# Pool Delegates can set an unreasonably large delegate management fee rate at anytime Crit/High · Three Sigma · Institutional lending · 10th April, 2024 Finding 3S-MAPLE-M04 of the Maple Finance security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iii-2024 - Source: https://cdn.sanity.io/files/qoqld077/production/36dbe5ca76da3d2392bcee581548067705b8bd36.pdf --- ### Description Using the function setDelegateManagementFeeRate() the pool manager can set an unreasonably large delegateManagementFeeRate (all the way up to 100%) at any time, stopping payments from reaching the pool (i.e. the liquidity providers). Since the loan manager updates the delegateManagementFeeRate every time a payment is made (and a new is added), this change will have an almost immediate impact, and the liquidity providers will have no choice but to accept these new terms. Some of them could try to withdraw their funds, but the majority of them would not be allowed to do so since the loan had already been made and the funds were locked. A pool delegate could therefore start by setting a low management fee to attract LPs to his pool and, after loans had been issued, this fee could be drastically increased without any governor or LPs permission, to the detriment of the LPs. ### Recommendation Allow the governor to limit this value or give the governor permission to accept or reject a change in the delegateManagementFeeRate. Alternatively, delegateManagementFeeRate could be set in deployment and not allowed to change, or at least stay constant on a per loan basis. ### Status Acknowledged by the team. --- Related findings: - [Delegate rewards system is unfair to delegates with less tokens and reduces decentralization](https://0xsimao.com/findings/ajna-protocol-delegate-rewards-system-decentralization): Ajna Protocol - [Performance and management fee updates may technically still apply to already earned interest](https://0xsimao.com/findings/morpho-vault-v2-fee-technically-earned-interest): Morpho Vault V2 - [Setting maxFundingFeePerBlock to a lower value than abs(lastFundingRate) will brick getPendingAccFundingFees()](https://0xsimao.com/findings/ostium-fee-abs-brick-fees): Ostium - [`LenderCommitmentGroup` pools will have incorrect exchange rate when fee-on-transfer tokens are used](https://0xsimao.com/findings/teller-finance-pools-exchange-fee-transfer): Teller Finance