Maple Governor Timelock audit
A private security review of Maple Finance (institutional lending), conducted with Sherlock and completed on 8th September 2025 over 3 days. 0xSimao disclosed 3 findings: 3 low.
What Maple Finance is
Maple Finance runs institutional lending pools on Ethereum. Lenders deposit into ERC-4626-style pools, a pool delegate underwrites borrowers and deploys the capital into fixed-term and open-term loans, and first-loss cover staked by the delegate absorbs defaults ahead of lenders. Withdrawals are not a simple redeem: they queue in a withdrawal manager and settle against the liquidity the pool actually holds.
Scope
This Sherlock collaborative review covered governance plumbing rather than pool mechanics: the GovernorTimelock added to maple-labs/globals-v2 and its deployment script in maple-core-v2. The timelock schedules governor actions with per-function delays and execution windows, so its correctness decides how fast, and by whom, every other privileged parameter in the system can move.
Low severity findings
- Delay can not be set to default value once set to a specific per function value
- CEI pattern is not followed in
GovernorTimelock::executeProposals() GovernorTimelock::_call()assembly revert block doesn't have the memory safe attribute
The report