Skip to content
Request an audit

‹ All findings

Attackers can DoS redemptions by cancelling requests just before the batch is processed

Low/InfoMaple Withdrawal Queue·Sherlock · Institutional lending · 22nd October, 2025L-2

ReportSource

Summary

SyrupBitcoinRouter::processRedemptions() reverts if the request owner is null, so any user can frontrun the batch call and delete their request to make it revert.

Vulnerability Detail

  1. User creates a request.
  2. User quickly removes the request, frontrunning the processRedemptions() call.

Impact

Temporary DoS, but not feasible for an attacker, pure griefing. There may be some economical benefits to stop users withdrawals, but it is theoretical.

Code Snippet

https://github.com/sherlock-audit/2025-10-maple-oct-22nd/pull/11/files#diff-18c2378be607a98c91191fcd085ea891f37c1a8a9210c32f7aa3caa044c30550R119

Tool Used

Manual Review

Recommendation

Consider skipping the request if it has been removed.