# Pool Delegates can steal all the pool's funds by setting a malicious Withdrawal Manager. Crit/High · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-H03 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description The current [PoolManager](https://github.com/maple-labs/pool-v2-private/blob/6a7ae87df4f27cd924ee24f8d577e00b0b087512/contracts/PoolManager.sol) contract allows the pool manager to change the withdrawalManager contract without any checks using the [setWithdrawalManager()](https://github.com/maple-labs/pool-v2-private/blob/6a7ae87df4f27cd924ee24f8d577e00b0b087512/contracts/PoolManager.sol#L207) function. Since the withdrawal manager is responsible for holding the redeemable tokens and informing the pool which tokens can be redeemed, corrupting this contract gives complete control of the pool's funds to the pool delegate. Exploit scenario ● Pool delegate deposits one token into the Pool to get a single share ● Pool delegate sets a malicious withdrawal manager, allowing them to redeem a single share for the entire pool balance ● Pool delegate redeems their share and receives all the funds in the pool ### Recommendation Remove the setWithdrawalManager() function or pause it by default. ### Status Addressed in the following PR: https://github.com/maple-labs/pool-v2-private/pull/272 --- Related findings: - [Users will steal excess funds from the Vault due to `VaultPoolLib::redeem()` not always decreasing `self.withdrawalPool.raBalance` and `self.withdrawalPool.paBalance`](https://0xsimao.com/findings/cork-protocol-steal-excess-redeem-withdrawal): Cork Protocol - [Malicious users can DOS the protocol by setting downsideProtected to a large value](https://0xsimao.com/findings/autonomint-dos-downside-protected-large): Autonomint - [Tokens with callbacks may allow malicious attackers to steal the protocol](https://0xsimao.com/findings/clip-finance-i-callbacks-malicious-attackers-steal): Clip Finance Strategies - [Halted withdrawals in BatchOut due to setting withdrawTo to address(0) in scheduleWithdrawal()](https://0xsimao.com/findings/clip-finance-i-withdrawals-withdraw-schedule-withdrawal): Clip Finance Strategies