# CEI pattern is not followed in `GovernorTimelock::executeProposals()` Low/Info · Sherlock · Institutional lending · 8th September, 2025 Finding L-2 of the Maple Governor Timelock security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-ii-2025 - Source: https://github.com/maple-labs/maple-core-v2/blob/main/audits/2025-sept-governor-timelock/Sherlock-Maple-Finance-timelock-Sept-2025.pdf --- ## Summary `GovernorTimelock::executeProposals()` calls the scheduled proposal target, but only deletes the proposal information after, allowing a malicious executor to reenter and execute the same proposal more than once. ## Vulnerability Detail As shown below, `GovernorTimelock::executeProposals()` doesn't follow the CEI pattern and allows a malicious executor to reenter in case the proposal passes execution to an executor controlled contract. ## Impact Depends on the use case, couldn't identify an attack path that resulted in significant damage. ## Code Snippet https://github.com/sherlock-audit/2025-09-maple-sept-8th/pull/1/files#diff-8976e5067f2102ea34580e0de5ec6762a73d214088306194672c326512646a77R173-R175 ## Tool Used Manual Review ## Recommendation Delete the proposal and then make the call. --- Related findings: - [CEI pattern is not followed on LoopedVault::fulfillWithdraw()](https://0xsimao.com/findings/yieldoor-iii-cei-followed-fulfill-withdraw): Yieldoor LoopedVault Update - [Checks effects interactions pattern is now always followed](https://0xsimao.com/findings/orange-effects-interactions-now-followed): Orange Bridge - [Checks effects interactions pattern is not always followed](https://0xsimao.com/findings/singularity-effects-interactions-pattern-followed): Singularity - [Checks-effects-interations pattern is not always followed, which can be used to drain all tokens](https://0xsimao.com/findings/singularity-effects-interations-followed-drain): Singularity