JOJO security record

```solidity=10 /// @param primaryAmount is the amount of primary asset you want to withdraw. /// @param secondaryAmount is the amount of secondary asset you want to withdraw. ``` The description of `deposit()` is about `withdraw`. ```solidity=44 /// orderList[0] is taker order and orderList[1:] are taker orders. ``` All but first are maker orders. ```solidity=196 /// safe or being liquidated if return 0. ``` ```solidity=233 If liqPrice<0, it should be considered as absolutely safe or being liquidated. ``` "or" is likely supposed to be "of".

The lower-level call is found in: ```Solidity=46 function execute(address to, bytes calldata data, uint256 value) external onlyOwner { (bool success, ) = to.call{value: value}(data); require(success, "tx failed"); emit ExecuteTransaction(owner, address(this)); } ``` Although only the owner can call the function `execute()` to perform low-level calls, but if the owner account is compromised, the hacker can take advantage of the owner account's privileges in any contract and bring unpredictable damages.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=32 chainlink = _chainlink; ``` ```solidity=28 witnet = _witnet; ``` ```solidity=41 owner = _owner; ``` ```solidity=42 dealer = _dealer; ``` ```solidity=33 dealer = _dealer; ```

`Perpetual._settle()` first makes an external call to `IDealer.realizePnl()` and only after that nullifies `reducedCredit`. This opens a risk of reentrancy if `Position._realizePnl()` will have external calls in the future.