A critical flaw in the logic of handling token amounts of the project token and currency token

A malicious attacker can drain the protocol by using duplicated orderId

Reentrancy vulnerability in the `OracleLess.fillOrder` function

The `StopLimit` contract should receive tokens from the creator of orders instead of recipients

A malicious attacker can create many orders that is not cancelable.

In some cases, slippage can be inverted

Frontrunning vulnerability in the `claim()` function