Maple Cash Strategies audit
A private security review of Maple Finance (institutional lending), conducted with Three Sigma and completed on 26th November 2024. 0xSimao disclosed 15 findings: 1 medium, 1 low and 13 informational.
What Maple Finance is
Maple Finance runs institutional lending pools on Ethereum. Lenders deposit into ERC-4626-style pools, a pool delegate underwrites borrowers and deploys the capital into fixed-term and open-term loans, and first-loss cover staked by the delegate absorbs defaults ahead of lenders. Withdrawals are not a simple redeem: they queue in a withdrawal manager and settle against the liquidity the pool actually holds.
Scope
This Three Sigma review covered the strategy contracts that deploy the pools' unloaned cash into external venues, Aave, Sky's sUSDS and PSM among them, and their withdrawal paths, where the pool's accounting has to stay exact across other protocols' rounding, reverts and approvals.
Medium severity findings
Low severity findings
Informational findings
- MapleSkyStrategy does not always cache the psm and misses underscores
- Differences in the strategy implementations that could be fixed
- ERC4626::previewRedeem() may revert, which will DoS MaplePool withdrawals
- The basic strategy does not have slippage control when withdrawing which may lead to arbitrage
- MapleSkyStrategy::assetsUnderManagement() uses maxWithdraw(), which may return 0
- MapleSkyStrategy:: setPsm() should set the old Psm's approval to 0
- tin in the Psm will cause an instant drop in the share price which could be leveraged by Maple Pool users
- There may not be enough gem(Usdc) in the Psm contract, DoSing withdrawals in the Sky Strategy
- Usdc to Usds calculation in the Sky Strategy is slightly different than the Psm Usds Wrapper
- The DaiJoin contract may be caged which will DoS withdrawals forever
- Withdrawals in the Maple Pool and Sky Strategy may be DoSed in case the DssLitePsm halts buying
- Aave RewardsController can add Usdc to the rewards list and the strategy has no way to collect the rewards
- Inactive or Impaired pool creates arbitrage oportunities
The report