Exploit-able Vendor script ?

//===== rAthena Script ==========================================================
//= Custom Shop
//===== By: =====================================================================
//= Emistry
//===== Current Version: ========================================================
//= 2.0
//===== Compatible With: ========================================================
//= rAthena
//===== Additional Comments: ====================================================
//= 1.0 Initial Script
//= 2.0 Optimized. Cleaned script. Added Currency Trader [Boom]
//===============================================================================
//Shop Currency can be either ItemID or Variable Name, but must write within Quotation Marks ( "" )
//Zeny , #CASHPOINTS , #KAFRAPOINTS , CustomVariable , #CustomVariable


-	shop	cshop1	-1,512:100

prontera,150,165,2	script	Shop	564,{

set .npcname$, "Premium item dealer";
function ShopSettings;
function ValidateCost;
function CurrencyInfo;
function ClearData;
function ValueConvert;
function ErrorNotice;

	// Menu Selection
	select("Upper Headgears","Middle Headgears","Lower Headgears");

	ClearData();
	ShopSettings( @menu );


	npcshopitem "cshop1",512,100;
	npcshopdelitem "cshop1",512;

	for(set .@i,0; .@i < getarraysize( @ItemLists ); set .@i,.@i+1)
		npcshopadditem "cshop1",@ItemLists[.@i],@ItemCost[.@i];

	mes "ok, shop now !";
	mes "^00FF00----------------------------^000000";
	CurrencyInfo( @Currency$ );
	mes "^00FF00----------------------------^000000";
	close2;
	npcshopattach "cshop1";
	callshop "cshop1",1;
	end;

	function	ShopSettings
	{
			switch( getarg(0) ){

				case 1:
					// Currency [ Item ID / Variable Name ]
					set @Currency$,"674";
					// Item ID Lists
					setarray @ItemLists[0],5105,5106,5407,5406,5011;
					// Item Price
					setarray @ItemCost[0],100,100,100,100,100;
					break;
					end;
				case 2:
					// Currency [ Item ID / Variable Name ]
					set @Currency$,"674";
					// Item ID Lists
					setarray @ItemLists[0],5788,5794,5786,5389;
					// Item Price
					setarray @ItemCost[0],100,100,100,100;
					break;
					end;
				case 3:
					// Currency [ Item ID / Variable Name ]
					set @Currency$,"674";
					// Item ID Lists
					setarray @ItemLists[0],5521,5054,5110,2240;
					// Item Price
					setarray @ItemCost[0],100,100,100,100;
					break;
					end;

				default:
					ErrorNotice( "Invalid Menu Selection for Menu "+@menu+"." );
					close;
			}

		if( @Currency$ == "" )
			ErrorNotice( "Invalid Currency Setting in Menu "+@menu+" ." );
		if( getarraysize( @ItemCost ) != getarraysize( @ItemLists ) || getarraysize( @ItemLists ) != getarraysize( @ItemCost ) )
			ErrorNotice( "Missing or Extra Value of Item or Cost Settings in Menu "+@menu+" ." );
		return;
	}

	function	ErrorNotice
	{
		mes "^FF0000ERROR^000000 - "+getarg(0);
		mes "^00FF00----------------------------^000000";
		mes "Please inform the ^0000FFGame Masters^000000 immediately !";
		close;
	}

	function	CurrencyInfo
	{
		if( getitemname( atoi( getarg(0) ) ) != "null" ){
			mes "Item Currency : ^FF0000"+getitemname( atoi( getarg(0) ) )+"^000000";
			mes "Available Amount : ^0000FF"+ValueConvert( countitem( atoi( getarg(0) ) ) )+"^000000";
		}else if( getitemname( atoi( getarg(0) ) ) == "null" ){
			mes "Variable Currency : ^FF0000"+getarg(0)+"^000000";
			mes "Available Amount : ^0000FF"+ValueConvert( getd( getarg(0) ) )+"^000000";
		}
	return;
	}

	function	ValidateCost
	{
		if( getitemname( atoi( getarg(0) ) ) != "null" ){
			if( countitem( atoi( getarg(0) ) ) < getarg(1) ) return 1;
		}else{
			if( getd( getarg(0) ) < getarg(1) ) return 1;
		}
	return 0;
	}

	function ClearData
	{
		set @Currency$,"";
		set @TotalCost,0;
		deletearray @bought_nameid[0],getarraysize( @bought_nameid );
		deletearray @bought_quantity[0],getarraysize( @bought_quantity );
		deletearray @ItemLists[0],getarraysize( @ItemLists );
		deletearray @ItemCost[0],getarraysize( @ItemCost );
	return;
	}

	function	ValueConvert
	{
		set .@num, atoi(""+getarg(0));
		if ( .@num == 0 || .@num >= 2147483647 ) return getarg(0);
		set .@l, getstrlen(""+.@num);
		for ( set .@i,0; .@i < .@l; set .@i, .@i + 1 ) {
			set .@num$, .@num % pow(10,.@i+1) / pow(10,.@i) + .@num$;
				if ( (.@i+1) % 3 == 0 && .@i+1 != .@l ) set .@num$, ","+ .@num$;
		}
		return .@num$;
	}

	OnBuyItem:
		ShopSettings( @menu );
		for(set @i,0; @i < getarraysize( @bought_nameid ); set @i,@i+1)
			for(set @j,0; @j < getarraysize( @ItemLists ); set @j,@j+1)
				if( @ItemLists[@j] == @bought_nameid[@i] )
				set @TotalCost,@TotalCost + ( @ItemCost[@j] * @bought_quantity[@i] );
		mes "^FF0000[Cash Shop Cart]^000000";
		mes "Cart Contents:^000000";
		for( set @i,0; @i < getarraysize( @bought_nameid ); set @i,@i+1 )
				mes "^FF0000"+@bought_quantity[@i]+" x ^0000FF"+getitemname( @bought_nameid[@i] )+"^000000";
		mes "";

		if( getitemname( atoi( @Currency$ ) ) != "null" )
			mes "Cost : ^0000FF"+ValueConvert( @TotalCost )+" x "+getitemname( atoi( @Currency$ ) )+"^000000";
		else if( getitemname( atoi( @Currency$ ) ) == "null" ){
			mes "Cost : ^0000FF"+ValueConvert( @TotalCost )+" "+@Currency$+"^000000";
		}

		if( ValidateCost( @Currency$,@TotalCost ) ){
			if( getitemname( atoi( @Currency$ ) ) != "null" )
				mes "[ ^FF0000X^000000 ] Insufficient ^0000FF"+getitemname( atoi( @Currency$ ) )+"^000000";
			else{
				mes "[ ^FF0000X^000000 ] Insufficient ^0000FF"+@Currency$+"^000000";
			}
		}else{
			if( select( "^0000FFPurchase^000000:Cancel" ) == 1 ){
				if( getitemname( atoi( @Currency$ ) ) != "null" )
					delitem atoi( @Currency$ ),@TotalCost;
				else{
					set getd( @Currency$ ),getd( @Currency$ ) - @TotalCost;
				}
				for(set @i,0; @i < getarraysize( @bought_nameid ); set @i,@i+1)
					getitem @bought_nameid[@i],@bought_quantity[@i];
				//message strcharinfo(0),"Received "+getarraysize( @bought_nameid )+" Items.";
				message strcharinfo(0),"[Cash Shop] Transaction completed.";
				mes "thx!";
			}
		}
	ClearData();
	close;
}