# Maple Syrup audit Three Sigma · Permissionless lending · 23rd August 2024 A private security review of Maple Finance Syrup (permissionless lending), conducted with Three Sigma and completed on 23rd August 2024 over 5 days. 0xSimao disclosed 5 findings: 1 low and 4 informational. ## What Syrup is Syrup, built by Maple Labs, opens Maple's institutional lending yield to permissionless deposits: USDC deposited through the Syrup platform mints syrupUSDC, an ERC-4626 share over pools lending to vetted institutional borrowers, with the same fixed-term and open-term loan machinery underneath. ## Scope The Three Sigma engagement covered the migration and user-action layer around the launch: the MPL-to-SYRUP token Migrator, SyrupDrip for token distributions, and SyrupUserActions/MPLUserActions, which bundle deposit, migration, staking and Balancer-routed swap steps into single transactions, alongside touched paths in the fixed- and open-term loan contracts. ## Low severity findings - [Deadline parameter in SyrupUserActions::_swapViaBalancer() could be set to minimize MEV](https://0xsimao.com/findings/maple-finance-syrup-balancer-swap-deadline) ## Informational findings - [Extra spaces found in some instances of the codebase](https://0xsimao.com/findings/maple-finance-syrup-extra-spaces) - [Duplicated slippage check in SyrupUserActions](https://0xsimao.com/findings/maple-finance-syrup-duplicated-slippage-check) - [Duplicated _permit() function](https://0xsimao.com/findings/maple-finance-syrup-duplicated-permit) - [Immutable variables are emitted in events](https://0xsimao.com/findings/maple-finance-syrup-immutable-event-emissions) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-08-23-maple-finance-syrup.pdf)