JOJO - Ⅲ

`external` functions can accept `calldata` arguments instead of `memory`, if the arguments are not modified. It allows to avoid copying and save gas.

`liquidationThreshold` is represented as a fixed-point number with the scaling factor `10**18`. It can be declared as a constant to improve the code readability. Same factor is used by `liquidationPriceOff`, `insuranceFeeRate`.

In `_isAllSafe()` the local variable `params` is declared as `memory`. However, only two fields are accessed. The variable can be declared as `storage`.

`JOJOExternal` implements several `view` functions: `isSafe()`, `isAllSafe()`, `getFundingRate()`. They can be moved to `JOJOView` for consistency.

`EIP-2362` standard defines the status codes returned by `valueFor()`. `valueFor()` will return a status code of 404 if the value for an id is not available yet, 400 in case of bad request. `getMarkPrice()` doesn't handle the status codes.

When transferring deflationary ERC20 tokens, the input amount may not be equal to the received amount due to the charged transaction fee. For example, if a user sends 100 deflationary tokens (with a 10% transaction fee), only 90 tokens actually arrived to the contract. However, a failure to discount such fees may allow the same user to withdraw 100 tokens from the contract, which causes the contract to lose 10 tokens in such a transaction. Reference: https://thoreum-finance.medium.com/what-exploit-happened-today-for-gocerberus-and-garuda-also-for-lokum-ybear-piggy-caramelswap-3943ee23a39f ```solidity=72 IERC20(state.secondaryAsset).safeTransferFrom( msg.sender, address(this), secondaryAmount ); ``` - Transferring tokens by `secondaryAmount`. ```solidity=77 state.secondaryCredit[to] += secondaryAmount; ``` - The `secondaryAmount` appears to be used for bookkeeping purposes without compensating the potential transfer fees.

In `Perpetual.balanceOf()` current `fundingRate` is retrieved via `IDealer(owner()).getFundingRate(address(this))` instead of direct state field access. The trades and liquidations are settled using `fundingRate` directly.

`setSecondaryAsset()` allows to set any address as `secondaryAsset`. It can't later be reassigned. `decimals` is not checked, however, expected to be the same as `primaryAsset`. Wrong `secondaryAsset` will break the contract.

"shoule" is supposed to be "should". "happens" is supposed to be "happen". "ALREASY" is supposed to be "ALREADY". "LEASE" is supposed to be "LEAST". "Operatiors" is supposed to be "Operators". "implemnents" is supposed to be "implementation". "newReducedCredkt" is supposed to be "newReducedCredit". "mathcing" is supposed to be "matching". "whold" is supposed to be "whole". And some others.

One or more state variables are used without being initialized in the constructor. ```solidity=15 uint256 public roundId; ``` - `roundId` is never initialized, but used in `EmergencyOracle.setMarkPrice`.