# `GovernorTimelock::_call()` assembly revert block doesn't have the memory safe attribute Low/Info · Sherlock · Institutional lending · 8th September, 2025 Finding L-3 of the Maple Governor Timelock security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-ii-2025 - Source: https://github.com/maple-labs/maple-core-v2/blob/main/audits/2025-sept-governor-timelock/Sherlock-Maple-Finance-timelock-Sept-2025.pdf --- ## Summary As per the Solidity docs, it's recommended to use memory safe. > While we recommend to always respect Solidity's memory model, inline assembly allows you to use memory in an incompatible way. Therefore, moving stack variables to memory and additional memory optimizations are, by default, globally disabled in the presence of any inline assembly block that contains a memory operation or assigns to Solidity variables in memory. This is also in line with the OZ [implementation](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/Address.sol#L138-L147). ## Vulnerability Detail Essentially certain optimizations are disabled when memory safe is not set in the assembly blocks, which is not recommended. ## Impact Undefined but it's better to follow the recommendations. ## Code Snippet https://github.com/sherlock-audit/2025-09-maple-sept-8th/pull/1/files#diff-8976e5067f2102ea34580e0de5ec6762a73d214088306194672c326512646a77R225 ## Tool Used Manual Review ## Recommendation Add memory safe as per the OZ implementation. --- Related findings: - [Liquidation can be finished without calling triggerDefault() (and repossessing the loan) if pool delegate or governor call finishCollateralLiquidation(...) after impairment.](https://0xsimao.com/findings/maple-finance-iii-liquidation-repossessing-delegate-collateral): Maple Finance - [API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflow](https://0xsimao.com/findings/init-capital-ii-oracle-timestamp-revert-underflow): INIT Capital - [Using transfer() instead of call() may revert](https://0xsimao.com/findings/ostium-transfer-instead-call-revert): Ostium