# Bypass or reduction on the lockup period of Pool FDTs.

Maple Pool weighted depositDate lets a new LP transfer FDTs to a seasoned LP who withdraws immediately, bypassing the lockup period.

- Payout: Audit contest
- Severity: medium
- Program: Maple Finance
- Disclosed: 2021-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-maple-findings/issues/117
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-maple%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic

**Target:** Pool.sol FDT withdrawal lockup logic
**Root cause:** depositDate is recomputed as a weighted timestamp on FDT transfer, so a large existing deposit dilutes the new holder's lockup, letting freshly minted FDTs be withdrawn after only withdrawCooldown.
**Steps:**
1. Alice deposits, waits `lockupPeriod`, calls `intendToWithdraw` to pass her withdrawal window.
2. Bob deposits fresh liquidity, minting FDTs still under lockup.
3. Bob transfers his FDTs to Alice via `_transfer`.
4. Alice's `depositDate` updates to a weighted timestamp; with her deposit much larger than Bob's, added lockup is near zero.
5. Alice calls `intendToWithdraw`, waits `withdrawCooldown`, withdraws Bob's FDT value and sends liquidity assets to Bob.
**How found:** Code review of the lockup restriction at Pool.sol#396 and the weighted-timestamp `depositDate` update on `_transfer`, reasoning that a large prior deposit dilutes a new holder's lockup.
**Exploitation:** Two colluding LPs: a seasoned LP with a large deposit acts as a withdrawal proxy for a new LP's locked FDTs, extracting liquidity assets after only the cooldown instead of the full lockup period.
**Insight:** When a lockup/vesting timestamp is recomputed as a weighted average on transfer, a large seasoned balance can dilute a fresh deposit's lockup to near zero; check whether transfer recipients inherit lockup correctly.