# Pool Delegates can set a really high origination fee and steal all pool funds. Crit/High · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-H02 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description The delegate origination fee can be set to any value at any time and anyone can deploy a loan, so the delegate can receive all the funds of a loan. Exploit scenario ● gather funds to a pool with a regular origination fee ● given enough funds, increase the origination fee to the pool amount minus the platformOriginationFee (which can be close to zero if the delegate creates the loan with 1 payment interval and 1 number of payments) ● create a fake loan ([anyone can deploy a loan](https://github.com/maple-labs/three-sigma-audit-2023-04-10/issues/28)) and fund it ### Recommendation The following mitigation options were proposed: ```solidity ● Redeploy factory and fix anyone can deploy a loan; ● Set an origination fee limit; ● Don't allow changing the origination fee; ● Set a timelock/minimum withdrawal cycles to change the origination fee; ``` ● Require governor approval on fee change. ### Status Addressed in the following PR: https://github.com/maple-labs/fixed-term-loan-private/pull/286 --- Related findings: - [Users will steal excess funds from the Vault due to `VaultPoolLib::redeem()` not always decreasing `self.withdrawalPool.raBalance` and `self.withdrawalPool.paBalance`](https://0xsimao.com/findings/cork-protocol-steal-excess-redeem-withdrawal): Cork Protocol - [Wrong tokensToCheck logic in BaseRouter enables attackers to steal funds](https://0xsimao.com/findings/fuji-finance-logic-enables-attackers-steal): Fuji Finance - [Anyone can steal pool shares from lender group if no-revert-on-failure tokens are used](https://0xsimao.com/findings/teller-finance-steal-shares-revert-failure): Teller Finance - [If xShadow is token0 or token1, ShadowStrategyGauge::collectGaugeRewards() will take protocol fee on user funds](https://0xsimao.com/findings/yieldoor-i-token0-token1-rewards-fee): Yieldoor Gauges