Maple Withdrawal Manager audit
A private security review of Maple Finance (institutional lending), conducted with Three Sigma and completed on 16th November 2023 over 12 days. 0xSimao disclosed 7 findings: 3 low and 4 informational.
What Maple Finance is
Maple Finance runs institutional lending pools on Ethereum. Lenders deposit into ERC-4626-style pools, a pool delegate underwrites borrowers and deploys the capital into fixed-term and open-term loans, and first-loss cover staked by the delegate absorbs defaults ahead of lenders. Withdrawals are not a simple redeem: they queue in a withdrawal manager and settle against the liquidity the pool actually holds.
Scope
The Q4 2023 update reviewed by Three Sigma introduced the queue-based withdrawal manager alongside changes to the fixed-term loan factory: redemption requests joining a FIFO queue that the pool delegate processes against available liquidity, replacing the older cyclical withdrawal windows.
Low severity findings
- Queue MapleWithdrawalManager may revert due to honest removeShares() or manual redeem calls
- Unbounded loops in MapleWithdrawalManager may break in the future if the withdrawal windows are small
- Factory update for maple loans can be performed with the old factory
Informational findings
- Allow lenders to set a minimum amount of asset they would take for their shares
- Gas savings
- Operational Admin Suggestions
- Documentation inconsistencies
The report