# Throughout code-base: missing address checks. Low/Info · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-L09 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description Whenever addresses change in the code, it's important to be careful about the possibility of setting the wrong address. The following occurrences could be dangerous in this regard ```solidity ● MapleProxyFactory, setGlobals(...) ● MapleGlobals, setMapleTreasury(...) ``` ● Fixed-term-loan-private, the [constructor of](https://github.com/maple-labs/fixed-term-loan-private/blob/670e9fe6dea857c8a0b203893fb32b66018f87d8/contracts/MapleLoanFeeManager.sol#L46) MapleLoanFeeManager ### Recommendation Two options were suggested: ● use the setPending-accept pattern ● don't change addresses, given that the contracts are upgradeable ### Status Acknowledged by the team. --- Related findings: - [Throughout code base, implement using SafeERC20 for IERC20 for better readability](https://0xsimao.com/findings/fuji-finance-erc20-ierc20-better-readability): Fuji Finance - [Admin checks in KeyringCoreV2Base could be placed in a modifier to increase readability and reduce code duplication](https://0xsimao.com/findings/keyring-ii-placed-readability-reduce-duplication): Keyring Credentials - [BaseAssetManager missing 0 address checks in the constructor](https://0xsimao.com/findings/singularity-asset-address-checks-constructor): Singularity - [When changing addresses, use 2 step transfer and/or contract size and/or address 0x0 checks](https://0xsimao.com/findings/fuji-finance-changing-addresses-transfer-0x0): Fuji Finance