# Attacker may frontrun SyrupRouter::depositWithPermit() call and use a different depositData_ as it is not signed Low/Info · Three Sigma · Permissionless lending · 21st May 2024 Finding 3S-Sy-L01 of the Maple Syrup Router security review. - Protocol: https://maple.finance/ - Report: /reports/maple-syrup-router - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-05-21-maple-finance-syrup-router.pdf --- ### Description [SyrupRouter::depositWithPermit()](https://github.com/maple-labs/syrup-router/blob/main/contracts/SyrupRouter.sol#L39) accepts a permit signature and a depositData_ as extra data to be emitted. An attacker may spot the signature and frontrun the transaction, but with a differerent depositData_, griefing the user. ### Recommendation A simple fix is not possible as the permit function does not accept any extra data. It should be possible to send the transaction through flashbots to mitigate this issue if needed. ### Status Addressed in [#cb70312](https://github.com/maple-labs/syrup-utils/commit/cb70312a1e92dfe2232384e3b642ebebf1914e02) Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [`BoldToken` initialization can be frontrun to silently mint/approve bold to an attacker](https://0xsimao.com/findings/nerite-initialization-frontrun-mint-approve): Nerite - [An attacker can manipulate `omniChainData.cdsPoolValue` by breaking protocol.](https://0xsimao.com/findings/autonomint-manipulate-omni-data-breaking): Autonomint - [In MapleGlobals, there is no check in the dataHash argument when unscheduling a call.](https://0xsimao.com/findings/maple-finance-iii-globals-hash-argument-unscheduling): Maple Finance - [`SyrupBitcoinRouter::processRedemptions()` could be optimized by batching transfers together](https://0xsimao.com/findings/maple-finance-iii-process-batching-transfers-together): Maple Withdrawal Queue