# Factory update for maple loans can be performed with the old factory Low/Info · Three Sigma · Institutional lending · 16th November, 2023 Finding 3S-MAPLE-L03 of the Maple Withdrawal Manager security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-ii-2023 - Source: https://cdn.sanity.io/files/qoqld077/production/34f2311ad7e8315d043e23054e794c136f19a079.pdf --- ### Description In the [MapleLoanV502Migrator](https://github.com/maple-labs/fixed-term-loan-private/blob/9effdcdc728b2ebcb659bc358fef76f86891b48a/contracts/MapleLoanV502Migrator.sol#L18), the only check is that the factory address is a valid instance. Thus, it's possible for a loan with the old factory to be updated and use the same old factory. ### Recommendation Prevent stale updates or hardcode the new factory address (via immutable variable in the constructor). ### Status Addressed in [#72bc617](https://github.com/maple-labs/fixed-term-loan-private/pull/312/commits/72bc617a30e3154f56c4ac1fb7589debfaefb251) --- Related findings: - [MapleSkyStrategy:: setPsm() should set the old Psm's approval to 0](https://0xsimao.com/findings/maple-finance-iv-sky-psm-old-approval): Maple Cash Strategies - [In MapleLoanFactory, isLoan has the same functionality of isInstance and thus can be removed.](https://0xsimao.com/findings/maple-finance-iii-functionality-instance-thus-removed): Maple Finance