All allowances to DepositStableCoinToDealer and GeneralRepay can be stolen due to unsafe call
DepositStableCoinToDealer.sol and GeneralRepay.sol are helper contracts that allow a user to swap and enter JOJODealer and JUSDBank respectively. The issue is that the call is unsafe allowing the contract to call the token contracts directly and transfer tokens from anyone who has approved the contract.\\n```\\n    IERC20(asset).safeTransferFrom(msg.sender, address(this), amount);\\n    (address approveTarget, address swapTarget, bytes memory data) = abi\\n    .decode(param, (address, address, bytes));\\n    // if usdt\\n    IERC20(asset).approve(approveTarget, 0);\\n    IERC20(asset).approve(approveTarget, amount);\\n    (bool success, ) = swapTarget.call(data);\\n    if (success == false) {\\n        assembly {\\n            let ptr := mload(0x40)\\n            let size := returndatasize()\\n            returndatacopy(ptr, 0, size)\\n            revert(ptr, size)\\n        }\\n    }\\n```\\n\\nWe can see above that the call is totally unprotected allowing a user to make any call to any contract. This can be abused by calling the token contract and using the allowances of others. The attack would go as follows:\\nUser A approves the contract for 100 USDT\\nUser B sees this approval and calls depositStableCoin with the swap target as the USDT contract with themselves as the receiver\\nThis transfers all of user A USDT to them
Only allow users to call certain whitelisted contracts.
All allowances can be stolen
```\\n    IERC20(asset).safeTransferFrom(msg.sender, address(this), amount);\\n    (address approveTarget, address swapTarget, bytes memory data) = abi\\n    .decode(param, (address, address, bytes));\\n    // if usdt\\n    IERC20(asset).approve(approveTarget, 0);\\n    IERC20(asset).approve(approveTarget, amount);\\n    (bool success, ) = swapTarget.call(data);\\n    if (success == false) {\\n        assembly {\\n            let ptr := mload(0x40)\\n            let size := returndatasize()\\n            returndatacopy(ptr, 0, size)\\n            revert(ptr, size)\\n        }\\n    }\\n```\\n