Skip to content
Request an audit

‹ All findings

In MapleGlobals, there is no check in the dataHash argument when unscheduling a call.

Low/InfoMaple Finance·Three Sigma · Institutional lending · 10th April, 20243S-MAPLE-L06

ReportSource

Description

In MapleGlobals.sol, in unscheduleCall(), the CallUnscheduled event is emitting dataHash (the hash of the callData_) which is never checked, and could be different than the one it is unscheduling.

Recommendation

  • emit the dataHash in storage (in the struct) and don't take the callData_ as an argument to the function unscheduleCall() or
  • verify that the dataHash is valid before emitting by comparing it to the one in storage

Status

Addressed in the following PR: https://github.com/maple-labs/globals-v2-private/pull/65