Skip to content
Request an audit

‹ Findings database

In MapleGlobals, there is no check in the dataHash argument when unscheduling a call.

Low/InfoMaple Finance audit·Three Sigma·Institutional lending·10th April, 20233S-MAPLE-L06

Description

In MapleGlobals.sol, in unscheduleCall(), the CallUnscheduled event is emitting dataHash (the hash of the callData_) which is never checked, and could be different than the one it is unscheduling.

Recommendation

  • emit the dataHash in storage (in the struct) and don't take the callData_ as an argument to the function unscheduleCall() or
  • verify that the dataHash is valid before emitting by comparing it to the one in storage

Status

Addressed in the following PR: https://github.com/maple-labs/globals-v2-private/pull/65

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests