Refund of protocol fee is being to wrong user
There is one function, _fillQuote(), which is handling swap from `0x`. Ideally If there is any remaining protocol fee (in ETH) then it will be returned to sender aka msg.sender. There are scenarios when fee can be sent to receiver of swap instead.\\nPeriphery and RollerPeriphery both are using almost identical logic in `_fillQuote()` hence this vulnerability affect both contracts. It exist if qupte.buyToken is ETH and there is any remaining protocol fee.\\nHere are pieces of puzzle\\nAfter swap if buyToken == ETH then store contract ETH balance in `boughtAmount`\\n```\\n// RollerPeriphery.sol\\n  boughtAmount = address(quote.buyToken) == ETH ? address(this).balance : quote.buyToken.balanceOf(address(this));\\n```\\n\\nNext it store refundAmt\\n```\\n// RollerPeriphery.sol\\n       // Refund any unspent protocol fees (paid in ether) to the sender.\\n       uint256 refundAmt = address(this).balance;\\n```\\n\\nCalculate actual refundAmt and transfer to sender\\n```\\n       if (address(quote.buyToken) == ETH) refundAmt = refundAmt - boughtAmount;\\n       payable(msg.sender).transfer(refundAmt);\\n```\\n\\nThis is clear that due to line 251, 258 and 259, refundAmt is 0. So sender is not getting refund.\\nLater on in logic flow buyToken will be transferred to receiver\\n```\\n       address(quote.buyToken) == ETH\\n               ? payable(receiver).transfer(amtOut)\\n               : ERC20(address(quote.buyToken)).safeTransfer(receiver, amtOut); // transfer bought tokens to receiver\\n```\\n
Consider intercepting refund amount properly when buyToken is ETH or else just handle refund when buyToken is NOT ETH and write some explanation around it.
Sender is not getting protocol fee refund.
```\\n// RollerPeriphery.sol\\n  boughtAmount = address(quote.buyToken) == ETH ? address(this).balance : quote.buyToken.balanceOf(address(this));\\n```\\n