Maple Withdrawal Queue audit
A private security review of Maple Finance (institutional lending), conducted with Sherlock and completed on 22nd October 2025 over 8 days. 0xSimao disclosed 5 findings: 3 low and 2 informational.
What Maple Finance is
Maple Finance runs institutional lending pools on Ethereum. Lenders deposit into ERC-4626-style pools, a pool delegate underwrites borrowers and deploys the capital into fixed-term and open-term loans, and first-loss cover staked by the delegate absorbs defaults ahead of lenders. Withdrawals are not a simple redeem: they queue in a withdrawal manager and settle against the liquidity the pool actually holds.
Scope
This review covered the queue-based MapleWithdrawalManager in maple-labs/withdrawal-manager-queue: the component that turns redemption requests into a FIFO queue, processes them in batches against available liquidity, and backs Maple's Bitcoin-yield product flows (syrupBTC) where an asset controller redeems on users' behalf.
Low severity findings
SyrupBitcoinRouter::setAssetController()could always allow the asset controller to be set to 0- Attackers can DoS redemptions by cancelling requests just before the batch is processed
SortedLinkedList::getAllValues()could add a paginated function to prevent DoS
Informational findings
SyrupBitcoinRouter::processRedemptions()could be optimized by batching transfers togetherSyrupBitcoinRouter::requestRedeem()could also check if the asset picked to redeem has liquidity
The report