All funds can be stolen from JOJODealer
`Funding._withdraw()` makes arbitrary call with user specified params. User can for example make ERC20 to himself and steal funds.\\nUser can specify parameters `param` and `to` when withdraws:\\n```\\n    function executeWithdraw(address from, address to, bool isInternal, bytes memory param) external nonReentrant {\\n        Funding.executeWithdraw(state, from, to, isInternal, param);\\n    }\\n```\\n\\nIn the end of `_withdraw()` function address `to` is called with that bytes param:\\n```\\n    function _withdraw(\\n        Types.State storage state,\\n        address spender,\\n        address from,\\n        address to,\\n        uint256 primaryAmount,\\n        uint256 secondaryAmount,\\n        bool isInternal,\\n        bytes memory param\\n    )\\n        private\\n    {\\n        // rest of code\\n\\n        if (param.length != 0) {\\n          require(Address.isContract(to), "target is not a contract");\\n            (bool success,) = to.call(param);\\n            if (success == false) {\\n                assembly {\\n                    let ptr := mload(0x40)\\n                    let size := returndatasize()\\n                    returndatacopy(ptr, 0, size)\\n                    revert(ptr, size)\\n                }\\n            }\\n        }\\n    }\\n```\\n\\nAs an attack vector attacker can execute withdrawal of 1 wei to USDC contract and pass calldata to transfer arbitrary USDC amount to himself via USDC contract.
Don't make arbitrary call with user specified params
All funds can be stolen from JOJODealer
```\\n    function executeWithdraw(address from, address to, bool isInternal, bytes memory param) external nonReentrant {\\n        Funding.executeWithdraw(state, from, to, isInternal, param);\\n    }\\n```\\n