# `SyrupBitcoinRouter::setAssetController()` could always allow the asset controller to be set to 0 Low/Info · Sherlock · Institutional lending · 22nd October, 2025 Finding L-1 of the Maple Withdrawal Queue security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2025 - Source: https://github.com/maple-labs/maple-core-v2/blob/main/audits/2025-november/Sherlock-Maple-Finance-WM-Nov-2025.pdf --- ## Summary `SyrupBitcoinRouter::setAssetController()` currently requires the asset being a COMPOSITE_DEPOSIT_ASSET, even if disabling the asset controller. ## Vulnerability Detail Other similar functions in the protocol allow setting a setting to 0, even if not whitelisted, so the same could apply in this situation. Since the function call is permissioned, it could make it smoother to just allow the asset controller to be set to address(0) regardless of the COMPOSITE_DEPOSIT_ASSET flag. ## Impact Slightly more mistake prone, but it's still possible to first set the asset controller to 0 and then unwhitelist COMPOSITE_DEPOSIT_ASSET from Globals. ## Code Snippet https://github.com/sherlock-audit/2025-10-maple-oct-22nd/pull/11/files#diff-18c2378be607a98c91191fcd085ea891f37c1a8a9210c32f7aa3caa044c30550R191 ## Tool Used Manual Review ## Recommendation Consider always allowing setting to address(0). --- Related findings: - [Deadline parameter in SyrupUserActions::_swapViaBalancer() could be set to minimize MEV](https://0xsimao.com/findings/maple-finance-syrup-balancer-swap-deadline): Maple Syrup - [Allow lenders to set a minimum amount of asset they would take for their shares](https://0xsimao.com/findings/maple-finance-ii-lenders-minimum-they-shares): Maple Withdrawal Manager - [Metadata is not set in Cap, which is required by the inherited Router to specify gas limit to the mailbox](https://0xsimao.com/findings/mitosis-metadata-inherited-gas-mailbox): Mitosis