# fundLoan() can be DoSed if returnFunds() is called before it. Medium · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-M02 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description It's possible to stop loans from being funded by calling returnFunds(). Exploit scenario ● attacker sees fundLoan(...) transaction and calls returnFunds(...) with an arbitrary amount ● returnFunds(...) increases [_drawableFunds](https://github.com/maple-labs/fixed-term-loan-private/blob/670e9fe6dea857c8a0b203893fb32b66018f87d8/contracts/MapleLoan.sol#L237) ● fundLoan(...) overrides _drawableFunds, which means that the amount sent earlier will be unaccounted ● the [require](https://github.com/maple-labs/fixed-term-loan-private/blob/670e9fe6dea857c8a0b203893fb32b66018f87d8/contracts/MapleLoan.sol#L355) that there are 0 unaccounted funds fails and the transaction reverts The lenders have incentive to do this if they want to withdraw and a loan would remove liquidity, see [getRedeemableAmounts(...)](https://github.com/maple-labs/withdrawal-manager-private/blob/25d9ff308626d00831cd15e1829e4c2ea9365a0d/contracts/WithdrawalManager.sol#L337). ### Recommendation In fundLoan(...), increase _drawableFunds instead of setting it. ### Status [Addressed in](https://github.com/maple-labs/three-sigma-audit-2023-04-10/issues/29) the following PR: https://github.com/maple-labs/fixed-term-loan-private/pull/285 --- Related findings: - [`Codeup::claimCodeupERC20()` may be forever DoSed by creating the `Uniswap` pool before it is called](https://0xsimao.com/findings/codeup-erc20-forever-creating-uniswap): CODEUP - [Providing liquidity to the AMM does not check the return value of actually provided tokens leading to locked funds.](https://0xsimao.com/findings/cork-protocol-providing-actually-provided-locked): Cork Protocol