# tin in the Psm will cause an instant drop in the share price which could be leveraged by Maple Pool users Low/Info · Three Sigma · Institutional lending · 26th November, 2024 Finding 3S-Maple-N07 of the Maple Cash Strategies security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iv - Source: https://cdn.sanity.io/files/qoqld077/staging/a68d604be9eca467b1f656c2ca775e1cebc2a468.pdf --- ### Description Currently tin is null in the Psm, but if it was non null, it would instantly lead to a reduction in the totalAssets() in the Maple Pool, as a fee would be taken when converting fundsAssets to Usds in the Sky Strategy, when requesting funds. This would allow Maple Pool users to frontrun the MapleSkyStrategy::fundStrategy() and withdraw, avoiding the fee, making unaware users pay for this. Then, they could redeposit to keep earning fees. The damage is limited by the withdrawal mechanism. ### Recommendation Consider procedures to safely request funds without allowing users to escape the fee. ### Status Acknowledged --- Related findings: - [Malicious users could lock in the NAV/Share of the DV to cause the loss of fees](https://0xsimao.com/findings/tokemak-lock-nav-share-fees): Tokemak - [MapleGlobals, activatePoolManager() has no check that the pool manager is actually a valid pool manager.](https://0xsimao.com/findings/maple-finance-iii-globals-activate-actually-valid): Maple Finance - [Partially removing liquidity may underflow if the price of the pool has changed significantly](https://0xsimao.com/findings/nftperp-i-partially-underflow-price-significantly): Nftperp Exchange - [Uniswap v4 pool initialization can be frontrunned, setting an arbitrary price, and stealing tokens](https://0xsimao.com/findings/spirit-protocol-uniswap-initialization-frontrunned-price): Spirit Protocol