gnrToken, groQty, totalGNR);                  
     }  

质押合约链接：https://bscscan.com/address/0x4e695c49c5ec5b364c0eae44625873d445f02946#code

第一个令牌（GRO令牌）：https://bscscan.com/token/0x9166e837eacc797adb1516348bdb805d658631ec

第二代币（GNR代币）：https://bscscan.com/token/0x58ce33a7c4e2d1ef89eaf5cfe13f0de1a0a2cfde

黑客智能合约：1) https://bscscan.com/address/0x412fcc49114e6d2d5b7b9c14de57e2b1ee2cda0c

2. https://bscscan.com/address/0x1c5ae72d7a5561a55a2aafa3edcd0bc762daa0f5