# Processes refinance operations may call malicious code by re-created refinancer contract

Borrower can selfdestruct and CREATE2-redeploy a refinancer contract at the same address with malicious code before the lender's acceptNewTerms delegatecall executes it.

- Payout: Audit contest
- Severity: medium
- Program: Maple Finance
- Found by: rayn
- Disclosed: 2022-04-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-03-maple#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-maple%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:access-control vuln:business-logic

**Target:** MapleLoanInternals._acceptNewTerms refinancer delegatecall
**Root cause:** _acceptNewTerms delegatecalls a borrower-specified refinancer address without pinning/whitelisting its bytecode, so the code at that address can change between proposal and acceptance.
**Steps:**
1. Borrower deploys a benign refinancer contract (with hidden malicious constructor in inherited contracts) and calls `proposeNewTerms` specifying it.
2. Borrower monitors the mempool for the lender's `acceptNewTerms` call.
3. Borrower front-runs: calls `selfdestruct` on the refinancer contract.
4. Borrower uses CREATE2 to redeploy a malicious contract at the same address.
5. Lender's `acceptNewTerms` executes, delegatecalling the malicious code.
**How found:** Noticed _acceptNewTerms uses delegatecall to a borrower-supplied refinancer address and reasoned that address code is not immutable, enabling a selfdestruct+CREATE2 swap between proposal and acceptance.
**Exploitation:** Attacker front-runs the lender's acceptNewTerms transaction by destroying the vetted refinancer and redeploying malicious code at the identical address via CREATE2, so the lender's delegatecall runs attacker code with the loan's context.
**Insight:** Any delegatecall to an address chosen by a counterparty is unsafe unless the code hash is committed at proposal time; check for selfdestruct/CREATE2 redeploy windows between propose and accept.