Maple Finance
Institutional credit-market lending protocol with professional Pool Delegates underwriting borrowers; includes Syrup.fi retail deposit wrapper and Syrup USDC/USDT yield-bearing stablecoins.
DeploymentsEthereum · $1.7B
01
Risk profile at a glance
0 red · 3 yellow · 10 green 02
Categories & evidence
184 factors · 13 categoriesCode & audits Green 9 25 of 25
RD-F-001 yellow Audit scope mismatch 15 audit engagements (6 firms, 2022–2025) cover V2 codebase; Jan 2026 CCIP Receiver audits (Dedaub/Sigma Prime) referenced in docs but PDFs not yet in public audits/ directory; commit-SHA-to-bytecode linkage unverifiable for the most recently deployed contracts. RD-F-017 yellow Mixed-decimals math without explicit scaling Maple operates with USDC (6 dec) and USDT (6 dec) as pool assets and WETH (18 dec) / WBTC (8 dec) as collateral. Multi-asset decimal handling required. 0xMacro M-2 finding (safe downcasting) was fixed. No confirmed live mixed-decimal arithmetic issue, but architecture warrants attention. RD-F-020 yellow EIP-712 domain separator missing chainId MaplePool has permit functionality (EIP-712 signatures). Domain separator chainId presence not directly confirmed without source inspection of the domain struct. Assessed yellow pending source verification. RD-F-022 yellow Public initialize() without initializer modifier Core V2 contracts use bespoke MapleProxied/NonTransparentProxy pattern without OZ Initializable — no public initialize() in the EVM sense; factory-controlled delegatecall init. MapleCCIPReceiver (UUPS, Jan 2026) exposes initialize(address,address) with likely OZ initializer modifier, but _disableInitializers() absence in constructor not confirmed from Etherscan ABI analysis. MapleLoanInitializer uses fallback-based init with no explicit re-initialization guard. RD-F-023 yellow Constructor calls _disableInitializers() Core V2 contracts (NonTransparentProxy/MapleProxied pattern) do not use OZ Initializable — _disableInitializers() is not part of their design by intent. MapleCCIPReceiver UUPS implementation constructor takes only ccipRouter — _disableInitializers() presence not confirmed from ABI/source analysis. RD-F-183 yellow Bug bounty scope gap on highest-TVL contracts Immunefi program covers 43 assets (updated Apr 21, 2026); Maple's primary high-TVL pool contracts appear in scope. The SyrupOftAdapter (LayerZero, 0x688AEe) and CCIP Receiver in-scope status cannot be confirmed from the Immunefi summary page alone. No explicit exclusion found but also no confirmation. RD-F-009 gray Formal verification coverage Maple mentions formal verification in their SDL but no published Certora/Halmos/Kani specs found in public maple-core-v2 repo. Foundry invariant testing is documented but is not formal verification. RD-F-010 gray Static-analyzer high-severity count No published Slither/Mythril/Semgrep output found in public audit reports or documentation. Static-analysis tool run required against Etherscan-verified source.
RD-F-002 green Audit recency Most recent audit engagement is November 2025 (WM upgrade by Spearbit/Sherlock) and January 2026 (CCIP Receiver by Dedaub/Sigma Prime); both are within 365 days of assessment date (2026-04-27).
RD-F-003 green Resolved-without-proof findings 0xMacro Dec-2023 audit: 0 critical/high, 1 medium fixed (safe downcasting), 1 medium acknowledged. Three Sigma Nov-2024: 0 critical/high, 2 low acknowledged. No evidence of high/critical findings marked Resolved without verifiable on-chain fix.
RD-F-004 green Audit count 6 distinct audit firms confirmed (Spearbit, Trail of Bits, Cantina, Three Sigma, 0xMacro, Sherlock); Dedaub and Sigma Prime also engaged per Jan 2026 docs entry. Exceeds green threshold (≥2 firms).
RD-F-005 green Audit firm tier At least two Tier-1 firms (Spearbit, Trail of Bits) have covered V2 code; Cantina is Spearbit-affiliated Tier-1. Three Sigma, 0xMacro, Sherlock are established Tier-2 firms.
RD-F-006 green Audit-to-deploy gap Nov 2025 WM audit concluded before Nov 28, 2025 deploy; gap approximately 0–3 days. GovernorTimelock Sept 2025 audit deployed ~30 days later. Both well within 60-day green threshold.
RD-F-007 green Bug bounty presence & max payout Active Immunefi program with max payout $500,000 (critical) and minimum $50,000. Live since January 25, 2022. 43 assets in scope. Meets green threshold (≥$500K max payout).
RD-F-008 green Ignored bounty disclosure No evidence of ignored bounty disclosure in public post-mortems. The December 2022 Orthogonal Trading event was a credit/operational failure, not a smart contract exploit. Rekt database shows zero smart contract incidents.
RD-F-011 green SELFDESTRUCT reachable from non-admin path No SELFDESTRUCT found in core lending contracts from audit reports or source inspection. Multiple audits by Tier-1 firms did not surface selfdestruct issues. Solidity 0.8.18+ prohibits SELFDESTRUCT in most contexts.
RD-F-012 green delegatecall with user-controlled target Maple uses delegatecall only through the factory-controlled proxy migration pattern (ProxiedInternals._migrate); no user-controlled delegatecall target found in audit reports or source review.
RD-F-013 green Arbitrary call with user-controlled target No arbitrary user-controlled external call target found in audit reports or source review. Pool contracts limit external calls to PoolManager. No such findings in 0xMacro or Three Sigma reports.
RD-F-014 green Reentrancy guard on external-calling functions MaplePool (Etherscan-verified v0.8.7) uses a custom reentrancy guard (uint8 reentrancyGuard, values 1/2). No reentrancy findings in 15 audit engagements across core lending functions.
RD-F-015 green ERC-777/1155/721 hook without reentrancy guard Maple pools accept USDC/USDT (standard ERC-20, no ERC-777/1155/721 callbacks). No hook-callback integration without reentrancy guard reported in audits.
RD-F-016 green Divide-before-multiply pattern No divide-before-multiply findings in 0xMacro Dec-2023 or Three Sigma Nov-2024 audits (0 critical/high findings). Assessed green based on extensive audit coverage; Slither run would confirm.
RD-F-018 green Signed/unsigned arithmetic confusion Solidity 0.8.x used throughout (native overflow/underflow protection). No signed/unsigned arithmetic findings in reviewed audit reports.
RD-F-019 green ecrecover zero-address return unchecked No ecrecover vulnerability findings in reviewed audit reports. Core lending contracts do not use ecrecover as primary auth. Assessed green; Slither run would confirm.
RD-F-021 green UUPS _authorizeUpgrade correctly permissioned MapleCCIPReceiver (UUPS) uses proxiableUUID() and upgradeToAndCall() with DEFAULT_ADMIN_ROLE gating _authorizeUpgrade. Core V2 contracts (NonTransparentProxy/MapleProxied) use admin-only setImplementation() — equivalent protection.
RD-F-024 green Code complexity vs audit coverage 0xMacro Dec-2023 covered 18 contracts over 14 days. Three Sigma Nov-2024 used 2 auditors over 4 person-weeks (20 person-days). Maple's modular architecture (separate releases per component) keeps individual audit scope manageable. No indication audit coverage is insufficient.
Governance & admin Yellow 21 24 of 24
RD-F-039 red delegatecall/call in proposal execution without allowlist GovernorTimelock executeProposals uses call() on proposal-supplied target with no on-chain target allowlist. Any contract can be targeted with arbitrary calldata after 1-day delay. Proposer gated to daoMultisig but no target restriction. RD-F-028 yellow Low-threshold multisig vs TVL daoMultisig 4-of-7 adequate; securityAdmin 3-of-6; operationalAdmin 3-of-5. globalAdmin is 2-of-3 — below peer norm for $1.7B TVL. Per methodology, one below norm = yellow. RD-F-029 yellow Multisig signers co-hosted 19 distinct signer addresses across four multisigs. No co-hosting evidence found but full infrastructure OSINT not completed. Yellow for insufficient data. RD-F-032 yellow Timelock duration on upgrades GovernorTimelock MIN_DELAY = 86,400 seconds = 24 hours. Methodology: green >= 48h; yellow 24-47h; red <24h. 24h is at the lower yellow boundary. Aave uses 2-day minimum. RD-F-033 yellow Timelock on sensitive actions Upgrade and oracle/fee config timelocked via GovernorTimelock. Pause (setProtocolPause) callable by securityAdmin (3-of-6) without timelock — deliberate emergency design. 3-of-5 action types timelocked. RD-F-035 yellow Role separation: upgrade ≠ fee ≠ oracle GovernorTimelock holds upgrade, oracle config, and fee config authority jointly (not separated at top level). securityAdmin handles pause separately. Two of three roles partially separated. RD-F-036 yellow Flash-loanable voting weight Governance is Snapshot off-chain with block-height voting snapshots, not live balanceOf. Prevents classic flash-loan attack. No on-chain governor with live-balance voting. Residual risk from off-chain Snapshot execution. RD-F-038 yellow Proposal execution delay < 24h GovernorTimelock MIN_DELAY = 86,400s = exactly 24 hours. Per methodology yellow band: 24-47h. At the lower boundary of yellow. RD-F-041 yellow Rescue/emergencyWithdraw without timelock No explicit rescue/emergencyWithdraw/sweep function identified in core contracts. setProtocolPause callable by securityAdmin (3-of-6) without timelock — pause, not drain. Internal scheduleCall timelock mechanism exists. Full enumeration of all 20+ proxy ABIs not completed. RD-F-042 yellow Admin has mint() with unlimited max SYRUP mint() gated by on-chain module system (not direct EOA access). Module additions require DAO governance. No hard supply cap confirmed (max supply = infinity per market data). Module can mint without per-tx timelock once registered. RD-F-167 yellow Deprecated contract paused but pause reversible by live admin Multiple deprecated/inactive pools exist (Maven11, Orthogonal, Icebreaker, Cicada, Laser). securityAdmin can issue setContractPause() on these contracts. Whether pause role was renounced on deprecated pools is unconfirmed. [migrated from Cat 12 via PD-032 2026-04-23] RD-F-030 gray Hot-wallet signer flag Signer behavioral pattern (hot-wallet vs hardware) not analyzed. Requires per-signer on-chain activity review. RD-F-044 gray Admin wallet interacts with flagged addresses CTI feed not available for this assessment. No public flags observed on admin addresses. Requires Chainalysis/TRM analysis. RD-F-047 gray Governance token concentration (Gini) Gini coefficient of SYRUP token holdings not computed. Full holder scan not performed in this assessment.
RD-F-025 green Admin key custody type All admin roles are multisig+timelock: governor = GovernorTimelock (1-day delay); daoMultisig is proposer; all other roles are Safe multisigs. No EOA holds admin.
RD-F-026 green Upgrade multisig signer configuration (M/N) 5 distinct privileged addresses: GovernorTimelock (governor), daoMultisig, securityAdmin, operationalAdmin, globalAdmin. Roles distributed adequately.
RD-F-027 green Single admin EOA No single EOA holds any admin role. All five admin addresses are Safe multisig contracts confirmed via Safe API and Etherscan.
RD-F-031 green Signer rotation recency No threshold-reduction or suspicious signer-set change events detected. GovernorTimelock deployed Sept 2025 with stable configuration. No DPRK-precursor pattern.
RD-F-034 green Guardian/pause-keeper distinct from upgrader securityAdmin (3-of-6) holds pause capability; GovernorTimelock holds upgrade capability. These are distinct addresses — role separation confirmed.
RD-F-037 green Quorum achievable via single-entity flash loan Snapshot quorum is 5% of circulating supply (~60.5M SYRUP). Block-height snapshot prevents flash-loan quorum capture. Token must be held at snapshot block. Flash loan cannot satisfy this requirement.
RD-F-040 green Emergency-veto multisig present securityAdmin (3-of-6 Safe) holds CANCELLER_ROLE on GovernorTimelock. Can cancel queued proposals. This is a separate Safe from the proposer (daoMultisig) — provides meaningful veto.
RD-F-043 green Admin = deployer EOA after 7 days Protocol launched May 2021 (~59 months ago). All current admin roles are multisig-controlled. No evidence admin remained with deployer EOA. Distinct deployer vs admin addresses confirmed.
RD-F-045 green Constructor args match governance proposal GovernorTimelock deployed with constructor args matching address registry (daoMultisig=proposer, operationalAdmin=executor, securityAdmin=canceller). No silent deviation identified.
RD-F-046 green Contract unverified on Etherscan/Sourcify All 20 core contracts in profile §3 are verified on Etherscan with public source code. 15 audit engagements reference publicly accessible code.
Oracle & external dependencies Green 15 17 of 17
RD-F-049 yellow Oracle role per asset Primary Chainlink feeds per asset. Manual override (setManualOverridePrice) acts as governor-triggered secondary, not automatic fallback. On staleness, contract reverts — no automatic switch to secondary oracle in code path. RD-F-050 yellow Dependency graph (protocols depended upon) Dependency graph: Chainlink (price feeds), Aave V3 AaveStrategy, Sky/MakerDAO SkyStrategy, Chainlink CCIP (supplementary bridge), LayerZero OFT (supplementary bridge). syrupRateProvider reads immutable pool address. Graph is substantially complete but breakage runbook is curator-derived, not formally published. RD-F-051 yellow Fallback behavior on oracle failure On primary Chainlink feed staleness: contract reverts (MG:GLP:STALE_PRICE). Governor can call setManualOverridePrice() to unblock — human-triggered, not automatic. No automatic fallback to secondary oracle. Aave/Sky strategy failures contained — idle liquidity stays in pool. RD-F-052 yellow Breakage analysis per dependency Breakage analysis documented in assessment: Chainlink staleness halts liquidations; Aave/Sky failures disrupt idle yield (not principal); CCIP failure blocks Solana bridge (not core lending); syrupRateProvider failure affects DeFi integrations. No formally published protocol breakage runbook found. RD-F-057 yellow Circuit breaker on price deviation No on-chain price-deviation circuit breaker in MapleGlobals. Governor has setManualOverridePrice() as emergency mechanism but this requires human action. No automatic halt-on-deviation. Chainlink feeds have deviation triggers but these are at the oracle layer, not enforced within Maple contract logic. RD-F-060 yellow Chainlink aggregator min/max bound misconfig Chainlink aggregators include minAnswer/maxAnswer bounds set by Chainlink. MapleGlobals does not independently verify these bounds. Known risk: if collateral asset crashes below minAnswer, feed returns minAnswer (floor), not real price. Cannot verify all bound configurations without direct RPC calls to each of 8+ feeds. RD-F-054 n/a TWAP window duration Protocol does not use DEX TWAP oracles. All feeds are Chainlink push-feeds. TWAP window duration is not applicable. RD-F-055 n/a Oracle pool depth (USD) No DEX pool feeds used. Chainlink aggregators use off-chain price aggregation, not DEX pool depth. Factor not applicable. RD-F-056 n/a Single-pool oracle (no medianization) No single-pool TWAP oracle used. Chainlink feeds aggregate multiple off-chain sources. Factor not applicable. RD-F-058 n/a Max-deviation threshold (bps) No on-chain circuit breaker threshold in Maple contracts. Factor is not applicable given F057 is yellow (no circuit breaker).
RD-F-048 green Oracle providers used All active market oracle feeds are Chainlink push-feeds accessed via latestRoundData(). One custom stub (usdcUsdOracle 0x5DC5E14be1280E747cD036c089C96744EBF064E7) returns hardcoded 1e8. syrupRateProvider is a peripheral pool-derived rate oracle. No spot DEX oracles used.
RD-F-053 green Oracle source = spot DEX pool (no TWAP) No spot DEX pool oracle used for any live market. All collateral/pool-asset pricing goes through MapleGlobals.getLatestPrice() which calls Chainlink latestRoundData(). No slot0() or getReserves() calls in any price path. [★ CRITICAL — NOT RED]
RD-F-059 green Oracle staleness check present Staleness check present in MapleGlobals.getLatestPrice(): require(updatedAt_ >= block.timestamp - priceOracleOf[asset_].maxDelay). Per-asset configurable maxDelay. Heartbeats range from 3600s (ETH, BTC, volatile) to 86400s (stablecoins). Reverts with MG:GLP:STALE_PRICE on violation.
RD-F-061 green LP token balanceOf used for pricing No balanceOf-based pricing in MapleGlobals price path. Price path uses Chainlink latestRoundData() exclusively. No donation-manipulable LP token pricing found.
RD-F-062 green External keeper/relayer not redundant Liquidation is permissionless — any address can call liquidation functions when a loan is undercollateralized. No single keeper/relayer dependency for core liquidation path. Pool strategies (Aave/Sky) use internal protocol calls.
RD-F-180 green Immutable oracle address Oracle addresses in MapleGlobals stored in mutable mapping(address => PriceOracle). setPriceOracle(asset_, oracle_, maxDelay_) callable by onlyGovernor — fully admin-replaceable without contract redeployment. EXCEPTION: syrupRateProvider (peripheral, DeFi integrations only) has immutable pool address — not used in core lending liquidation path. [★ CRITICAL — NOT RED]
RD-F-181 green Permissionless-pool lending oracle MapleGlobals oracle system requires governor-configured oracle addresses (onlyGovernor for setPriceOracle). No permissionless pool oracle acceptance. All oracle sources are whitelisted Chainlink feeds. No permissionless listing mechanism for oracle sources.
Economic risk Yellow 33 13 of 13
RD-F-067 red Historical bad-debt events One documented bad-debt event: Orthogonal Trading default December 2022, ~$36M uncollateralized bad debt from M11 Credit-managed pools. ~30% of active protocol loans at the time. Depositors in affected pools faced up to 80% losses. Recovery was partial (Kroll retained, BVI liquidator appointed, estimated $2.5M minimum recovery). Losses not fully compensated. RD-F-063 yellow TVL (current + 30d trend) TVL $2.09B current (DefiLlama, 2026-05-07), recovered from $1.70B at the 2026-04-27 trough. TVL peaked ~$4.59B at end-2025; current represents a ~54% drawdown from that peak. Multi-month trend remains in the declining-trend yellow band, but short-term reversal noted. RD-F-065 yellow Liquidity depth per major asset Pool assets are USDC/USDT (highly liquid). Secondary market DEX depth for syrupUSDC: $10M total ($5M Uniswap + $5M Balancer) against $2.09B TVL = ~0.48% depth (refreshed 2026-05-07). Protocol-level withdrawal buffer scaling with utilization (~85% range) — thin but non-zero; relies on loan repayments and idle liquidity for queue redemption. RD-F-066 yellow Utilization rate (lending protocols) Protocol-wide utilization 85.38% ($1.451B borrowed / $1.699B supplied) as of 2026-04-27 cache; supply has since rebounded to $2.09B (DefiLlama, 2026-05-07) which would mechanically reduce utilization assuming the loan book is sticky. Reading remained within the 80-95% yellow band at last full snapshot. Recommend a fresh borrow-side refetch before the next rubric pass. RD-F-068 yellow Collateralization under stress Average collateralization 160%+ across product categories (Modular Capital April 2025). Blue Chip: BTC/ETH only. High Yield: broader altcoin basket. Off-chain margin call + 24h cure window before liquidation. Under 50% collateral drop stress: 160% initial ratio falls to ~80%, below 100% if cure is not executed in time. RD-F-071 yellow Seed-deposit requirement for new market listing Governor configures bootstrapMint per asset before pool creation — functions as a seed deposit mechanism. Governor can set to any value including zero. No hard code-level enforcement of a non-zero minimum floor independent of governance configuration. RD-F-074 yellow ERC-4626 virtual-share offset (OZ ≥4.9) Maple pool tokens use custom ERC-4626 implementation (revenue-distribution-token library), not OpenZeppelin. OZ >=4.9 virtual-share offset not used. Protection comes from governor-configurable bootstrapMint, not a code-level OZ virtual constant. Non-OZ custom mitigation present. RD-F-075 yellow First-depositor / share-inflation guard Explicit guard present via bootstrapMint (governor-set at pool creation), confirmed as remediation of Spearbit Dec 2022 high-severity finding. Active pools have non-zero supply. Guard is governance-configurable, not a code-level constant — future pools with bootstrapMint=0 would lack protection. RD-F-064 gray TVL concentration (top-10 wallet share) On-chain depositor concentration (top-10 wallet share) not obtainable from public sources. Institutional lender model implies some large concentrated depositors but subgraph query not executed. Data unavailable. RD-F-069 n/a Algorithmic / under-collateralized stablecoin Maple Finance is not a stablecoin protocol. syrupUSDC/USDT are yield-bearing receipt tokens, not synthetic stablecoins. Algorithmic/under-collateralized stablecoin classification does not apply. RD-F-073 n/a Oracle-manipulation-proof borrow cap Not applicable. Maple uses Chainlink push-oracle price feeds (not DEX TWAP) for collateral valuation. Borrow caps are negotiated per-borrower by Pool Delegates. Oracle-manipulation-proof borrow cap vs. DEX pool depth check does not apply to this architecture.
RD-F-070 green Empty cToken-style market (zero supply/borrow) [★ CRITICAL] Maple V2 implements `bootstrapMint` mechanism (set by Governor per asset) to prevent first depositor share-inflation on ERC-4626-style pool tokens. High-severity finding identified by Spearbit in Dec 2022 V2 audit and remediated before launch. Active pools have non-zero TVL ($1.70B). Green — mitigant present and currently active.
RD-F-072 green Market-listing governance threshold New pool creation requires governance DAO vote (Snapshot + GovernorTimelock on-chain execution). Pool Delegates must be approved by Maple governance. PoolDeployerV4 is the current deployer contract. High-threshold DAO vote required — not permissionless.
Operational history Green 19 15 of 15
RD-F-077 yellow Prior exploit count 1 documented incident: Orthogonal Trading credit default December 2022, ~$36M bad debt. Not a smart-contract exploit. Recovery was partial (depositors faced up to 80% losses). No smart-contract exploits on record. Yellow per methodology (1 incident with partial recovery). RD-F-081 yellow Post-exploit response score Fast public communication (same-day, Dec 5 2022). V2 deployed Dec 11 (6 days) as structural fix. Kroll engaged for recovery. No comprehensive protocol-level post-mortem with named contracts/code diffs. Depositor compensation partial. Response quality: adequate speed, inadequate transparency and compensation. RD-F-082 yellow Post-mortem published within 30 days M11 Credit Medium update published within days of default. No comprehensive protocol-level post-mortem with root cause, named contracts, and code diff found. V2 release served as implicit remediation. Published within 30 days but quality below green standard. RD-F-084 yellow TVL stability (CoV over 90d) 30-day TVL change of −31.62% (data cache). A contraction of this magnitude over 30 days is consistent with CoV > 0.15, placing this in the yellow band (0.15–0.35). Full 90-day daily time-series not computed. RD-F-085 yellow Incident response time (minutes) Public announcement same-day (Dec 5, 2022). On-chain default declaration ~8 days later (Dec 13). Fast public communication; measured on-chain enforcement. Exact minute-level timestamp not determinable from public sources. RD-F-088 yellow Re-deployed to new addresses in last year GovernorTimelock deployed September 2025; withdrawal manager redeployed November 2025; multi-version loan contract history indicates ongoing new deploys. Not a full protocol redeployment, but new contract surfaces deployed within 12 months. RD-F-166 yellow Deprecated contracts still holding value Maple V1 deprecated December 11, 2022. Docs still reference V1 UI as accessible for three legacy pools. On-chain balances of V1 contracts not independently confirmed as zero. Likely below $100K threshold but not on-chain verified. Yellow pending curator confirmation. RD-F-086 gray Pause activations (trailing 12 months) On-chain RPC event log for Paused/Unpaused events not queried. No public announcements of emergency pauses found. Gray pending on-chain verification. RD-F-087 gray Pause > 7 consecutive days Not assessed via on-chain event log. No evidence of extended pause found in public sources. Gray pending on-chain verification. RD-F-089 gray Insurance coverage active No active DeFi insurance coverage on Maple V2 pools found. Maple's institutional, permissioned, overcollateralized lending pools are not underwritten by DeFi insurance providers (Nexus Mutual, Sherlock, Unslashed) — credit risk is structurally outside DeFi insurance scope. Gray per institutional-lending exemption (not red, as this is not a fixable oversight).
RD-F-076 green Protocol age (days) 1,811 days live as of 2026-04-27 (launched 2021-05-12 on Ethereum mainnet). Exceeds 365-day green threshold by a wide margin.
RD-F-078 green Chronic-exploit flag (≥3 incidents) Only 1 known incident (Orthogonal Trading, Dec 2022). Does not meet the ≥3 incidents chronic threshold. CHRONIC badge does not apply.
RD-F-079 green Same-root-cause repeat exploit No repeat incident. Single credit default in 2022. Root cause (no early-default enforcement on undercollateralized borrowers) was structurally addressed in V2. No post-V2 credit default found.
RD-F-080 green Days since last exploit 1,604 days since the December 5, 2022 incident as of 2026-04-27. Exceeds 365-day green threshold.
RD-F-083 green Auditor re-engaged after last exploit Three Tier-1/Tier-2 audits of V2 in December 2022 (Spearbit, Trail of Bits, Three Sigma) — contemporaneous with the incident, as direct structural response. Continuous auditing through 2025 (15 total engagements, 6 firms).
Real-time signals Green 8 22 of 22
RD-F-098 yellow TVL anomaly — % drop in <1h TVL down -31.62% over 30 days ($2.5B → $1.70B); 1-day change only -0.03%. 1h window signal not firing. 30d trend reflects orderly institutional outflow (lstBTC injunction, legal uncertainty, credit cycle), not exploit-drain. Yellow posture on trend. RD-F-105 yellow DNS/CDN/frontend hash drift February 2026: maple.finance website taken offline due to confirmed security breach. Smart contracts unaffected per Maple statement. Signal fired and cleared. Currently operating normally. Historical fire within recent window warrants yellow. RD-F-109 yellow Social-media impersonation scam spike No confirmed coordinated impersonation campaign identified. February 2026 website outage and legal disputes (lstBTC) create elevated ambient risk for impersonation campaigns. No confirmed scam-coordinator campaign. RD-F-090 gray Mixer withdrawal → protocol interaction Requires Chainalysis/TRM CTI feed. No public reports of mixer-funded wallets interacting with Maple protocol contracts. Institutional KYC/KYB model reduces probability of anonymous mixer-funded wallets passing pool onboarding. RD-F-091 gray Partial-drain test transactions Pattern-matcher not deployed for Maple. No pre-strike test-transaction patterns identified in public chain data. Institutional loan structure means fund movements are scheduled repayments/draws, not suspicious drain-test signatures. RD-F-092 gray Unusual mempool pattern from deployer wallet Original deployer address is null in data-cache pipeline. PoolDeployerV4 (0xdaF005B31B10F33EE42cEB1A4b983434FE947488) is current factory-level deployer but its mempool baseline is not established. No anomalous deployer activity reported publicly. RD-F-093 gray Abnormal gas-price willingness from attacker wallet Requires live mempool stream + EMA baseline. No attacker wallet identified against Maple contracts. Cannot assess without live mempool monitoring. RD-F-094 gray New contract with similar bytecode to exploit template No new contract deployments matching Maple-targeting exploit templates identified in public sources. Bytecode similarity index not maintained for this protocol class. RD-F-095 gray Known-exploit function-selector replay No known exploit replay patterns against Maple's contract surfaces identified in public data. Selector pattern index not maintained. RD-F-096 gray New ERC-20 approval to unverified contract from whale No public reports of Maple depositor whales granting approvals to unverified contracts. Whale list and approval event monitoring not configured in pipeline. RD-F-103 n/a Bridge signer-set change proposed/executed Maple's bridge surfaces (Chainlink CCIP, LayerZero OFT) are provider-controlled signer sets, not Maple-controlled. No Maple-controlled bridge signer set exists for this signal to fire on. RD-F-107 gray Admin EOA signing from new geography/device Requires off-chain signing telemetry (team opt-in). Not available publicly. Will be gray for virtually all protocols. RD-F-182 n/a Security-Council threshold reduction (RT) Maple does not operate a Security Council multisig governance model. Its governance is Snapshot → daoMultisig → GovernorTimelock. RD-F-182's SC threshold-reduction signal has no direct analog here.
RD-F-097 green Sybil surge of identical-pattern transactions Sybil-surge precursor is structurally inapplicable to Maple's KYC/KYB institutional lending model. Pool onboarding requires identity verification, making sybil EOA clusters unable to gain access. Signal not firing.
RD-F-099 green Oracle price deviation >X% from secondary Chainlink feeds for all major assets (ETH/USD, BTC/USD, USDC/USD, USDT/USD) operating within normal parameters as of 2026-04-27. No oracle price deviation event identified.
RD-F-100 green Flash loan >$10M targeting protocol tokens Flash-loan attack surface structurally reduced: withdrawal queues with cooldowns prevent front-running; collateral valued via Chainlink aggregators not spot DEX; institutional loan agreements not AMM mechanics. No flash-loan attack identified.
RD-F-101 green Large governance proposal queued Most recent governance activity is MIP-020 (routine SSF allocation, January 2026). No proposals with admin-role-change, upgrade, delegatecall, or SC-threshold-reduction patterns. GovernorTimelock 1-day delay active. Signal not firing.
RD-F-102 green Admin/upgrade transaction in mempool No publicly reported admin/upgrade tx anomaly as of 2026-04-27. Protocol has Tenderly + OZ Defender monitoring all admin txs at block level with PagerDuty escalation. Phase-2 signal.
RD-F-104 green Stablecoin depeg >2% on shared-LP venue USDC and USDT stable as of 2026-04-27. USDS (SkyStrategy dependency) stable. No stablecoin in Maple dependency graph depegged >2%. Signal not firing.
RD-F-106 green Cross-chain bridge unverified mint pattern Chainlink CCIP bridge provides proof-verified cross-chain messaging by design. No unverified mint pattern applicable. Signal not firing.
RD-F-108 green GitHub force-push to sensitive branch Last commit to maple-labs/maple-core-v2 was 2026-02-19. No public reports of unauthorized force-push or non-protocol-account push to protected branches. No anomaly publicly detected.
RD-F-110 green Unusual pending/executed proposal ratio Governance on Snapshot (maple-protocol.eth) and GovernorTimelock shows normal cadence. MIPs 017-020 are sequential, well-spaced tokenomics proposals. No unusual proposal ratio detected.
Dev identity & insider risk Green 7 16 of 16
RD-F-116 yellow Contributor tenure at admin-permissioned PR GovernorTimelock commit (Sept 2025) authored by '0xfarhaan' — contributor tenure on maple-core-v2 not independently confirmed. Audits (0xMacro + Sherlock) were used for the deploy, indicating institutional process, but the specific contributor's tenure is unverified. RD-F-119 yellow Commit timezone consistent with stated geography Team is Australia-based (Melbourne/Sydney, UTC+10/+11). Full commit-time distribution analysis was not performed. No auditor flagged timezone anomaly across 15 audit engagements (6 firms). Yellow due to non-assessment rather than a negative finding. RD-F-123 yellow Sudden admin-rescue/ACL change without discussion GovernorTimelock deployed September 2025 with new admin topology (DAO multisig proposer, operationalAdmin executor, securityAdmin canceller). Audits (0xMacro + Sherlock) completed. No corresponding MIP or governance forum proposal identified for this structural ACL change. Governance discussion gap is the yellow driver. RD-F-117 gray ENS/NameStone identity bound to deployer No ENS name found bound to the deployer address (0xb54a98c242...). Deployer is a purpose-built wallet with 4 transactions, not used post-deploy. ENS binding is not typical for 2021-era protocol deploy wallets. RD-F-184 gray Real-capital social-engineering persona No evidence of a real-capital social-engineering persona deploying ≥$1M to Maple Finance or peer protocols to build credibility. M-only curation factor; no positive evidence found. Maple's KYC'd institutional borrower model is an atypical attack surface for this vector.
RD-F-111 green Team doxx status Sidney Powell (CEO) and Joe Flanagan (Exec Chairman) are fully doxxed with real names, LinkedIn profiles, conference speaker records, and X/Twitter. Maple Finance Inc. is Australia-incorporated with a public team page.
RD-F-112 green Team public accountability surface Both co-founders have multiple verifiable public trails: LinkedIn with employment history, conference speaker profiles, video interviews, X/Twitter. Sidney Powell is a repeat conference speaker (Consensus 2025, Greenwich Economic Forum, Blockworks). Joe Flanagan has prior-employer verifiability (PwC, Axsesstoday CFO).
RD-F-113 green Team other-protocol involvement history No prior rug or exit-scam affiliations for Powell or Flanagan. Both have verifiable TradFi/fintech employment histories pre-Maple. Orthogonal Trading default (Dec 2022) was a borrower default — not a team-executed rug. Team rebuilt protocol to $1.7B TVL.
RD-F-114 green Deployer address prior on-chain history Deployer 0xb54a98c242abc8582153b5e6b2b8c83cc6c1c8c4 has only 4 total transactions (Apr–May 2021): one funding receipt, one MapleToken deploy, one ETH transfer out. Purpose-built deploy wallet. Not linked to any prior rugged protocol.
RD-F-115 green Prior rug/exit-scam affiliation No rug or exit-scam affiliations found for any identified Maple Finance team member. Protocol had a credit risk event (Orthogonal Trading borrower default, Dec 2022) but team response involved active recovery, not exit.
RD-F-118 green Handle reuse across failed/rugged projects No evidence of Twitter/Discord handle reuse across failed or rugged projects for Sidney Powell or Joe Flanagan. Both handles are consistently and exclusively associated with Maple Finance.
RD-F-120 green Video-off/voice-consistency flag No video-off or voice-consistency flags. Sidney Powell participates in public video conference panels (Consensus 2025, Blockworks). Joe Flanagan appeared in CoinDesk video interview. No anomalous patterns reported.
RD-F-121 green Contributor OSINT depth score Sid Powell: LinkedIn full employment history, Consensus 2025 speaker, Blockworks speaker, Greenwich Economic Forum, Crunchbase, RootData, active X. Joe Flanagan: LinkedIn with PwC + CFO history, ZoomInfo, The Org, video interviews. OSINT depth: 5/5 for Powell, 4/5 for Flanagan.
RD-F-122 green Contributor paid to DPRK-cluster wallet No evidence of any contributor payment wallet routing within 3 hops to a DPRK-labeled cluster. No Chainalysis-published or OFAC-SDN DPRK proximity found for any Maple Finance wallet.
RD-F-124 green Deployer wallet mixer-funded within 30 days Deployer (0xb54a98c242...) funded 2021-04-20, ~22 days before MPL deploy (2021-05-12 — within the 30-day window). Funding source (0x160834291e...) has NO Tornado Cash or mixer interactions. The funder is an unlabeled personal DeFi wallet with a 6-year history, no mixer proximity.
RD-F-125 green Deployer linked within 3 hops to DPRK/Lazarus No DPRK/Lazarus cluster proximity found for any Maple Finance privileged address. No OFAC SDN match. No published Chainalysis attribution. Maple is an Australia-incorporated company with fully doxxed TradFi-background founders.
Fork / dependency lineage Green 11 10 of 10
RD-F-135 yellow Shared-library version with known-vuln status Core contracts use Solidity 0.8.7–0.8.25 (all non-EOL). SYRUP token (0.8.18) metadata notes four low/medium solc compiler bugs (informational severity). OZ version not determinable from data-cache (oz_contracts_version=null). No critical library CVE affecting current deployed versions identified. RD-F-126 n/a Is-a-fork-of Maple Finance is an original codebase, not a fork of any prior protocol. No upstream parent. RD-F-127 n/a Upstream patch not merged Not applicable — Maple is an original protocol with no upstream fork parent. RD-F-128 n/a Upstream vulnerability disclosure (last 90d) Not applicable — no upstream fork parent; no upstream vulnerability disclosure possible. RD-F-129 n/a Code divergence from upstream (%) Not applicable — original codebase, no upstream to measure divergence from. RD-F-130 n/a Fork depth (generations from original audit) Not applicable — original protocol (fork depth = 0 by definition; there is no fork chain). RD-F-131 n/a Fork retains upstream audit coverage Not applicable — Maple is not a fork and has its own independent audit coverage (15 engagements). RD-F-132 n/a Fork has different economic parameters than upstream Not applicable — not a fork, no upstream economic parameters to diverge from.
RD-F-133 green Dependency manifest uses unpinned versions Maple uses Foundry with git submodules (no package.json / npm). Git submodules are pinned to specific commits, not floating semver ranges. No unpinned version risk from npm-style floating ranges.
RD-F-134 green Dependency had malicious-release incident (last 90d) No malicious release in trailing 90 days affecting Maple's Foundry/Solidity git-submodule dependencies. Minimal npm attack surface (package_json_present=false).
Post-deploy hygiene & change mgmt Yellow 23 13 of 13
RD-F-143 red Reinitializable implementation (no _disableInitializers) _disableInitializers() absent from entire maple-core-v2 repo (GitHub search: 0 files). NonTransparentProxied base has no constructor calling this guard. Implementation contracts behind NonTransparentProxy lack reinitialization protection. RD-F-136 yellow Deployed bytecode matches signed release tag data-cache shows changelog_present=false. No GPG-signed release tags confirmed. Foundry build present. Unsigned tags may exist but signed-tag verification not confirmed. RD-F-139 yellow Post-audit code changes without re-audit GitHub last commit 2026-02-19 (data-cache). Most recent audit: Nov 2025 (WM by Spearbit+Sherlock). Feb 2026 commits are post-audit and unverified by any public audit. Strong audit cadence historically but a ~3-month gap exists. RD-F-142 yellow Storage-layout collision risk across upgrades Protocol uses bespoke NonTransparentProxy pattern (not OZ). Multiple versioned implementations (FixedTermLoanV400-V601, PoolManagerV100-V400) imply extensive upgrade history. Storage-layout collision checks not confirmed from public audit summaries. RD-F-145 yellow Deployed bytecode reproducibility Foundry build system present (foundry_toml_present=true). optimizer_enabled=false (data-cache) suggests deterministic build settings. No explicit bytecode reproducibility statement published. RD-F-168 yellow Stale-approval exposure on deprecated router Deprecated/inactive pool contracts exist (Maven11, Orthogonal, Icebreaker, Cicada, Laser). Users may retain stale approvals to these contracts. Formal approval scan not performed. [migrated from Cat 12 via PD-032 2026-04-23] RD-F-185 yellow Bridge rate-limiter / chain-pause as positive mitigant CCIP bridge endpoint exists for Solana syrupUSDC and LayerZero OFT adapter for SYRUP. No Maple-specific rate-limiter confirmed on bridge contracts. CCIP has protocol-level rate-limiting. Solana TVL = 0 (low exposure). [batch-24 addition]
RD-F-137 green Upgrade frequency (per 90 days) No Upgraded events found for core proxy contracts (Globals, SYRUP token) in last 90 days. 0 upgrades detected in the look-back window.
RD-F-138 green Hot-patch deploys without timelock (last 30 days) No hot-patch deploys without timelock identified in last 30 days. No CallExecuted events found for GovernorTimelock in the review period.
RD-F-140 green Fix-merged-but-not-deployed gap No identified security PRs merged without corresponding deployment. No public evidence of pending-but-undeployed security fixes.
RD-F-141 green Test-mode parameters in deploy GovernorTimelock deployed with production addresses. MapleGlobals has production oracle addresses. No test-mode parameters identified.
RD-F-144 green CREATE2 factory permits same-address redeploy No CREATE2 factory deployment pattern identified for core contracts. Standard deployer-based deployment used. Not applicable to current deployment pattern.
RD-F-146 green New contract deploys in last 30 days No new contract deploys identified in last 30 days. GitHub last commit 2026-02-19 suggests no recent fresh deployments.
Cross-chain & bridge Green 19 12 of 12
RD-F-148 yellow Bridge validator count (M) CCIP uses Chainlink DON — validator count managed by Chainlink, not readable from MapleCCIPReceiver. CCIP DON typically uses multiple independent node operators. Cannot verify exact count from application contract. LayerZero surface assessed under RD-F-179. RD-F-149 yellow Bridge validator threshold (k-of-M) CCIP threshold managed by Chainlink protocol — not configurable by Maple or readable from MapleCCIPReceiver. Trusts Chainlink DON consensus. For LayerZero OFT, see RD-F-179. RD-F-150 yellow Bridge validator co-hosting CCIP DON operators are externally managed by Chainlink. LayerZero DVN operator co-hosting not assessed (layerzeroscan rate-limited). Cannot verify independence of validators for either bridge surface. RD-F-151 yellow Bridge ecrecover checks result ≠ address(0) MapleCCIPReceiver does not use ecrecover — relies on CCIP Router as trusted authority. SyrupOftAdapter delegates to LayerZero endpoint. Zero-address ecrecover vulnerability pattern (Wormhole class) is not applicable at application layer. Security depends on upstream router/endpoint trust. [★ CRITICAL — NOT RED] RD-F-155 yellow Bridge validator-set rotation recency CCIP: Chainlink manages DON operator set rotation — not observable from MapleCCIPReceiver. LayerZero DVN: not assessed (layerzeroscan rate-limited). Cannot confirm rotation recency for either bridge surface. RD-F-156 yellow Bridge uses same key custody for >30% validators Cannot assess from available data. CCIP DON operators are Chainlink-managed. LayerZero DVN operators not confirmed (layerzeroscan rate-limited). RD-F-179 yellow LayerZero OFT DVN config (count, threshold, diversity) SyrupOftAdapter (0x688AEe022AA544f150678B8E5720b6b96a9E9a2F) confirmed as LayerZero OFT adapter using EndpointV2. DVN configuration (count, threshold, operator diversity) NOT verified due to layerzeroscan rate-limiting (HTTP 429). data-cache shows layerzero.present=false (pipeline miss). Post-Kelp DAO event, single-DVN configs are a critical concern. Requires curator follow-up with direct LayerZero endpoint getConfig() call.
RD-F-147 green Protocol has bridge surface Bridge surface confirmed: (1) Chainlink CCIP — Maple CCIP Receiver proxy (0x02B6A75c5D1F430F0614dc5AC8aD5F9D35fbA2c4) for syrupUSDC → Solana bridging. (2) LayerZero OFT — SyrupOftAdapter (0x688AEe022AA544f150678B8E5720b6b96a9E9a2F) for SYRUP token cross-chain. Both are supplementary to core lending TVL.
RD-F-152 green Bridge binds message to srcChainId CCIP messages include sourceChainSelector in Client.Any2EVMMessage struct. MapleCCIPReceiver stores chainType per selector via setChainType() and validates source chain. LayerZero messages include srcEid enforced at endpoint layer.
RD-F-153 green Bridge tracks nonce-consumed mapping CCIP assigns unique messageId to each message. MapleCCIPReceiver maintains getMessage mapping tracking processed message IDs and FailedMessage records for replay resistance. LayerZero V2 uses ordered nonce delivery at endpoint layer.
RD-F-154 green Default bytes32(0) acceptable as valid root CCIP does not use Merkle root validation — uses DON consensus. Nomad bytes32(0) bug class is architecturally inapplicable to CCIP design. No bytes32(0) root acceptance pattern in MapleCCIPReceiver or SyrupOftAdapter. [★ CRITICAL — NOT RED]
RD-F-157 green Bridge TVL per validator ratio CCIP bridge TVL: DefiLlama Solana TVL = $0 (2026-04-27). LayerZero OFT: SyrupOftAdapter holds ~4.24M SYRUP (~$1.07M). Both surfaces show very low bridge TVL, resulting in very low TVL-per-validator concentration regardless of validator count.
Threat intelligence & recon Green 17 8 of 8
RD-F-161 yellow Protocol-impersonator domain registered (typosquat) Domain monitoring not configured in pipeline. February 2026 website security breach elevates typosquat risk for a period. No specific typosquat confirmed in public sources. RD-F-163 yellow Avg attacker reconnaissance time for peer-class protocols Institutional lending class reconnaissance time varies; no Maple-specific hack DB sample. For smart-contract lending exploits broadly, reconnaissance ranges 7-30+ days. Insufficient protocol-specific data for precise estimate. RD-F-158 gray Known-threat-actor cluster has touched protocol Requires Chainalysis/TRM CTI feed. No public reports of known threat-actor clusters interacting with Maple protocol contracts. Institutional KYC/KYB model reduces exposure. CTI feed required for definitive confirmation. RD-F-159 gray Attacker wallet pre-strike probe (low-gas failing txs) Requires mempool + CTI cluster feed. No pre-strike probe patterns (low-gas failing txs from CTI-flagged wallets to Maple contracts) identified in public data. RD-F-162 gray Known-exploit-template selector deployed by any address No known exploit-template contract deployments targeting Maple's contract selectors identified in public chain data. Selector pattern index not maintained for this protocol class. RD-F-164 gray Leaked credential on paste/sentry site Paste/Sentry monitoring not configured. February 2026 website breach raises possibility of infrastructure credential exposure. No public paste-site credential dump referencing maple.finance or syrup.fi identified.
RD-F-160 green GitHub malicious-dependency incident touching protocol deps No active GHSA advisory flagging malicious release in maple-core-v2 dependencies. Foundry-based repo with no npm supply-chain exposure in core contracts. No advisory affecting maple-labs deps identified.
RD-F-165 green Protocol social channel has scam-coordinator flag No scam-coordinator flag identified in Maple's Discord/Telegram/X channels. No ScamSniffer or Chainabuse entries linking Maple official channel admins to scam-coordinator watchlists.
Tooling / compiler / AI Green 0 5 of 5
RD-F-171 n/a Bytecode similarity to audited upstream with behavior deviation Maple is an original codebase — no audited upstream to measure bytecode similarity or behavioral deviation against. Factor designed for AI-generated copies of audited code; moot for original protocols.
RD-F-170 green Solc version used (known-bug versions flagged) Deployed contracts use Solidity 0.8.7 (Pool, MapleLoan), 0.8.10 (MapleStrategy legacy), 0.8.18 (SYRUP token), 0.8.24 (MapleCCIPReceiver), 0.8.25 (Globals, GovernorTimelock). All in the 0.8.x supported branch. No versions on the known-critical-bug list.
RD-F-172 green Repo shows AI-tool co-authorship in critical files No evidence of GitHub Copilot or AI tool co-authorship metadata (co-authored-by trailers) in Maple's commit history from public searches. Active contributors do not show AI co-authorship patterns.
RD-F-173 green Team self-disclosure of AI-generated Solidity No public disclosure found of AI-generated Solidity in security-critical paths. Maple's security blog emphasizes formal SDL, audits, and invariant testing with no mention of AI-generated production code.
RD-F-174 green Dependency tree uses EOL Solidity version All deployed contracts use Solidity 0.8.7–0.8.25. Solidity 0.8.x is the actively supported branch. No contracts on EOL versions (0.4.x, 0.5.x, 0.6.x).
Response & disclosure hygiene Green 8 4 of 4
RD-F-176 yellow Disclosure SLA public No explicit written SLA for acknowledgment-time published by Maple (e.g., 72h ack commitment). Immunefi platform standard implies some SLA by convention but Maple has not publicly committed to a specific window.
RD-F-175 green Disclosure channel exists Immunefi bug bounty program live since January 25, 2022 (https://immunefi.com/bug-bounty/maple/). Security email security@maple.finance identified on docs page. Two distinct disclosure channels present.
RD-F-177 green Prior known-ignored disclosure No evidence of a disclosed vulnerability that was known and ignored before exploitation. The sole incident (Orthogonal default) was a credit/counterparty event, not a smart-contract vulnerability. No prior-ignored disclosure found in any searched source.
RD-F-178 green CVE/GHSA advisory issued against protocol No CVE or GHSA advisory found for Maple Finance (the DeFi protocol) in GitHub Advisory Database, NIST NVD, or public advisory feeds as of 2026-04-27.
rubric_version v1.7.0 graded_at 2026-05-12 04:38:07 factors 184 protocol maple-finance