# In MapleGlobals, there is no check in the dataHash argument when unscheduling a call. Low/Info · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-L06 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description In MapleGlobals.sol, in unscheduleCall(), the CallUnscheduled event is emitting dataHash (the hash of the callData_) which is never checked, and could be different than the one it is unscheduling. ### Recommendation ● emit the dataHash in storage (in the struct) and don't take the callData_ as an argument to the function unscheduleCall() or ● verify that the dataHash is valid before emitting by comparing it to the one in storage ### Status Addressed in the following PR: https://github.com/maple-labs/globals-v2-private/pull/65 --- Related findings: - [triggerSendFrom() will send all the ETH in the destination chain where sendFrom() is called to the refundAddress in the LzCallParams argument](https://0xsimao.com/findings/tapioca-dao-eth-refund-params-argument): Tapioca DAO - [_to argument missing 0x0 address check in the ConnextRouter](https://0xsimao.com/findings/fuji-finance-argument-0x0-address-connext): Fuji Finance