# `SortedLinkedList::getAllValues()` could add a paginated function to prevent DoS Low/Info · Sherlock · Institutional lending · 22nd October, 2025 Finding L-3 of the Maple Withdrawal Queue security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2025 - Source: https://github.com/maple-labs/maple-core-v2/blob/main/audits/2025-november/Sherlock-Maple-Finance-WM-Nov-2025.pdf --- ## Summary `SortedLinkedList::getAllValues()` fetches all values from the list, which may be DoSed, both on chain and through certain rpc providers that may timeout. ## Vulnerability Detail There are onchain gas limits and rpc providers may timeout even if there isn't an offchain limit. ## Impact ## Code Snippet https://github.com/sherlock-audit/2025-10-maple-oct-22nd/pull/26/files#diff-039b765c6733ead864f7a36bdbf1e880064e5d25e276a3b3cde1cb4935dc7e12R101 ## Tool Used Manual Review ## Recommendation Usually a separate paginated function is added as an alternative. --- Related findings: - [.values() may revert when calling getWatchList() due to OOG](https://0xsimao.com/findings/ostium-revert-watch-list-oog): Ostium - [Aave RewardsController can add Usdc to the rewards list and the strategy has no way to collect the rewards](https://0xsimao.com/findings/maple-finance-iv-aave-rewards-usdc-way): Maple Cash Strategies