ERC20 token stolen from smart contract

Question

I created two tokens on bscscan and also created a smart contract for staking and swapping these tokens but someone called the swapping function and stole tokens from here and transferred to another smart contract. Please help me to find out the issue with my contract.

Swapping Functions:

function swapGNRtoGRO(uint256 gnrQty) public payable
    {
         require(buyOnGRO,"Buy Stopped.");
         require(!isContract(msg.sender),"Can not be contract");  
         uint256 totalGRO=(gnrQty*1e18)/getGROPrice();  
         groToken.transfer(msg.sender , totalGRO);
         gnrToken.transferFrom(msg.sender, address(this), gnrQty);
         emit TokenDistribution(address(this), msg.sender, gnrToken, groToken, gnrQty, totalGRO);                   
     }


    function swapGROtoGNR(uint256 groQty) public payable
    {
         require(sellOnGRO,"Sell Stopped.");
         require(!isContract(msg.sender),"Can not be contract");    
         require(groQty<=MaximumSell,"Invalid Quantity!");     
         uint256 ded=(groQty*groTognrFee)/100;         
         uint256 restToken = groQty-ded;
         uint256 totalGNR = (restToken*getGROPrice())/1e18;
         gnrToken.transfer(msg.sender,totalGNR);
         groToken.transferFrom(msg.sender,address(this),groQty);
         if(ded>0)
         groToken.transfer(marketingAddress, ded);
         emit TokenDistribution(msg.sender, address(this), groToken,  gnrToken, groQty, totalGNR);                  
     }  

Staking Contract Link: https://bscscan.com/address/0x4e695c49c5ec5b364c0eae44625873d445f02946#code

First Token(GRO Token): https://bscscan.com/token/0x9166e837eacc797adb1516348bdb805d658631ec

Second Token(GNR Token): https://bscscan.com/token/0x58ce33a7c4e2d1ef89eaf5cfe13f0de1a0a2cfde

Hacker Smart Contract: 1) https://bscscan.com/address/0x412fcc49114e6d2d5b7b9c14de57e2b1ee2cda0c

2. https://bscscan.com/address/0x1c5ae72d7a5561a55a2aafa3edcd0bc762daa0f5