# owner in SyrupRouter also requires transfer permission Low/Info · Three Sigma · Permissionless lending · 21st May 2024 Finding 3S-Sy-N03 of the Maple Syrup Router security review. - Protocol: https://maple.finance/ - Report: /reports/maple-syrup-router - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-05-21-maple-finance-syrup-router.pdf --- ### Description SyrupRouter::_deposit() checks for owner permission to deposit, but due to [transferring](https://github.com/maple-labs/syrup-router/blob/main/contracts/SyrupRouter.sol#L67) the shares later in ERC20Helper::transfer(), it also requires P:transfer permission. ### Recommendation According to the specifications, P:transfer and P:transferFrom should be permissionless, so this is not a problem. However, consider adding a comment in the code. ### Status Acknowledged Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [`SyrupBitcoinRouter::processRedemptions()` could be optimized by batching transfers together](https://0xsimao.com/findings/maple-finance-iii-process-batching-transfers-together): Maple Withdrawal Queue - [`SyrupBitcoinRouter::setAssetController()` could always allow the asset controller to be set to 0](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-asset-controller): Maple Withdrawal Queue - [`SyrupBitcoinRouter::requestRedeem()` could also check if the asset picked to redeem has liquidity](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-redeem-picked): Maple Withdrawal Queue - [Mismatching calldata in _crossTransferWithCalldata(...) and xReceive(...) in ConnextRouter](https://0xsimao.com/findings/fuji-finance-mismatching-calldata-cross-transfer): Fuji Finance