# makePayment() Lack of access control allows malicious lender to retrieve a large portion of the funds earlier, making the borrower suffer fund loss

MapleLoan.makePayment() lacked caller restriction, letting a malicious lender repay the loan from drawable funds and reclaim most principal, leaving borrower owing interest on unused funds.

- Payout: Audit contest
- Severity: high
- Program: Maple Finance
- Found by: WatchPug
- Disclosed: 2022-01-05
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-maple-findings/issues/56
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-maple%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** MapleLoan.sol smart contract (makePayment)
**Root cause:** makePayment() has no access control and repays using _drawableFunds, so any caller (including the lender) can trigger repayment and shift funds to _claimableFunds before the borrower draws them.
**Steps:**
1. Borrower calls postCollateral() with 1 BTC collateral
2. Lender calls fundLoan() with 12,000 USDC
3. Lender calls makePayment() 11 times, moving funds from _drawableFunds to _claimableFunds
4. State becomes _drawableFunds=96, _claimableFunds=11903, _principal=1553
5. Lender calls _claimFunds() to withdraw 11,903 USDC
**How found:** Code review of makePayment() noticing missing msg.sender check combined with repayment drawing from _drawableFunds, then modeling the fund flow after fundLoan().
**Exploitation:** Lender funds the loan then immediately calls makePayment() repeatedly with amount_=0, repaying from _drawableFunds and pushing principal into _claimableFunds, then withdraws via _claimFunds(), recovering ~11,903 of 12,000 USDC while borrower still owes 1,579 USDC interest against only 96 USDC drawable.
**Insight:** In lending contracts, check whether repayment/settlement functions are callable by the counterparty and whether they draw from not-yet-disbursed funds; a lender repaying early can convert drawable principal into claimable balance before the borrower draws.