# Fixed term loans can be deployed with a wrong fee manager and possibly steal all funds. Crit/High · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-H01 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description In MapleLoanInitializer, the address of the fee manager is not whitelisted. Exploit scenario ● Borrower agrees with delegate on the terms and creates a loan with the correct fee manager; ● Attacker sees the transaction and creates a loan with the same arguments, changing only the fee manager address. They can even choose a salt that makes the first bytes of the malicious loan contract equal to the valid loan contract; ● The pool delegate sees the malicious loan address and funds it thinking it is the valid one; ● All funds are sent to the attacker. ### Recommendation Whitelist the Fee Manager by adding an isInstanceOf check in MapleGlobals. ### Status Addressed in the following PR: https://github.com/maple-labs/fixed-term-loan-private/pull/282 --- Related findings: - [Wrong tokensToCheck logic in BaseRouter enables attackers to steal funds](https://0xsimao.com/findings/fuji-finance-logic-enables-attackers-steal): Fuji Finance - [Users will steal excess funds from the Vault due to `VaultPoolLib::redeem()` not always decreasing `self.withdrawalPool.raBalance` and `self.withdrawalPool.paBalance`](https://0xsimao.com/findings/cork-protocol-steal-excess-redeem-withdrawal): Cork Protocol - [The incorrect accounting of protocol fee will cause double charging fee and wrong distribution of earnings for variable users](https://0xsimao.com/findings/saffron-lido-vaults-accounting-fee-double-charging): Saffron Lido Vaults - [Liquidations can be prevented by frontrunning and liquidating 1 debt (or more) due to wrong assumption in POS_MANAGER](https://0xsimao.com/findings/init-capital-ii-liquidations-frontrunning-debt-assumption): INIT Capital