Skip to content
Request an audit

‹ All findings

Fixed term loans can be deployed with a wrong fee manager and possibly steal all funds.

Crit/HighMaple Finance·Three Sigma · Institutional lending · 10th April, 20243S-MAPLE-H01

ReportSource

Description

In MapleLoanInitializer, the address of the fee manager is not whitelisted. Exploit scenario

  • Borrower agrees with delegate on the terms and creates a loan with the correct fee manager;
  • Attacker sees the transaction and creates a loan with the same arguments, changing only the fee manager address. They can even choose a salt that makes the first bytes of the malicious loan contract equal to the valid loan contract;
  • The pool delegate sees the malicious loan address and funds it thinking it is the valid one;
  • All funds are sent to the attacker.

Recommendation

Whitelist the Fee Manager by adding an isInstanceOf check in MapleGlobals.

Status

Addressed in the following PR: https://github.com/maple-labs/fixed-term-loan-private/pull/282