# In PoolManager, setOpenToPublic(), there is no way to unset openToPublic. Low/Info · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-L08 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description The setOpenToPublic(...) function only enables setting openToPublic to true, so if a delegate sets a permissioned pool to open by mistake, it's impossible to undo it. ### Recommendation Add setOpenToPublic as an argument. ### Status Acknowledged by the team. --- Related findings: - [CurveAssetManagerHelper::_validateAssets() should check that the number of assets provided is smaller than the maximum of the pool](https://0xsimao.com/findings/singularity-curve-helper-validate-provided): Singularity - [DarkPoolAssetManager can be drained by looping over join(), joinSplit() or swap() with only some initial amount](https://0xsimao.com/findings/singularity-dark-looping-join-split): Singularity