# Maple Syrup Router audit Three Sigma · Permissionless lending · 21st May 2024 A private security review of Maple Finance Syrup Router (permissionless lending), conducted with Three Sigma and completed on 21st May 2024 over 2 days. 0xSimao disclosed 5 findings: 2 low and 3 informational. ## What Syrup is Syrup, built by Maple Labs, opens secured institutional lending to permissionless depositors for the first time: USDC in, syrupUSDC out, with the yield sourced from fully collateralised loans to the largest institutions in crypto. ## Scope A two-day Three Sigma review of the deposit path: the SyrupRouter contract and the SyrupRateProvider that reports the syrupUSDC exchange rate. ## Findings ### Low - [Attacker may frontrun SyrupRouter::depositWithPermit() call and use a different depositData_ as it is not signed](https://0xsimao.com/findings/maple-finance-syrup-router-frontrun-deposit-permit-different) - [SyrupRouter::depositWithPermit() may be DoSed by frontrunning ERC20::permit()](https://0xsimao.com/findings/maple-finance-syrup-router-deposit-permit-frontrunning-erc20) ### Informational - [Signatures in the SyrupRouter are not fully compatible with EIP712](https://0xsimao.com/findings/maple-finance-syrup-router-signatures-fully-compatible-eip712) - [Hardcoded 1e18 in SyrupRateProvider](https://0xsimao.com/findings/maple-finance-syrup-router-hardcoded-1e18-rate-provider) - [owner in SyrupRouter also requires transfer permission](https://0xsimao.com/findings/maple-finance-syrup-router-owner-requires-transfer-permission) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-05-21-maple-finance-syrup-router.pdf) [Protocol](https://maple.finance/)