Limiting the Price in the buy and onTokenTransfer Functions
When an investor tries to `buy` the tokens in the `Crowdinvesting` contract, the `buy` function does not allow to limit the amount of tokens that can be spent during this particular transaction:\\n```\\nfunction buy(uint256 \\_amount, address \\_tokenReceiver) public whenNotPaused nonReentrant {\\n // rounding up to the next whole number. Investor is charged up to one currency bit more in case of a fractional currency bit.\\n uint256 currencyAmount = Math.ceilDiv(\\_amount \\* getPrice(), 10 \\*\\* token.decimals());\\n```\\n\\nThe owner of the price oracle can front-run the transaction and twist the price.\\nOf course, the buyer can try to regulate that limit with the token allowance, but there may be some exceptions. Sometimes, users want to give more allowance and buy in multiple transactions over time. Or even give an infinite allowance (not recommended) out of convenience.\\nThe same issue can be found in the `onTokenTransfer` function. This function works differently because the amount of currency is fixed, and the amount of tokens minted is undefined. Because of that, limiting the allowance won't help, so the user doesn't know how many tokens can be bought.
It's recommended to explicitly limit the amount of tokens that can be transferred from the buyer for the `buy` function. And allow users to define a minimal amount of tokens bought in the `onTokenTransfer` function.
```\\nfunction buy(uint256 \\_amount, address \\_tokenReceiver) public whenNotPaused nonReentrant {\\n // rounding up to the next whole number. Investor is charged up to one currency bit more in case of a fractional currency bit.\\n uint256 currencyAmount = Math.ceilDiv(\\_amount \\* getPrice(), 10 \\*\\* token.decimals());\\n```\\n