# Maple Governor Timelock audit Sherlock · Institutional lending · 8th September 2025 A private security review of Maple Finance (institutional lending), conducted with Sherlock and completed on 8th September 2025 over 3 days. 0xSimao disclosed 3 findings: 3 low. ## What Maple Finance is Maple Finance runs institutional lending pools on Ethereum. Lenders deposit into ERC-4626-style pools, a pool delegate underwrites borrowers and deploys the capital into fixed-term and open-term loans, and first-loss cover staked by the delegate absorbs defaults ahead of lenders. Withdrawals are not a simple redeem: they queue in a withdrawal manager and settle against the liquidity the pool actually holds. ## Scope This Sherlock collaborative review covered governance plumbing rather than pool mechanics: the GovernorTimelock added to maple-labs/globals-v2 and its deployment script in maple-core-v2. The timelock schedules governor actions with per-function delays and execution windows, so its correctness decides how fast, and by whom, every other privileged parameter in the system can move. ## Low severity findings - [Delay can not be set to default value once set to a specific per function value](https://0xsimao.com/findings/maple-finance-ii-delay-default-specific-function) - [CEI pattern is not followed in `GovernorTimelock::executeProposals()`](https://0xsimao.com/findings/maple-finance-ii-cei-followed-timelock-proposals) - [`GovernorTimelock::_call()` assembly revert block doesn't have the memory safe attribute](https://0xsimao.com/findings/maple-finance-ii-timelock-assembly-revert-attribute) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-09-08-maple-finance-ii.pdf)