Skip to content
Request an audit

‹ Findings database

In PoolManager, setOpenToPublic(), there is no way to unset openToPublic.

Low/InfoMaple Finance audit·Three Sigma·Institutional lending·10th April, 20233S-MAPLE-L08

Description

The setOpenToPublic(...) function only enables setting openToPublic to true, so if a delegate sets a permissioned pool to open by mistake, it's impossible to undo it.

Recommendation

Add setOpenToPublic as an argument.

Status

Acknowledged by the team.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests