<!-- canonical: https://0xsimao.com/findings/maple-finance-ii-delay-default-specific-function -->

# Delay can not be set to default value once set to a specific per function value

Low/Info · Sherlock · Institutional lending · 8th September, 2025

Finding L-1 of the Maple Governor Timelock security review.

- Protocol: https://maple.finance/
- Report: /reports/maple-finance-ii-2025
- Source: https://github.com/maple-labs/maple-core-v2/blob/main/audits/2025-sept-governor-timelock/Sherlock-Maple-Finance-timelock-Sept-2025.pdf

---

## Summary

The desired feature as per the [docs](https://github.com/maple-labs/maple-core-v2-private/wiki/Tech-Design-%E2%80%90-Governor-Timelock#setters) of setting the timelock to 0 to signal the use of the default timelock is not possible once set to per function:
> Contract will allow setting timelock to 0 for specific function selector which means that contract will fallback to using default timelock config in future for that function

## Vulnerability Detail

The setter for the function specific timelock is:
```solidity
function setFunctionTimelockParameters(
    address target_,
    bytes4  functionSelector_,
    uint32  delay_,
    uint32  executionWindow_
)
    external override onlySelf
{
    require(delay_           >= MIN_DELAY,            "GT:SFTP:INVALID_DELAY");
    require(executionWindow_ >= MIN_EXECUTION_WINDOW, "GT:SFTP:INVALID_EXEC_WINDOW");

    functionTimelockParameters[target_][functionSelector_] = TimelockParameters({ delay: delay_, executionWindow: executionWindow_ });

    emit FunctionTimelockSet(target_, functionSelector_, delay_, executionWindow_);
}
```

As can be seen, delay has always to be >= `MIN_DELAY`, making it impossible to set it to 0 again and allow the usage of the default timelock.

## Impact

Timelock of a function can't be set back to the default value.

## Code Snippet

https://github.com/sherlock-audit/2025-09-maple-sept-8th/pull/1/files#diff-8976e5067f2102ea34580e0de5ec6762a73d214088306194672c326512646a77R118

## Tool Used

Manual Review

## Recommendation

Allow setting the delay to 0.

---

Related findings:

- [_setDefaultRoyalty() in the constructor is overriding the BasicRoyalties constructor](https://0xsimao.com/findings/metazero-i-default-royalty-overriding-royalties): MetaZero Omnichain NFTs