Maple V2
Cantina reviewed Maple (Maple V2) on 2 Dec 2022: 52 findings, 0 critical; 44 marked fixed, 8 acknowledged.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings52
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 3 |
| Low | 0 | 7 | 40 |
HighFirst pool depositor can be front-run and have part of their deposit stolenFixed
The report gives no description here.
MediumInitial cycle time is wrong when queuing several config updatesFixed
The report gives no description here.
MediumTransitionLoanManager.add does not account for accrued interest since last callFixed
The report gives no description here.
MediumUnaccounted collateral is mishandled in triggerDefaultFixed
The report gives no description here.
Low_getCollateralRequiredFor should round upFixed
The report gives no description here.
LowAdd additional checks to prevent refinancing/funding a closed loanFixed
The report gives no description here.
LowAdd encodeArguments/decodeArguments to WithdrawalManagerInitializerFixed
The report gives no description here.
LowAdditional verification in MapleLoanInitializerFixed
The report gives no description here.
LowAdditional verification in removeLoanImpairmentFixed
The report gives no description here.
LowAdditional verification that paymentIdOf[loan_] is not 0Fixed
The report gives no description here.
Show 10 more
LowBad parameter encoding and deployment when using wrong initializersFixed
The report gives no description here.
LowBug in makePayment() reverts when called with small amountsFixed
The report gives no description here.
LowCache calculation in getExpectedAmountFixed
The report gives no description here.
LowCan check msg.sender != collateralAsset/fundsAsset for extra safetyFixed
The report gives no description here.
LowClean up updatePlatformServiceFeeFixed
The report gives no description here.
LowDocument restrictions on RefinancerFixed
The report gives no description here.
LowEvent LoanClosed might be emitted with the wrong valueFixed
The report gives no description here.
LowFor-Loop OptmizationFixed
The report gives no description here.
LowfullDaysLate computation can be optimizedFixed
The report gives no description here.
LowGlobals.poolDelegates[delegate_].ownedPoolManager mapping can be overwrittenFixed
The report gives no description here.
Show 10 more
LowIERC426 Implementation of preview and max functionsFixed
The report gives no description here.
LowIssuance rate for double-late claims does not need to be updatedFixed
The report gives no description here.
LowLiquidator uses different reentrancy guards than rest of codebaseFixed
The report gives no description here.
LowLoanManager redundant check on late paymentFixed
The report gives no description here.
LowMissing post-migration check in PoolManager.sol could result in lost fundsFixed
The report gives no description here.
LowNo need to explicitly initialize variables with default valuesFixed
The report gives no description here.
LowPool._divRoundUp can be more efficientFixed
The report gives no description here.
LowPool._requestRedeem reduces the wrong approval amountFixed
The report gives no description here.
LowPool.previewWithdraw always reverts but Pool.withdraw can succeedFixed
The report gives no description here.
LowPoolManager has low-level shares computation logicFixed
The report gives no description here.
Show 10 more
LowPoolManager.removeLoanManager does not clear loanManagers mappingFixed
The report gives no description here.
LowPoolManager.removeLoanManager errors with out-of-bounds if loan manager not foundFixed
The report gives no description here.
LowReorder WM.processExit parametersFixed
The report gives no description here.
LowReplace hard-coded value with PRECISION constantFixed
The report gives no description here.
LowSet domainEnd correctly in intermediate _advanceGlobalPaymentAccounting stepsFixed
The report gives no description here.
LowsetTimelockWindows checks isGovernor multiple timesFixed
The report gives no description here.
LowTypos / Incorrect documentationFixed
The report gives no description here.
LowUse block.timestamp instead of domainStart in removeLoanImpairmentFixed
The report gives no description here.
LowUse ERCHelper approve() as best practiceFixed
The report gives no description here.
LowUse of floating pragma versionFixed
The report gives no description here.
Show 4 more
LowUse the cached variable in makePaymentFixed
The report gives no description here.
LowUse whenProtocolNotPaused on migrate() instead of upgrade() for more complete protectionFixed
The report gives no description here.
LowUsers cannot resubmit a withdrawal request as per the wikiFixed
The report gives no description here.
LowwithdrawCover() vulnerable to reentrancyFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Maple’s security record
MapleSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us