# Maple Cash Strategies audit Three Sigma · Institutional lending · 26th November 2024 A private security review of Maple Finance (institutional lending), conducted with Three Sigma and completed on 26th November 2024. 0xSimao disclosed 15 findings: 1 medium, 1 low and 13 informational. ## What Maple Finance is Maple Finance runs institutional lending pools on Ethereum. Lenders deposit into ERC-4626-style pools, a pool delegate underwrites borrowers and deploys the capital into fixed-term and open-term loans, and first-loss cover staked by the delegate absorbs defaults ahead of lenders. Withdrawals are not a simple redeem: they queue in a withdrawal manager and settle against the liquidity the pool actually holds. ## Scope This Three Sigma review covered the strategy contracts that deploy the pools' unloaned cash into external venues, Aave, Sky's sUSDS and PSM among them, and their withdrawal paths, where the pool's accounting has to stay exact across other protocols' rounding, reverts and approvals. ## Medium severity findings - [Aave and SavingsUsds strategies may revert when trying to withdraw all funds](https://0xsimao.com/findings/maple-finance-iv-aave-revert-trying-withdraw) ## Low severity findings - [MapleSkyStrategy:: _gemForUsds() suffers a rounding error up to approximately 1e12 Usds](https://0xsimao.com/findings/maple-finance-iv-suffers-rounding-approximately-1e12) ## Informational findings - [MapleSkyStrategy does not always cache the psm and misses underscores](https://0xsimao.com/findings/maple-finance-iv-sky-cache-misses-underscores) - [Differences in the strategy implementations that could be fixed](https://0xsimao.com/findings/maple-finance-iv-differences-strategy-implementations-fixed) - [ERC4626::previewRedeem() may revert, which will DoS MaplePool withdrawals](https://0xsimao.com/findings/maple-finance-iv-erc4626-redeem-revert-withdrawals) - [The basic strategy does not have slippage control when withdrawing which may lead to arbitrage](https://0xsimao.com/findings/maple-finance-iv-slippage-control-withdrawing-arbitrage) - [MapleSkyStrategy::assetsUnderManagement() uses maxWithdraw(), which may return 0](https://0xsimao.com/findings/maple-finance-iv-sky-management-withdraw-return) - [MapleSkyStrategy:: setPsm() should set the old Psm's approval to 0](https://0xsimao.com/findings/maple-finance-iv-sky-psm-old-approval) - [tin in the Psm will cause an instant drop in the share price which could be leveraged by Maple Pool users](https://0xsimao.com/findings/maple-finance-iv-instant-drop-share-price) - [There may not be enough gem(Usdc) in the Psm contract, DoSing withdrawals in the Sky Strategy](https://0xsimao.com/findings/maple-finance-iv-gem-usdc-sing-withdrawals) - [Usdc to Usds calculation in the Sky Strategy is slightly different than the Psm Usds Wrapper](https://0xsimao.com/findings/maple-finance-iv-usdc-usds-slightly-wrapper) - [The DaiJoin contract may be caged which will DoS withdrawals forever](https://0xsimao.com/findings/maple-finance-iv-dai-join-caged-withdrawals) - [Withdrawals in the Maple Pool and Sky Strategy may be DoSed in case the DssLitePsm halts buying](https://0xsimao.com/findings/maple-finance-iv-withdrawals-dss-lite-halts) - [Aave RewardsController can add Usdc to the rewards list and the strategy has no way to collect the rewards](https://0xsimao.com/findings/maple-finance-iv-aave-rewards-usdc-way) - [Inactive or Impaired pool creates arbitrage oportunities](https://0xsimao.com/findings/maple-finance-iv-inactive-impaired-creates-oportunities) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-11-26-maple-finance-iv.pdf)