# Attackers can DoS redemptions by cancelling requests just before the batch is processed Low/Info · Sherlock · Institutional lending · 22nd October, 2025 Finding L-2 of the Maple Withdrawal Queue security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2025 - Source: https://github.com/maple-labs/maple-core-v2/blob/main/audits/2025-november/Sherlock-Maple-Finance-WM-Nov-2025.pdf --- ## Summary `SyrupBitcoinRouter::processRedemptions()` reverts if the request owner is null, so any user can frontrun the batch call and delete their request to make it revert. ## Vulnerability Detail 1. User creates a request. 2. User quickly removes the request, frontrunning the `processRedemptions()` call. ## Impact Temporary DoS, but not feasible for an attacker, pure griefing. There may be some economical benefits to stop users withdrawals, but it is theoretical. ## Code Snippet https://github.com/sherlock-audit/2025-10-maple-oct-22nd/pull/11/files#diff-18c2378be607a98c91191fcd085ea891f37c1a8a9210c32f7aa3caa044c30550R119 ## Tool Used Manual Review ## Recommendation Consider skipping the request if it has been removed. --- Related findings: - [BatchOut:withdrawFulfill() can be DoSed by spamming withdrawal requests, leading to OOG reverts](https://0xsimao.com/findings/clip-finance-i-withdraw-spamming-withdrawal-reverts): Clip Finance Strategies