Skip to content
Request an audit

‹ Findings database

DoS attack if assets are transferred before a fundLoan() call.

MediumMaple Finance audit·Three Sigma·Institutional lending·10th April, 20233S-MAPLE-M06

Description

In fixed term loans, a DoS attack is possible if assets are transferred into the MapleLoan before the loan is funded. Exploit scenario

  • delegate funds loan
  • attacker frontruns delegate and transfers fundsAsset to the MapleLoan
  • funding reverts due to the require that the unaccounted funds are 0

Recommendation

Skim before funding.

Status

Addressed in the following PR: https://github.com/maple-labs/fixed-term-loan-manager-private/pull/34

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests