# Unbounded loops in MapleWithdrawalManager may break in the future if the withdrawal windows are small Low/Info · Three Sigma · Institutional lending · 16th November, 2023 Finding 3S-MAPLE-L02 of the Maple Withdrawal Manager security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-ii-2023 - Source: https://cdn.sanity.io/files/qoqld077/production/34f2311ad7e8315d043e23054e794c136f19a079.pdf --- ### Description Loops revert due to OOG errors if too many iterations are performed. Some functions will stop working if these loops grow too large. For example, [`getConfigAtId(uint256 cycleId_)`](https://github.com/maple-labs/withdrawal-manager-cyclical-private/blob/95212a0adb2853420e60d094c01323274979cb75/contracts/MapleWithdrawalManager.sol#L317) may be called with a cycleId_ well in the past, leading to OOG. The likelihood of this happening depends on the number of times the configs were changed and the cycle durations. Due to this, it might make it impossible to call removeShares(), so the shares would be stuck. ### Recommendation Send hints in these functions (or make them internal and create 2 external functions, one with hints and another the same as the current one). For example, getConfigAtId(uint256 cycleId_) could receive latestConfigIdHint_ as argument. ### Status Acknowledged --- Related findings: - [Pool Delegates can steal all the pool's funds by setting a malicious Withdrawal Manager.](https://0xsimao.com/findings/maple-finance-iii-delegates-steal-setting-withdrawal): Maple Finance - [Missing documentation for MapleLoan, SetPendingLender and AcceptLender being implemented on MapleLoan but not on LoanManager.](https://0xsimao.com/findings/maple-finance-iii-documentation-pending-accept-implemented): Maple Finance - [MapleGlobals, activatePoolManager() has no check that the pool manager is actually a valid pool manager.](https://0xsimao.com/findings/maple-finance-iii-globals-activate-actually-valid): Maple Finance