# Maple Withdrawal Queue audit Sherlock · Institutional lending · 22nd October 2025 A private security review of Maple Finance (institutional lending), conducted with Sherlock and completed on 22nd October 2025 over 8 days. 0xSimao disclosed 5 findings: 3 low and 2 informational. ## What Maple Finance is Maple Finance runs institutional lending pools on Ethereum. Lenders deposit into ERC-4626-style pools, a pool delegate underwrites borrowers and deploys the capital into fixed-term and open-term loans, and first-loss cover staked by the delegate absorbs defaults ahead of lenders. Withdrawals are not a simple redeem: they queue in a withdrawal manager and settle against the liquidity the pool actually holds. ## Scope This review covered the queue-based MapleWithdrawalManager in maple-labs/withdrawal-manager-queue: the component that turns redemption requests into a FIFO queue, processes them in batches against available liquidity, and backs Maple's Bitcoin-yield product flows (syrupBTC) where an asset controller redeems on users' behalf. ## Low severity findings - [`SyrupBitcoinRouter::setAssetController()` could always allow the asset controller to be set to 0](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-asset-controller) - [Attackers can DoS redemptions by cancelling requests just before the batch is processed](https://0xsimao.com/findings/maple-finance-iii-redemptions-cancelling-requests-processed) - [`SortedLinkedList::getAllValues()` could add a paginated function to prevent DoS](https://0xsimao.com/findings/maple-finance-iii-sorted-linked-list-paginated) ## Informational findings - [`SyrupBitcoinRouter::processRedemptions()` could be optimized by batching transfers together](https://0xsimao.com/findings/maple-finance-iii-process-batching-transfers-together) - [`SyrupBitcoinRouter::requestRedeem()` could also check if the asset picked to redeem has liquidity](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-redeem-picked) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-10-22-maple-finance-iii.pdf)