# MapleSkyStrategy::assetsUnderManagement() uses maxWithdraw(), which may return 0 Low/Info · Three Sigma · Institutional lending · 26th November, 2024 Finding 3S-Maple-N05 of the Maple Cash Strategies security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-iv - Source: https://cdn.sanity.io/files/qoqld077/staging/a68d604be9eca467b1f656c2ca775e1cebc2a468.pdf --- ### Description MapleSkyStrategy::assetsUnderManagement() uses maxWithdraw(), which according to EIP4626 returns 0 when the withdrawal limit is reached or similar. The SavingsUsds contract is upgradeable, so even if it currently returns the correct value, it may be upgraded in the future, adding a withdrawal limit. This would bring concerns in regards to silently reporting 0 assets. ### Recommendation Although not a problem right now, consider calling balanceOf() followed by previewRedeem(). ### Status Addressed in [#c540e86](https://github.com/maple-labs/maple-strategies/pull/36/commits/c540e86f2b68416b47c7337995a46f8a491aba2c). --- Related findings: - [YieldVault maxRedeem(...) unnecessarily converts shares to assets and back to shares again](https://0xsimao.com/findings/fuji-finance-yield-redeem-converts-shares): Fuji Finance - [All assets of (m)TapiocaOFT can be stealed by depositing to strategy cross chain call with 1 amount but maximum shares possible](https://0xsimao.com/findings/tapioca-dao-tapioca-stealed-maximum-shares): Tapioca DAO - [Curve multi exchange can be used to withdraw assets without paying fees](https://0xsimao.com/findings/singularity-curve-withdraw-paying-fees): Singularity - [ERC4626YieldBackend.withdrawSurplus() uses convertToAssets() which doesn't account for fees](https://0xsimao.com/findings/superfluid-erc4626-yield-withdraw-fees): Superfluid Yield Backends