Skip to content
Request an audit

‹ Findings database

Factory update for maple loans can be performed with the old factory

Low/InfoMaple Withdrawal Manager audit·Three Sigma·Institutional lending·16th November, 20233S-MAPLE-L03

Description

In the MapleLoanV502Migrator, the only check is that the factory address is a valid instance.

Thus, it's possible for a loan with the old factory to be updated and use the same old factory.

Recommendation

Prevent stale updates or hardcode the new factory address (via immutable variable in the constructor).

Status

Addressed in #72bc617