# A pool delegate should not be allowed to be a borrower Medium · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-M03 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description A Pool Delegate should not be allowed to be a borrower otherwise they can leave with the funds at any time with no questions asked. We believe this is not the intended behavior, but currently the code allows it to happen (which means it could happen by mistake, for example by copy pasting the wrong address). ### Recommendation Suggestions to mitigate this issue (to implement in maple globals): ● In setValidBorrower, check if the address is a pool delegate. ● In setValidPoolDelegate, check if the address is a borrower. ### Status Acknowledged by the team. --- Related findings: - [Borrower deposit, withdraw, deposit will reinit `omniChainData.cdsPoolValue`, getting profit stuck for cds depositors](https://0xsimao.com/findings/autonomint-deposit-withdraw-reinit-stuck): Autonomint