Maple Finance

What it is

Maple Finance runs institutional lending pools: lenders deposit, a pool delegate underwrites and issues loans, and withdrawals are queued against the liquidity that is actually there.

By its own figures it manages $4.23 billion in assets and has issued over 400 loans to more than 100 institutional borrowers, $23.97 billion borrowed in all.

What was reviewed

Seven reviews between November 2023 and October 2025, four with Three Sigma and three with Sherlock, across the fixed-term and open-term loan contracts, the loan managers, the pool and its withdrawal manager, the fee manager, the protocol globals and the Syrup migration and user action utilities.

What was found

70 findings were published across the 7 reviews, 6 of them high severity. Maple fixed 37 of them, including every high severity one.

Featured finding

When a Maple borrower defaults, the pool is meant to seize the collateral backing the loan first, and to draw on the pool delegate’s own staked cover only for whatever the collateral does not repay. The last step of that sequence could be called on its own, skipping the seizure: the collateral stayed with the borrower, the delegate’s cover paid the loss in its place, and the loan was left half closed in the pool’s books, where a later repayment could make other borrowers’ payments revert.

As designedA borrower defaults and the loan is impaired↓triggerDefault() repossesses the collateral↓The collateral is liquidated against the debt↓finishCollateralLiquidation() closes the loan↓The delegate's cover pays only the shortfall

The path the bug allowedA borrower defaults and the loan is impaired↓finishCollateralLiquidation() is called directly, skipping triggerDefault()↓The collateral stays with the borrower↓The delegate's cover pays the whole loss↓The loan is left half closed, and a later repayment can make other borrowers' payments revert

See the whole finding

Engagement history