Maple Finance (Syrup)

Protocol identification — as of October 4, 2026.

• Name: Maple Finance; the on-chain protocol is now branded Syrup, while Maple refers to the institutional lending business/entities. Website: maple.finance. Docs: docs.maple.finance. Category: institutional/private-credit DeFi lending and yield, using permissioned pools and institutional borrowers.
• Launch: operational on Ethereum mainnet on May 12, 2021; its first reported lending pool launched with $17 million on May 19, 2021.
• Chains: Ethereum mainnet is the requested production scope. Maple’s SDK documentation additionally lists Base mainnet and Sepolia testnet; therefore “Ethereum only” is incomplete for the broader deployment footprint.
• Native token: SYRUP is the current governance/utility token; MPL and xMPL lost protocol utility after the migration. Ethereum SYRUP: 0x643C4E15d7d62Ad0aBeC4a9BD4b001aA3Ef52d66; stSYRUP: 0xc7E8b36E0766D9B04c93De68A9D47dD11f260B45.
• Representative Ethereum contracts: syrupUSDC PoolV2 0x80ac24aA929eaF5013f6436cdA2a7ba190f5Cc0b; SyrupRouter 0x134cCaaA4F1e4552eC8aEcb9E4A2360dDcF8df76; syrupUSDT PoolV2 0x356B8d89c1e1239Cbbb9dE4815c39A1474d5BA7D. These are cross-referenced by Maple’s integration documentation and linked Ethereum explorer records.
• Dune/raw on-chain cross-check: Not verifiable as of October 4, 2026. Consequently, the requested >=2-source address validation including Dune is incomplete. Explorer source-code verification status: Not verifiable as of October 4, 2026 from the available fetch; explorer links exist, but verification badges were not independently confirmed. Fork lineage
• No evidence found that Maple Finance is a fork of Compound, Aave, TrueFi, or another upstream lending protocol. Its public repositories are Maple-owned (maple-core, maple-core-v2) and describe a bespoke Pool/PoolManager architecture.
• Accordingly, “changes versus upstream” and “malicious modification history in similar forks” are Not verifiable as of October 4, 2026 / not applicable as a confirmed fork lineage.
• Maple’s own V1/V2 code was audited: Code4rena reviewed the original system in April 2021, and Three Sigma reviewed V2 plus migration contracts in October–November 2022. These are protocol audits, not evidence of fork-delta audits.

Maple looks like a real, functional product rather than a template landing page. Its docs show active user flows for connecting an Ethereum wallet, depositing syrupUSDC/syrupUSDT, monitoring positions, and requesting withdrawals through a FIFO queue, which is consistent with a live app and not just a brochure. The product surface also includes an open developer/API layer: Maple’s docs explicitly point to a production GraphQL endpoint at api.maple.finance/v2/graphql, and the docs expose integration, SDK, and technical-resources pages for querying AUM, APY, loans, and collateral.

The docs also state that the same data shown in the Open Access Details page is available via API. I did not find strong signs of a fake-metric template or a dead portal in the available pages; instead, the docs are fairly detailed and operationally specific, including withdrawal timing caveats and contract-integration steps. Broken-link or template-sign audits are not fully verifiable from the current evidence set, so those items remain Not verifiable as of 2026-10-04.

Bottom line: Maple’s website and docs indicate a mature, working DeFi product with live deposit/withdrawal UX and an exposed public API surface, not merely a marketing landing page.

Maple has an active bug bounty program on Immunefi. It started on 2022-01-25, requires a functional PoC for reward eligibility, and covers Maple’s Ethereum smart-contract/protocol stack including pools, loan managers, withdrawal managers, factories, proxies, and related liquid DeFi strategies; ERC-4626 compliance issues are out of scope. Publicly listed severity scope includes direct theft of user funds, permanent or temporary freezing of funds, MEV, protocol insolvency, theft or freezing of unclaimed yield, unintended permissioning or proxy/upgradeability changes, and unfair liquidations.

The publicly listed reward ceiling for critical smart-contract issues is $500,000, with critical payouts described as 10% of affected funds with a $50,000 floor; payouts may be made in USDC or SYRUP at Maple’s discretion. Publicly reported results were not independently verifiable here, so results remain not verifiable as of 2026-10-04.

Assessment — Ethereum; as of October 6, 2026. On-chain exposure percentages, current borrower concentration, and live pool positions are Not verifiable as of October 6, 2026 because Dune was unavailable; no percentage is inferred. Primary counterparty risk: institutional borrower default, impairment, restructuring, and collateral-liquidation shortfall. Maple states that defaults reduce pool value by unpaid principal/interest, while impairments can distribute expected losses across lenders and withdrawal queues can crystallize losses before recoveries. Custody and collateral administration: exposure can involve third-party custodians, including Anchorage and Zodia. Maple’s Anchorage case study describes custody of Maple treasury assets and tri-party lending infrastructure; its September 14, 2026 announcement adds Zodia segregated-wallet collateral arrangements.

Custodian insolvency, operational failure, fraud, or enforcement/legal delays could impair recovery. Current custodian-by-pool exposure: Not verifiable as of October 6, 2026. Oracle/manipulation risk: Maple relies on Chainlink feeds plus oracle wrappers for liquidation pricing and explicitly assumes prices are accurate and timely. Residual risks include stale/outlier prices, wrapper defects, governance-set manual prices, and liquidation during market gaps. Bridge risk: Ethereum syrup products now have a Maple CCIP receiver and cross-chain deposit/redemption functionality. This creates Chainlink CCIP/message-delivery and cross-chain pause/mint-redeem dependency; Ethereum-native positions avoid bridge risk unless users bridge them. Stablecoin / RWA exposure: syrupUSDC and syrupUSDT are claims on institutional loan pools, not direct USDC/USDT reserves.

Risks include USDC/USDT depeg, redemption-liquidity mismatch, and borrower insolvency. Maple’s cash-management product limits proceeds to U.S. Treasury bills and Treasury-collateralized reverse repos, but still depends on the borrower, custodian, broker, legal structure, and settlement chain. CEX/MM, SPV, LST/restaking exposure: borrower-level CEX/market-maker, issuer/SPV, LST, and restaking concentrations are Not verifiable as of October 6, 2026.

No active dependency failure was identified in the reviewed sources, but absence of a reported incident is not proof of absence.

Maple’s custody is organized around institutional third-party custodians rather than Maple directly holding client crypto. Public materials say BTC for Maple’s BTC Yield product stays in qualified custody with BitGo and Copper, remains in cold storage, and is not wrapped, rehypothecated, or moved into unsecured smart contracts. Maple has also described institutional lending collateral as being held with regulated custodians such as BitGo and, in some arrangements, Zodia Custody.

Independent coverage of Maple’s institutional model also describes tri-party/qualified-custody structures rather than direct platform custody. withdrawal_paused: Not verifiable as of 2026-10-06. segregated_assets: Not verifiable as of 2026-10-06.

Maple (Ethereum) — key-management organization, as of October 4, 2026

• Primary governance layer: Maple uses an on-chain GovernorTimelock, controlled by a DAO multisig rather than a single administrator. The DAO multisig address disclosed by Maple is 0xd6d4…a196, with a 4-of-7 signing threshold. It holds PROPOSER_ROLE and ROLE_ADMIN, allowing it to schedule protocol proposals and manage timelock roles.
• Timelock controls: Governor-authorized changes follow a schedule → delay → execution-window process. The Governor can modify major protocol controls, including treasury settings, approved assets, oracle configuration, fees, pause controls, admin roles, and certain contract upgrades.
• Operational separation: Maple identifies separate privileged roles:
• Operational Admin: routine operational actions with narrower authority than the Governor.
• Security Admin: emergency pause authority across the protocol. A current transparency filing reports an Operational Admin multisig of 3-of-5 and Security Admin multisig of 3-of-6.
• Tokenholder layer: SYRUP holders participate through a forum discussion and Snapshot vote; implementation is performed by the DAO multisig. This is governance coordination, not direct execution by tokenholders.
• Security evolution: In August 2025, Maple stated that it would add a 24-hour timelock for all Governor multisig calls and on-chain actions, following external review concerns about timelock bypass paths. The current public documentation describes timelock functionality, but does not independently establish the live signer set or every currently effective delay. Risk view: The structure reduces single-key risk through role separation, multisig thresholds, and delayed execution. Material residual risks remain: multisig signer collusion or compromise, emergency Security Admin powers, Operational Admin powers, and Governor-controlled upgrades/parameters. Verification gap: On-chain verification of current signer membership, live role assignments, and effective timelock parameters: Not verifiable as of October 4, 2026 (Dune unavailable in this run).

Maple — Ethereum smart-contract/admin risk (as of October 6, 2026). On-chain verification was unavailable in this run; therefore current proxy-admin ownership, decoded admin events, role renunciation, live timelock values, and deployment-specific pause/upgrade permissions are Not verifiable as of October 6, 2026. Registry / key addresses: Governor 0x2eFFf88747EB5a3FF00d4d8d0f0800E306C0426b; DAO multisig 0xd6d4Bcde6c816F17889f1Dd3000aF0261B03a196; Security Admin 0x6b1A78C1943b03086F7Ee53360f9b0672bD60818; Operational Admin 0xCe1cE7c7F436DCc4E28Bc8bf86115514d3DC34E8; Global Admin 0x0D8b2C1F11c5f9cD51de6dB3b256C1e3b0800200; Permissions Admin 0x54b130c704919320E17F4F1Ffa4832A91AB29Dca. syrupUSDC Pool 0x80ac24aA929eaF5013f6436cdA2a7ba190f5Cc0b; PoolManager 0x7aD5fFa5fdF509E30186F4609c2f6269f4B6158F; WithdrawalManager 0x1bc47a0Dd0FdaB96E9eF982fdf1F34DC6207cfE3; Router 0x134cCaaA4F1e4552eC8aEcb9E4A2360dDcF8df76. Architecture: Pool/ERC-4626 → PoolManager → LoanManagers and external strategies (Aave/Sky); WithdrawalManager controls queued liquidity; MapleGlobals centralizes protocol parameters. Factories deploy upgradeable instances. Governor-controlled functions include pause/unpause, oracle/manual pricing, treasury, fee rates, strategy activation/impairment, liquidity caps, borrower/asset allowlists, and upgrades.

The documented Governor Timelock uses proposer/executor/canceller/role-admin roles; documentation states default delay and execution window are at least 1 day, but the live delay is not on-chain-verified here. ``text DAO multisig / roles │ ▼ GovernorTimelock ──► MapleGlobals ──► fees/oracle/pause/allowlists │ └──► upgrade permissions ▼ Pool ──► PoolManager ──► LoanManagers / Aave / Sky strategies │ └──► WithdrawalManager ──► queued LP exits ` Exit risk: Users can request/perform withdrawals without an admin transaction, but immediate full exit is not guaranteed because capital is deployed into loans and liquidity may be queued. A compromised governance multisig or privileged upgrade path could alter implementations, fees, oracle parameters, pause behavior, or strategy logic; this creates severe freeze and potential-loss risk after the applicable timelock. A direct, single-call drain by an ordinary operational admin is not established. Contradiction / limitation: Audit pages report addressed findings, but that does not prove every live deployment is audited. Not verifiable as of October 6, 2026 for deployment-to-audit matching. Assessment: admin_can_drain is conservatively true` at the governance/upgrade-path level because a compromised governance multisig can schedule and execute malicious upgrades without a token-holder vote; timelock delay is the principal mitigation.

No role is treated as renounced without on-chain proof.

Maple’s security framework summary lists a June 2023 audit cycle by Cantina (Spearbit) and Three Sigma for protocol updates, with all identified issues addressed before release. The snippet does not expose per-severity counts. Bytecode-match note: Not verifiable as of 2026-08-30.

Maple Finance Core Smart Contract Audit Report covered the Maple core smart contracts (maple-core) on commit 05ef95f. The report states 1 critical, 1 high, and 0 medium findings, with issue resolution marked as resolved for the reviewed issue set. It explicitly notes that the audit was performed before the v1.0.0 release commit, so it does not by itself prove coverage of deployed Ethereum code unless the deployed bytecode matches the audited commit.

Bytecode-match note: Not verifiable as of 2026-08-30.

New report identified since 2026-09-06.

New report.

New report identified since 2026-09-06.

New report identified since 2026-09-06.

New/corrected published report; separate from previously recorded June-2023 audit.

New report.

New report identified since 2026-09-06.

New report.

New report identified since 2026-09-06.

New report.

New report; publication date corrected from the engagement start date 2023-11-27 to 2023-12-15.

New report.

New report identified since 2026-09-06.

New report.

PeckShield performed a security audit on Maple smart contracts, focusing on lending functionality and risk vectors on Ethereum. Scope included pool and token contracts and key protocol flows. Bytecode match and coverage of all current deployed contracts: Not verifiable as of 2026-09-03.

Maple Finance engaged Quantstamp for an additional smart contract security audit focused on lending pool logic and upgrades on Ethereum. Scope covered core contracts and interactions between pools, borrowers, and liquidity providers. Not verifiable on-chain as of 2026-09-03 whether audited bytecode fully matches current deployments.

Spearbit — 2022-10-17. Scope: Maple V2 December-2022 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Maple’s security page lists a Spearbit audit for the December 2022 release. The snippet confirms the report link and that all relevant issues were addressed prior to V2 launch, but it does not provide critical/high/medium counts in the excerpt. Bytecode-match note: Not verifiable as of 2026-08-30.

Maple’s November 2025 withdrawal manager upgrade was audited by Spearbit and Sherlock. The source says the upgrade underwent these audits, but the snippet does not provide critical/high/medium counts. Fix status is implied as completed prior to release. Bytecode-match note: Not verifiable as of 2026-08-30.

Spearbit via Cantina — 2023-06-05. Scope: June-2023 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Three Sigma — 2022-10-24. Scope: Maple V2 December-2022 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Maple’s security page lists a Three Sigma audit for the December 2022 release. The snippet confirms the report link and that all relevant issues were addressed prior to V2 launch, but it does not provide critical/high/medium counts in the excerpt. Bytecode-match note: Not verifiable as of 2026-08-30.

Three Sigma — 2023-04-10. Scope: June-2023 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Maple’s security page and framework summary list audits for the August/December 2024 releases by Three Sigma and 0xMacro, with all relevant issues addressed before release. The provided excerpts do not include finding counts. Bytecode-match note: Not verifiable as of 2026-08-30.

Maple Finance (core lending protocol and smart contracts on Ethereum) were audited by Trail of Bits in 2021. Report includes security review of protocol architecture and smart contract implementation, including loan pools, debt tokens, staking, and upgrade mechanisms. Not verifiable on-chain as of 2026-09-03 whether this exact audited bytecode matches all currently deployed contracts.

Trail of Bits — 2022-08-24. Scope: Maple V2 December-2022 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Maple’s security page lists a Trail of Bits audit for the December 2022 release. The provided source confirms the audit existed and links the report, but does not expose the finding counts in the snippet. Fix status is stated at the release level as: all relevant issues identified by auditors were addressed prior to launch of V2.

Bytecode-match note: Not verifiable as of 2026-08-30.

Maple Finance is a public, non-anonymous institutional-credit business, founded in 2019 by Sidney (Sid) Powell and Joe Flanagan. Powell is CEO; Flanagan is identified as co-founder and executive chairman in Maple’s current materials. Both founders have identifiable traditional-finance backgrounds rather than pseudonymous crypto identities. Founders and prior experience

• Sidney Powell: Former National Australia Bank securitisation/corporate-finance professional and Treasurer at Angle Finance. Reported experience includes participation in more than $3 billion of corporate-bond issuance and management of a roughly $200 million debt-funding programme.
• Joe Flanagan: Previously associated with PwC Australia, Clover Advisory, Axsesstoday and a family-office investment/operating role. Sources credit him with CFO/company-secretary experience at an ASX-listed commercial-lending fintech and involvement in more than $400 million of debt and equity transactions.
• Maple’s published team identifies additional personnel with backgrounds at institutions including JPMorgan, Bank of America, Deutsche Bank, Amazon, BlackRock, Galaxy Digital and PIMCO; these are primarily self-reported team credentials and should not be treated as independently verified employment records. Reality check
• Credibility: The founders’ finance and credit-market histories are plausible and externally corroborated by multiple independent profiles. This supports a genuine operating business rather than a purely anonymous web front.
• Real-world presence: Independent company-profile data places Maple Finance in Melbourne, Australia, while reporting describes Powell operating from South Beach, Miami. This indicates an international operating footprint, but the precise current legal-entity structure, office occupancy and regulatory domicile are Not verifiable as of October 4, 2026 from the available evidence.
• Onshore/offshore: Not verifiable as of October 4, 2026. The available sources establish Australian origins and a reported Miami base, but do not establish the complete entity, licensing or tax structure.
• Prior adverse outcomes: In December 2022, Orthogonal Trading’s insolvency and approximately $36 million of Maple-associated defaults exposed serious counterparty and underwriting risk. This was a credit event, not a smart-contract exploit.
• Hacks/exploits: Available evidence reports no exploit affecting Maple smart contracts or protocol funds as of June 4, 2026; a 2026 security review nevertheless identified a high-severity share-inflation bug that was found during review, not reported as exploited. Wintermute’s 2022 hack was external and reportedly did not affect Maple depositors. Conclusion: The team is public and institutionally credible, with a real operating history and identifiable corporate footprint. The principal demonstrated weakness is credit, counterparty and disclosure risk, not evidence of an anonymous team or confirmed protocol-fund theft. On-chain verification is unavailable in this run: Not verifiable as of October 4, 2026.

Maple Finance/Syrup has a mixed reputation: credible security work and an active bug bounty coexist with a material legacy credit loss, opaque private-credit exposure, and unresolved questions around governance, disclosures, and legal disputes. On-chain verification was unavailable in this run: Not verifiable as of October 10, 2026.

• Legacy credit failure: In December 2022, Maple issued default notices on approximately $36 million of Orthogonal Trading loans after the borrower’s undisclosed FTX exposure. Independent reporting describes losses of up to roughly 80% for investors in one affected pool. This remains the principal reputational concern because it demonstrated that undercollateralized institutional credit could fail with limited lender recourse.
• Current risk perception: Independent risk commentary continues to flag borrower opacity, impairment/workout risk, withdrawal liquidity, and the difficulty of independently auditing private loan books. Maple’s claim of more than $20 billion in originations and no defaults since 2023 has been reported as a company-supplied figure; no independent loan-tape audit was identified in the reviewed material.
• Security and audits: Maple documents 7+ audits for Maple Core V2 and a Syrup Router audit, while third-party compilations report broader audit coverage involving firms such as Three Sigma, 0xMacro, Spearbit, Sherlock, Trail of Bits, Sigma Prime, and Dedaub. An Immunefi bug bounty is active. Audit coverage reduces smart-contract risk but does not validate credit underwriting, asset quality, or solvency.
• Legal/regulatory: Reporting and independent reviews describe a Cayman Islands dispute involving Core Foundation and syrupBTC, concerning alleged confidentiality/exclusivity breaches and related product rights. Some later reporting says the matter was settled in May 2026 with claims released, while other October 2026 material still describes injunction/arbitration exposure; the procedural status is therefore contradictory and should not be treated as resolved without primary court documentation.
• Fraud, rug, sanctions: No verified source reviewed here established that Maple Finance or its founders committed fraud, operated a rug pull, or were sanctioned. No filed U.S. SEC/CFTC enforcement action was identified in the reviewed legal scan, but this is not a substitute for a comprehensive regulator-database search.
• Founder/investor concerns: Sid Powell and Joe Flanagan remain associated with the project. Reported historical entanglement with Alameda Research—described as both investor and borrower—creates a conflict-of-interest and diligence concern, though it does not by itself establish misconduct. Bottom line: reputational risk is medium-high, driven primarily by historical credit losses and opacity rather than a verified exploit, fraud finding, or sanctions action. Several current claims remain Not verifiable as of October 10, 2026 without primary on-chain, court, or audited loan-book evidence.

As of October 6, 2026. Maple is an institutional credit/lending protocol. Lenders deposit stablecoins or other pool assets and receive ERC-4626 LP/syrup tokens whose value increases from borrower repayments and interest. Yield is primarily borrower interest, with loans underwritten by Maple/Pool Delegates; collateral is loan-specific and may include digital assets.

Default, impairment, liquidation, counterparty and smart-contract risks remain. This is not market-neutral: the credit book is economically directional to borrower solvency and, where crypto collateral is used, crypto-market volatility. Assets/exposure: Core products include syrupUSDC, syrupUSDT, syrupUSDG and Maple Institutional secured lending. External integrations can add leverage, looping, liquidity-provider, Pendle and other DeFi exposure, but these are user/integration strategies rather than necessarily base-pool leverage.

Historic Drips rewards were subsidized SYRUP incentives: Maple reported Season 10 native net APY of 6.78% plus 2.15% Drips, while earlier campaigns advertised materially higher total APY. The current organic/incentive split is Not verifiable as of October 6, 2026. Withdrawals/lock-ups: Queue-based withdrawal managers process requests in submission order and can be liquidity-constrained; impairment withdrawals may crystallize losses and forfeit future recoveries. Product terms differ: the Cash Management Pool states no lock-up and withdrawals within 24 hours on U.S. banking days, while historic Drips boosts used 3- or 6-month commitments.

Current syrup withdrawal timing, gates and limits are Not verifiable as of October 6, 2026. Fees/revenue: Maple documents origination, service and management fees shared between Pool Delegates and Maple Treasury; strategy fees are configurable. DeFiLlama reports $1.44M revenue and $9.62M fees over 30 days; Maple’s transparency page reports $1.47M monthly revenue and $20.65M trailing-12-month revenue. TVL/AUM: DeFiLlama reports $3.057B TVL, all on Ethereum. Maple reports $4.85B AUM: syrupUSDC $2.91B, syrupUSDT $651.45M, syrupUSDG $394.99M, Institutional $895.51M. Contradiction: AUM and TVL differ materially; scope/reconciliation is Not verifiable as of October 6, 2026.

Dune/on-chain verification and TVL trend are Not verifiable as of October 6, 2026. Current APY volatility/history and sustainability are also Not verifiable beyond the cited issuer-reported snapshots.

As of October 6, 2026, Maple’s transparency page reports a Balance Sheet (Treasury) of $39.89M, consisting of 76.46M SYRUP and $4.94M in liquid assets. These are unverified marketing claims: no independent reconciliation or Dune query was available in this run. Contradiction: The September 6, 2026 review recorded $35.80M / 77.57M SYRUP / $4.51M liquid assets, while an earlier page snapshot showed $34.84M / 77.89M / $4.46M. The current page now shows $39.89M / 76.46M / $4.94M.

Maple does not provide a clearly reconciled change log in the retrieved page; the variance is a material data-quality finding. Addresses and control: Publicly documented Ethereum addresses include Maple DAO/Governor 0xd6d4Bcde6c816F17889f1Dd3000aF0261B03a196, Maple Treasury 0xa9466EaBd096449d650D5AEB0dD3dA6F52FD0B19, and Maple Treasury 1 staging wallet 0x6a01C16EB312B80535F4799E4BF7522B715AAcfF. The DAO multisig is reported as 4/7, with proposal scheduling through a GovernorTimelock and a three-day delay. Composition / policy: The SSF is intended to be segregated and used for liquidity initiatives and growth/rewards programs. Later governance proposals describe buybacks, strategic reserves, stablecoin buffers, and restrictions on selling or deploying reserve SYRUP, but these proposals are not independently verified as fully implemented. Custody / attestations: Maple announced Proof of Reserves with The Network Firm for syrupUSDC and syrupUSDT, using custodian feeds and on-chain activity.

The announcement states that reports would be published through a dashboard, but a current report, reserve address reconciliation, and attestation scope for the corporate treasury were not retrieved. On-chain balances via Dune: Not verifiable as of October 6, 2026. Liabilities: Not verifiable as of October 6, 2026; the treasury page does not provide a reconciled liability figure.

As of October 4, 2026; Ethereum. Native token: SYRUP (MPL migration ratio 1:100); contract 0x643C4E15d7d62Ad0aBeC4a9BD4b001aA3Ef52d66. MPL/xMPL no longer have governance or staking utility. Supply and valuation. CoinGecko reports approximately 1.167B circulating, 1.245B total, $301.9M market cap, and $321.9M FDV; Etherscan reports 1.2447B total and approximately 16,040 holders, with materially different price-derived market-cap figures. This is an unresolved data-source contradiction. > Contradiction: Maple documentation projected 1,228,740,800 SYRUP by September 2026, while current aggregator/explorer totals are about 1.245B.

The excess is not attributable here because Dune/on-chain verification is unavailable. Utility/governance. SYRUP and stSYRUP are governance assets; voting is via Snapshot, with staking available through the non-custodial ERC-4626 stSYRUP vault. Staking rewards are described as streamed SYRUP inflation plus buyback-derived value. Value accrual. Maple states that 25% of protocol revenue funds SYRUP buybacks. Repurchased tokens are reportedly retained in the treasury, not burned or redistributed; no dividends are identified. Emissions/unlocks. Disclosed policy included a one-time 100M SYRUP issuance and approximately 5% annual inflation for three years.

DefiLlama displays the mapped allocation as 100% unlocked, but whether every announced unlock/emission occurred on-chain is Not verifiable as of October 4, 2026. Allocations. Reported original categories: public sale 5%, seed/SAFT 30.5%, ecosystem/community 29.5%, foundation/treasury 10%, team 25%. DefiLlama’s remapped view differs materially, so allocation reconciliation is Not verifiable as of October 4, 2026. Control/concentration/liquidity. Mint, blacklist, transfer-fee, and fee-switch permissions—and controlling addresses—are Not verifiable as of October 4, 2026. Top-holder/insider concentration is likewise Not verifiable as of October 4, 2026.

A third-party snapshot reports roughly $3.6M Ethereum DEX liquidity, mainly on Uniswap; Maple’s own site lists Uniswap, Binance, Coinbase, Bitget, Gate.io, KuCoin, Kraken, MEXC, BingX and HTX, which is an unverified marketing/listing claim.

Stress assessment — BTC below $10,000: Maple/Syrup would face a material collateral-value and liquidation stress, but the available evidence does not establish that it would become insolvent. The decisive variables are current BTC collateral share, loan-to-value thresholds, liquidation execution, borrower concentration, and liquidity buffers.

• Maple’s publicly described secured pools accept BTC collateral, and the protocol states that secured loans were overcollateralized above 150% on average. This is a protocol-source claim and therefore an unverified marketing claim.
• Maple reported that approximately 84% of its collateral was BTC during the October 2025 volatility event, with collateralization above 150%. Applying a BTC fall from roughly $100,000 to below $10,000 would reduce BTC collateral value by about 90%; a 150% collateral buffer would be economically exhausted well before that price level unless borrowers add collateral or positions are liquidated. This is scenario analysis, not a forecast.
• A third-party risk report dated June 2026 reported 61.5% BTC collateral and 173.9% aggregate collateralization, but this is stale relative to the requested October 10, 2026 state and its coverage of Maple/Syrup could not be independently confirmed from the available results.
• Maple’s 2026 custody expansion explicitly accepts Bitcoin, wrapped Bitcoin, Ether, and Solana as collateral, increasing the relevance of BTC-market stress to the credit book.
• Syrup holders appear exposed primarily through pool NAV and credit losses rather than through a protocol-wide guarantee. A reported analysis states that lender losses from default reduce the lending pool’s NAV and are not backstopped by SYRUP holders or the treasury; this remains an independent analytical claim, not on-chain verification. > Verification gap: On-chain BTC exposure, pool-level collateralization, borrower concentration, liquidation thresholds, current Ethereum TVL, and chain allocation are Not verifiable as of October 10, 2026. Dune was unavailable, so no on-chain query ID, execution ID, latest block height, or timestamp can be supplied. Risk conclusion: A BTC price below $10,000 would be a severe tail event for BTC-heavy Maple credit pools. The principal risks are rapid undercollateralization, liquidation slippage, custody/enforcement delays, borrower defaults, and syrupUSDC NAV impairment. Claims that collateral remains sufficient under this scenario are not supported by the available evidence.

Stress scenario — largest collateral depegs 20% (Ethereum): The scenario is not fully quantifiable from the available evidence. On-chain collateral balances, the largest collateral asset, concentration, and current Ethereum exposure are Not verifiable as of October 10, 2026 because on-chain verification was unavailable in this run. Therefore, no reliable protocol-wide loss, liquidation, or TVL-impact estimate should be assigned.

Available risk disclosures indicate that Syrup’s yield-bearing assets are backed by a dynamic pool of loans and other yield-generating strategies, with loans described as overcollateralized and subject to margin calls and liquidation procedures. The disclosures also identify underlying stablecoins—USDC, USDT, and USDG—as exposed to issuer, redemption, regulatory, and depegging risk. A 20% depeg of the largest collateral asset would therefore reduce collateral value by approximately 20% for the affected positions, but the resulting collateralization ratio, liquidation volume, bad-debt risk, and lender loss depend on asset concentration, loan-level thresholds, borrower top-ups, liquidation liquidity, and recovery prices; these inputs are not independently verified here.

The most relevant available evidence is Maple’s September 2026 risk disclosure, which is a protocol-origin source and therefore does not independently verify collateral composition. The search results also contain third-party figures for Syrup pool sizes and collateral composition, but they are not sufficient to establish Ethereum-only exposure or the largest collateral asset and should not be treated as on-chain verified. Assessment: a 20% depeg of the largest collateral is a material liquidation and liquidity stress, particularly if the asset is a stablecoin or concentrated across borrowers. The magnitude of principal impairment is Not verifiable as of October 10, 2026.

No contradiction with an independently verified on-chain figure can be established in this run.

## Maple — stress scenario: top counterparty becomes insolvent Current exposure / counterparty ranking: Not verifiable as of October 4, 2026. Dune/on-chain verification was unavailable in this run, so current pool balances, largest borrower, collateral, cover, and loss percentages are not asserted. Scope is Ethereum only; cross-chain spillover is therefore not assessed. ### Expected loss path 1. Early distress: Maple can call impairLoan, reducing the withdrawal valuation through unrealizedLosses. This is intended to prevent informed lenders from exiting before losses are recognized; later recoveries are allocated pro rata to lenders who remained.

2. Technical default: After the applicable grace period, the Pool Delegate or Governor can call triggerDefault(). The loan’s outstanding principal and accrued interest are removed from pool accounting. 3. Collateralized loan: Collateral is repossessed and liquidated; recovered cash is returned to the pool.

During liquidation, the shortfall is represented as unrealizedLosses. 4. Uncollateralized or residual shortfall: Cover/first-loss capital is liquidated up to the pool’s configured limit. Any remaining loss reduces totalAssets and is borne by LPs through a lower share/redemption value. ### Who absorbs it / compensation

• First: collateral recoveries.
• Second: pool-delegate cover/first-loss capital, if funded and available.
• Last: affected pool LPs; there is no evidence here of a Maple-wide mutualized insurance backstop.
• Recoveries are applied first to protocol fees, then returned to the pool; legal/restructuring recoveries may provide additional compensation. ### Smart-contract containment Each pool has separate Pool, PoolManager, LoanManager, cover, and withdrawal components; the architecture isolates losses at pool level rather than automatically spreading them across pools. The 2022 Orthogonal failure was reported as affecting only the two relevant pools, with estimated hits of roughly 80% and 17% before recoveries. > Contradiction / limitation: Older Maple documentation says Pool Delegate Cover was unused in most Maple Direct pools, while current deployment-specific cover status cannot be confirmed without on-chain data. Not verifiable as of October 4, 2026.

Assessment as of October 4, 2026: I found no verifiable evidence that Maple’s DAO, owners, or controlling entities have been adjudicated to have committed fraud. The strongest relevant case was a commercial dispute with Core Foundation—not a fraud judgment. Core alleged misuse of confidential information and breach of a 24-month exclusivity arrangement concerning a Bitcoin yield product; a Cayman court granted an injunction after finding a serious issue to be tried, while Maple denied wrongdoing.

On May 22, 2026, the parties announced a full and final settlement: claims and counterclaims were mutually released, proceedings were discontinued, and the settlement expressly made no admission of liability or wrongdoing.

Finding — stress scenario: primary yield source negative over 30 days (Maple, Ethereum): not triggered by available evidence. The latest available Maple Institutional product result reports 5.4% Last 30d APY, up from the previously recorded 5.2%; this is positive, not negative. Maple’s stated core yield source is institutional borrower interest from secured, overcollateralized lending, while newer allocation strategies are described as diversification around that core. A negative 30-day lender APY, or a verified loss offsetting accrued borrower interest, is Not verifiable as of 2026-10-04.

• Stress interpretation: If the primary lending yield became negative, it would imply borrower-interest income was insufficient to cover realized credit losses, liquidation shortfalls, fees, expenses, or other portfolio-level deductions. This is a scenario assumption, not an observed Maple result.
• Current signal: The available product data instead shows a positive 30-day net APY of 5.4%.
• Scope limitation: Ethereum-only on-chain verification, pool-level cash-flow attribution, realized losses, and chain-level exposure percentages are Not verifiable as of 2026-10-04 because on-chain queries were unavailable. No Dune query ID or execution ID can therefore be provided.
• Data-quality note: The 5.4% figure is from Maple’s own product page and is consequently an unverified marketing claim absent independent raw on-chain confirmation. The September 2026 Maple material also states that overcollateralized digital-asset lending remains the backbone of yield and that new strategies diversify yield sources. Contradiction check: No contradiction was identified between the previously recorded 5.2% 30-day APY and the current 5.4% result; the value increased. The negative-yield stress premise remains unconfirmed, rather than disproven by independent on-chain evidence.

Assessment — Maple Finance / Syrup, Ethereum; reviewed October 13, 2026. Governance is DAO-symbolic rather than autonomous. SYRUP and stSYRUP are the sole stated governance tokens; MPL has no governance rights. The documented process is forum discussion → Snapshot vote → implementation, but execution is controlled by the GovernorTimelock and designated administrators. Control surface. The GovernorTimelock governs MapleTreasury, global parameters, allowlists, pause controls, operational/security-admin assignments, pool and strategy permissions, and upgrades to Globals, Liquidator, and Withdrawal Manager.

It also manages proposer, executor, canceller, and role-administration functions. A Security Admin can emergency-pause the protocol; operational admins control a narrower operational subset. Timelock / multisig. Previously recorded evidence remains 72 hours and a 4-of-7 multisig. Current public documentation confirms the timelock and multisig-controlled Governor, but does not expose current signer identities or independence.

Voting concentration and top SYRUP/stSYRUP holders: Not verifiable as of October 13, 2026 (Dune unavailable in this run). Current signer identities, threshold, and owner count are likewise not independently re-verified on-chain in this run; the prior 4-of-7 record is retained pending on-chain refresh. Funds risk. The Governor’s treasury, role, upgrade, and configuration powers mean the administrative control plane can redirect or impair protocol-controlled assets without a fresh token-holder vote; therefore admin_can_drain=true under the requested definition. Emergency pause is a bypass for incident response, not an autonomous withdrawal mechanism. Company/frontend. The interface is operated under Maple Labs Pty Ltd, an Australian private company, ABN 34 635 342 880, ACN 635 342 880, active from August 9, 2019, with main business location Victoria 3002.

Directors: Not verifiable as of October 13, 2026. The interface Terms use Florida law and AAA arbitration. Contradiction callout: Protocol documentation describes token-holder governance, but implementation authority remains multisig/admin-controlled; this is the material governance gap.

Assessment as of October 4, 2026. Maple’s identifiable operating entity is Maple Labs Pty Ltd, an active Australian private company registered in Victoria (ABN 34 635 342 880). A separate product structure, Maple International Operations SPC, is an active Cayman Islands segregated portfolio company; Cayman SPC portfolios provide asset/liability segregation but are not separate legal entities. Terms and restrictions. The interface terms are with Maple Labs Pty Ltd, apply to users aged 18+, select Florida law, require individual AAA arbitration, waive class actions/jury trial, limit claims to one year, and contain broad “as-is,” liability, indemnity, and blockchain-risk disclaimers. For U.S. users, the terms state that certain LP-token offerings rely on Regulation D and Investment Company Act §3(c)(1), with accredited-investor and transfer restrictions.

This is a contractual disclosure, not an independent regulatory classification. KYC/AML and classification. Institutional lending products are permissioned: onboarding requires KYC, accredited-investor verification where applicable, AML screening, wallet allowlisting, and documentation; Maple states that TRM Labs is used for wallet-risk screening. The legal/regulatory classification of the overall Maple protocol, SYRUP token, or every product across jurisdictions is Not verifiable as of October 4, 2026. Privacy/data protection. Maple’s policy identifies collection of IP/device, wallet, usage, and on-chain information; permits disclosure to affiliates, service providers, and authorities; and describes EEA/UK access, correction, deletion, restriction, objection, and portability rights. It warns that blockchain data is public, immutable, and may be correlated with identity.

Coverage is interface-focused; third-party protocols, DAOs, wallets, and blockchain infrastructure may have separate policies. Warnings, enforcement, and litigation. I found no protocol/entity-specific regulator enforcement action or sanctions designation. The Cayman dispute Core Foundation v Maple International Operations SPC involved an ex parte commercial injunction in 2025, not regulatory enforcement; the parties announced a confidential full-and-final settlement and discontinuance on May 22, 2026, without admission of liability. Sanctions status: Not verifiable as of October 4, 2026 beyond the absence of an identified designation in reviewed sources. Risk conclusion. The corporate wrapper is identifiable, but legal exposure remains product- and jurisdiction-specific: contractual arbitration/class-action waivers, Cayman SPC/portfolio structures, securities-law reliance for some U.S. offerings, DAO/affiliate involvement, and immutable on-chain activity can leave users with materially less recourse than the operating-company identification suggests.

No exact GLEIF LEI record for 'Maple Labs Pty Ltd', 'Maple Finance (Syrup)'. OFAC SDN screening of 'Maple Labs Pty Ltd', 'Maple Finance (Syrup)': no match. SEC litigation and administrative release feeds: no mention.

Maple does not appear to issue a protocol-native stablecoin on Ethereum; its relevant user-facing assets are syrupUSDC and syrupUSDT, which Maple’s own disclosures say are not stablecoins and are tokenized representations of deposits into Maple-managed pools. The available web evidence does not verify any depeg event for the stablecoin exposure used by Maple, so depeg_count, max_depeg_pct, and last_depeg_date are not verifiable as of 2026-10-06. On that basis, stable is not verifiable as of 2026-10-06.

Maple’s dominant risks remain credit loss from institutional borrowers, liquidity mismatch during withdrawals, smart-contract and upgrade failure, oracle/liquidation errors, and governance or operator concentration. Documented controls reduce these exposures but do not eliminate tail losses, especially during correlated market stress. Current Ethereum exposure, concentration, defaults, and liquidity are Not verifiable as of October 5, 2026 because Dune/on-chain verification is unavailable and available documentation is stale data (>7 days old).

Maple’s strongest points appear to be: institutional-grade credit underwriting, onchain transparency, strong risk management, DeFi composability/access to yield products, and compliance-oriented institutional service. The evidence aligns across Maple’s own materials and independent coverage: it emphasizes in-house underwriting, KYC/AML and due diligence, real-time loan monitoring, transparent loan/collateral visibility, and products designed for institutional borrowers and allocators. Independent writeups also describe Maple as bridging traditional credit and DeFi by bringing credit-assessment discipline to onchain lending.

If you need a risk memo, the key takeaway is that Maple’s moat is less about retail scale and more about structured, institution-facing credit infrastructure.