# MapleGlobals, activatePoolManager() has no check that the pool manager is actually a valid pool manager. Medium · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-M05 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description In MapleGlobals, activatePoolManager(), there is no check that the Pool Manager and Pool Delegate are valid, so the governor can mistakenly set malicious addresses as activated. Exploit scenario ● governor was tricked into activating a fake pool manager, which works because it does not validate if the pool delegate of the pool manager is a valid pool delegate nor if the poolManager is a valid poolManager ● a real pool delegate calls acceptPoolDelegate() on a pool manager, but the fakePoolManager frontruns it and calls transferOwnedPoolManager(...) with the toDelegate argument as the pool delegate ● the pool delegate is now the owner of the fake pool in the mapping poolDelegates[delegate_].ownedPoolManager = poolManager_ ● the acceptPoolDelegate transaction to the real pool manager will fail because the pool delegate is already the owner of the fake pool manager (require(poolDelegates[delegate_].ownedPoolManager == address(0), "MG:APM:ALREADY_OWNS"); in activatePoolManager ● the pool delegate does not notice that he is the owner of the fake pool manager instead of the real pool manager and calls deposit cover, which has malicious code, and sends the funds to the attacker ### Recommendation Check the validity of the Pool Delegate and Pool Manager in activatePoolManager(...). ### Status Addressed in the following PR: https://github.com/maple-labs/globals-v2-private/pull/62 --- Related findings: - [Providing liquidity to the AMM does not check the return value of actually provided tokens leading to locked funds.](https://0xsimao.com/findings/cork-protocol-providing-actually-provided-locked): Cork Protocol - [KeyringCoreV2Base::registerKey() could check that validTo is equal to or bigger than block.timestamp](https://0xsimao.com/findings/keyring-ii-register-equal-bigger-timestamp): Keyring Credentials - [Queue MapleWithdrawalManager may revert due to honest removeShares() or manual redeem calls](https://0xsimao.com/findings/maple-finance-ii-queue-withdrawal-shares-redeem): Maple Withdrawal Manager - [Unbounded loops in MapleWithdrawalManager may break in the future if the withdrawal windows are small](https://0xsimao.com/findings/maple-finance-ii-unbounded-loops-withdrawal-windows): Maple Withdrawal Manager