# MerkleRoot is not validated in all StakingAssetManager functions Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-C02 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description All functions that require a merkle root to verify note inclusion must validate that the merkle root is valid. Otherwise, attackers can forge a merkle root that includes a fake note and steal all assets. ### Recommendation Validate that the provided Merkle Root is valid. ### Status Addressed in [#5520165](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/5520165a664c3ae222d9f4a697db6c379cf4240c). --- Related findings: - [LoanManager code optimizations: redundant impairment functions.](https://0xsimao.com/findings/maple-finance-iii-optimizations-redundant-impairment-functions): Maple Finance