Maple

Identification (as of September 4, 2026). Name: Maple Finance (currently also branded Syrup). Website: maple.finance. Docs: docs.maple.finance.

Category: institutional/private-credit DeFi lending and yield. Operational launch: May 12, 2021 on Ethereum mainnet; a contemporaneous report describes the first $17m pool launch on May 19, 2021. Scope chain: Ethereum mainnet; current SDK documentation also lists Base L2 and Sepolia, so “Ethereum only” is incomplete for the broader deployment footprint.

Native token. Original governance token: MPL. Following MIP-009/010/011, MPL conversion to SYRUP ended May 21, 2025; SYRUP and stSYRUP are now the sole governance tokens. Ethereum addresses: SYRUP 0x643C4E15d7d62Ad0aBeC4a9BD4b001aA3Ef52d66; stSYRUP 0xc7E8b36E0766D9B04c93De68A9D47dD11f260B45.

Both are documented by Maple and present on Etherscan; SYRUP source is verified as a proxy and stSYRUP source is verified. Main Ethereum contracts. Maple’s integration documentation lists syrupUSDC PoolV2 0x80ac24aA929eaF5013f6436cdA2a7ba190f5Cc0b, SyrupRouter 0x134cCaaA4F1e4552eC8aEcb9E4A2360dDcF8df76, and WithdrawalManagerQueue 0x1bc47a0Dd0FdaB96E9eF982fdf1F34DC6207cfE3. Required two-source cross-check including Dune is unavailable: Not verifiable as of September 4, 2026.

Explorer verification status for these three contracts: Not verifiable as of September 4, 2026. Fork lineage. No evidence found that Maple is a fork of another DeFi protocol; Maple’s repositories describe an original Maple Core/V2 codebase. Therefore upstream changes are N/A; audit status for “fork modifications” is Not verifiable as of September 4, 2026. Maple V2 and later releases have independent audits, including Trail of Bits, Spearbit, Three Sigma, Cantina, 0xMacro and others.

Malicious-modification history in comparable Maple forks: Not verifiable as of September 4, 2026.

Maple appears to have a real, functional product rather than only a marketing landing page: the main site presents as an onchain asset-management platform, and the docs site exposes developer-oriented pages including an integration/get-started flow and a dynamic documentation endpoint for queries. The available pages also describe live user actions such as connecting an Ethereum wallet, depositing USDC/USDT, monitoring positions, and requesting withdrawals through a queue, which is consistent with an operational app rather than a static brochure. There is also evidence of an API/developer surface via documentation pages that explicitly reference production and staging API base URLs, plus an integration docs section.

I could not verify broken links, fake metrics, or template-site signs from the material gathered, so those remain Not verifiable as of 2026-09-04. I also could not independently confirm live deposit/withdrawal execution from chain data in this turn, so that is Not verifiable as of 2026-09-04. Overall, Maple’s web presence looks mature: live product pages, documentation, and a developer API surface are present, with no obvious sign from the gathered sources that it is only a landing page.

Maple has an active bug bounty program run on Immunefi. It is live since 25 January 2022, requires a PoC for all severities, and covers smart contract and related in-scope protocol components on Ethereum. The program pays in USD-denominated rewards, with payouts made in USDC or SYRUP at the team’s discretion.

Publicly listed impact scope includes direct theft of user funds, permanent or temporary freezing of funds, MEV, protocol insolvency, theft/freeze of unclaimed yield, unintended permissioning or proxy/upgradeability changes, and unfair liquidations. Reported reward structure includes a minimum of $50,000 and maximum of $500,000 for critical smart-contract vulnerabilities, with critical rewards also capped at 10% of funds directly affected/economic damage. Publicly visible results on the bounty page do not list specific awarded findings or payouts, so bounty outcome counts are not verifiable here.

Assessment — Ethereum; as of September 6, 2026. On-chain exposure percentages and current positions are Not verifiable as of September 6, 2026 because Dune was unavailable; no exposure percentage is inferred.

• Primary counterparty risk: institutional borrower default, impairment, restructuring, and collateral-liquidation shortfall. Maple’s own documentation confirms permissioned borrowers, fixed/overcollateralized lending, and pool-level impairment/default mechanisms; legal recovery and withdrawal queues can delay or reduce lender proceeds.
• Custody / collateral administration: collateral may be held with Anchorage, BitGo, or Zodia. Custodian insolvency, fraud, operational failure, lien/perfection problems, or inability to liquidate collateral are material external risks. Maple states that each pool/loan uses segregated legal structures; syrupUSDC uses a segregated SPV.
• Oracles and governance: Ethereum pools use Chainlink price feeds plus Maple oracle wrappers. A stale, unavailable, misconfigured, or manipulated feed could delay or distort margin calls/liquidations. The Governor can set price oracles, valid collateral, liquidation parameters, and pause/upgrade-related controls, creating privileged-administrator dependency.
• Bridges / external DeFi: syrupUSDC and syrupUSDT use Chainlink CCIP for cross-chain deposits/redemptions; a CCIP, receiver, or remote-chain failure could interrupt transfers or redemptions. Maple reported exiting Aave V3 and Mantle exposure after an April 18, 2026 exploit and stated it had no active DeFi lending positions thereafter; this is a protocol self-report / unverified marketing claim, not an on-chain verification.
• Stablecoin/RWA exposure: syrupUSDC/syrupUSDT create dependence on USDC/USDT, borrower repayment, redemption liquidity, and SPV/legal enforceability. Cash-management strategies are permitted to invest in U.S. Treasury bills and fully collateralized reverse repos. Maple also states collateral may be liquid-staked or natively staked, but current LST/restaking exposure is Not verifiable as of September 6, 2026. Contradiction / gap: Maple’s reported “no active DeFi lending positions” cannot be reconciled with raw Ethereum balances here; the on-chain figure is Not verifiable as of September 6, 2026. Stress scenarios: borrower default plus collateral gap; USDC/USDT depeg; custodian/SPV insolvency; oracle or CCIP outage; administrator compromise; redemption queue run; correlated collateral liquidation. Structured fields: dependency_failure_active: null; max_exposure_pct: null.

Maple’s custody is organized around institutional third-party custodians rather than Maple directly holding client crypto. For its BTC Yield product, Maple says BTC remains in qualified custody with BitGo and Copper, is never wrapped, rehypothecated, or moved into unsecured smart contracts, and is kept in cold storage throughout the process. Maple has also described related institutional structures where collateral stays with custodians such as Zodia Custody, and public materials describe the use of separate operational entities for some cash-management arrangements.

I could not verify any protocol-wide withdrawal pause from the available sources, and segregated-assets status is not verifiable as of 2026-09-06; some materials describe segregated custody vaults for BTC Yield, but there is no confirmed protocol-wide statement covering all Maple products.

On July 9, 2022, Babel Finance defaulted on a $10 million USDC loan in Orthogonal Credit’s Maple pool after liquidity problems and alleged covenant misrepresentation. Affected: lenders in the Orthogonal USDC pool; the loss was isolated to that pool. Pool Cover/first-loss capital was liquidated, leaving approximately $7.852 million of lender loss (about a 3.2% pool haircut).

Maple/Orthogonal pursued off-chain recovery, with any recoveries intended for affected lenders. Full reimbursement was not confirmed. Fix: Maple later replaced the legacy Pool Cover model with first-loss capital, stronger default/impairment controls, and more conservative secured lending.

Current status: unresolved for the unrecovered credit loss; operational remediation completed. No attacker proceeds—this was a borrower credit default.

July 10, 2022: Babel Finance’s $10M USDC loan in Orthogonal Credit’s Maple pool was liquidated after Babel’s liquidity failure and covenant/representation breach. Affected lenders in the Orthogonal USDC pool. Pool Cover was liquidated; $7,852,146 was allocated as lender loss, approximately 3.2% of the pool.

Orthogonal/Maple pursued off-chain recovery for lenders. No verified subsequent recovery or full reimbursement. Maple later replaced the legacy Pool Cover model with first-loss capital, stronger impairment/default controls, and more conservative underwriting.

On-chain verification: Not verifiable as of September 6, 2026.

November 13–December 20, 2022: Auros Global missed scheduled payments, including a reported approximately $3M payment, after FTX-related liquidity stress. M11 impaired the Auros exposure in its Maple USDC and wETH pools, affecting their liquidity providers. On February 15, 2023, 55% of outstanding debt was repaid and the balance was restructured into term facilities; Maple/M11 reported a path to 100% repayment.

No realized lender loss is currently evidenced, but final repayment and user reimbursement are not independently verifiable. Response included pool impairment, restructuring, and enhanced underwriting/real-time monitoring. On-chain verification: Not verifiable as of September 6, 2026.

December 5, 2022: Orthogonal Trading defaulted across eight M11 Credit loans after allegedly misrepresenting its financial condition and revealing substantial FTX exposure. Affected lenders in M11’s USDC and wETH pools; headline default exposure was approximately $31M USDC plus $5M wETH. Maple severed ties, removed Orthogonal’s borrowing/delegate rights, restricted affected pools, liquidated first-loss resources, and allocated cover/fees to lenders.

Maple publicly estimated at least $2.5M of mitigation; later recovery actions included insolvency proceedings. Approximate residual loss is therefore $33.5M before any later unverified recoveries. Users were not made whole.

Replacement controls included first-loss capital, enhanced credit underwriting, monitoring, and formal impairment/default procedures. On-chain verification: Not verifiable as of September 6, 2026.

In early December 2022, and on-chain on December 13, Orthogonal Trading defaulted on eight Maple loans totaling approximately $36 million: about $31 million in M11’s USDC pool and $5 million in its wETH pool. Cause: FTX contagion and alleged misrepresentation of FTX exposure. Affected: lenders in the two M11 pools; other Maple pools were not directly affected.

Maple severed ties with Orthogonal, removed it as borrower/delegate, shut its pools to new activity, liquidated first-loss capital, and distributed MPL-related cover proceeds to affected lenders. Maple estimated at least $2.5 million of mitigation from pool cover and accrued fees; additional recovery was pursued through Kroll liquidators and legal processes. Exact final recovered amount and full reimbursement are Not verifiable as of September 5, 2026.

Current status: remediation_in_progress; the lender shortfall remains unresolved. Gross default is not equivalent to confirmed realized loss, so loss_usd is not verifiable.

A second documented credit event was the Auros Global missed payment / distress in late 2022, described in contemporaneous coverage as a $3 million missed payment that contributed to a broader $54 million sour-debt episode across Maple pools; the pool cover had been largely depleted, and the event was handled through restructuring rather than a code fix.

April 18, 2026: The rsETH verifier exploit caused an external DeFi incident. Maple reported no direct rsETH collateral exposure, but indirect exposure existed through capital deployed to Aave V3 on Ethereum and an isolated Mantle market. Maple stated it exited Aave promptly and unwound Mantle within 24 hours; syrupUSDC and syrupUSDT redemptions reportedly continued without interruption.

No realized Maple or user loss was reported and no reimbursement was required. This is a protocol-reported account and is an unverified marketing claim; on-chain verification: Not verifiable as of September 6, 2026.

Key-management organization (Ethereum) Maple uses layered, role-based control rather than one universal admin key:

• Governor / DAO multisig: The GovernorTimelock is the primary protocol administrator. Public disclosures identify the Maple DAO Safe as 4-of-7 (0xd6d4...a196). It holds proposal-scheduling authority and controls high-impact settings such as treasury, approved assets, admin-role membership, oracle configuration, fees, contract deployment permissions, and protocol parameters.
• Timelock: Governor actions are intended to follow a schedule → delay → execution-window process. This provides monitoring and exit time, but it does not eliminate governance-key risk.
• Operational Admin: A separate 3-of-5 Safe (0xCe1c...34E8) executes routine operational functions, including activating pool managers, adding borrowers/pool managers, setting certain fees, and other limited actions. This role is less powerful than the Governor but operates partly outside the main timelock path.
• Security Admin: A 3-of-6 Safe (0x6b1A...0818) can trigger emergency pauses and, according to external governance risk assessments, cancel eligible timelocked proposals. This is an incident-response control, not a general treasury key.
• Pool Delegates: Each pool has a designated operational actor able to configure pool parameters, manage strategies, and administer loans. This introduces pool-level human/organizational trust independent of the global multisigs. Risk assessment: The model reduces single-key compromise risk through threshold signatures and separation of duties. However, Maple explicitly treats the Governor and Operational Admin as trusted actors. The Governor multisig has broad authority over upgrade/configuration paths, while the Operational Admin and Pool Delegates retain meaningful operational power. Signer identities, key-storage procedures, geographic separation, rotation policy, and disaster-recovery arrangements are not publicly verifiable from the sources reviewed: Not verifiable as of September 4, 2026. > Contradiction: Maple deployment documentation describes default timelock parameters of a one-week delay and two-day execution window, while a recent transparency filing reports a three-day delay. The live configured delay is Not verifiable as of September 4, 2026 because Dune/on-chain verification was unavailable.

Maple / Ethereum — Smart Contract & Admin Risk (as of September 6, 2026) Addresses. Current registry matches the prior September 4 finding: Governor 0x2eFFf88747EB5a3FF00d4d8d0f0800E306C0426b; DAO multisig 0xd6d4Bcde6c816F17889f1Dd3000aF0261B03a196; Security Admin 0x6b1A78C1943b03086F7Ee53360f9b0672bD60818; Operational Admin 0xCe1cE7c7F436DCc4E28Bc8bf86115514d3DC34E8; Global Admin 0x0D8b2C1F11c5f9cD51de6dB3b256C1e3b0800200; Permissions Admin 0x54b130c704919320E17F4F1Ffa4832A91AB29Dca. syrupUSDC: Pool 0x80ac24aA929eaF5013f6436cdA2a7ba190f5Cc0b; PoolManager 0x7aD5fFa5fdF509E30186F4609c2f6269f4B6158F; WithdrawalManager 0x1bc47a0Dd0FdaB96E9eF982fdf1F34DC6207cfE3; Router 0x134cCaaA4F1e4552eC8aEcb9E4A2360dDcF8df76. Architecture. GovernorTimelock → MapleGlobals / factories / upgrade paths → PoolManager → Pool + LoanManagers + WithdrawalManager + external strategies. Pools are ERC-4626-like user-facing contracts; PoolManager holds most administration. Factories deploy upgradeable proxies. Authority. Governor-controlled functions include protocol/contract pause, oracle and manual-price changes, treasury and fee changes, borrower/asset/deployer allowlists, strategy activation/deactivation, liquidity caps, withdrawal-manager assignment, and loan impairment/default actions.

Governor can upgrade Globals, Liquidator and Withdrawal Manager. Timelock / roles. Documentation specifies PROPOSER_ROLE, EXECUTOR_ROLE, CANCELLER_ROLE, ROLE_ADMIN, and a separate token withdrawer. Minimum default delay is 1 day; deployment documentation specifies a 1-week delay and 2-day execution window. Role updates cannot be unscheduled.

Exact live delay, proxy-admin contract/type, signer threshold, and renunciation status are Not verifiable as of September 6, 2026 because Dune/on-chain verification is unavailable. Exit and failure mode. Users can technically withdraw through the Pool/WithdrawalManager, but liquidity may be unavailable because capital is deployed in loans; admin-controlled pauses, oracle overrides, impairment/default actions, strategy changes, or upgrades can freeze, delay, dilute, or materially impair exits. A compromised effective governance key could redirect parameters, approve malicious implementations/factories, alter fees/oracles, pause withdrawals, or create insolvency pathways. Direct unrestricted admin draining is Not verifiable as of September 6, 2026. Risk view. Centralized, upgradeable, multi-role governance creates meaningful freeze, oracle, upgrade, and key-compromise risk despite extensive release audits and documented timelocks. Diagram: DAO multisig → GovernorTimelock → Globals/factories → PoolManager → Pool ↔ WithdrawalManager; PoolManager → LoanManagers/Strategies → assets

Maple’s security framework summary lists a June 2023 audit cycle by Cantina (Spearbit) and Three Sigma for protocol updates, with all identified issues addressed before release. The snippet does not expose per-severity counts. Bytecode-match note: Not verifiable as of 2026-08-30.

Maple Finance Core Smart Contract Audit Report covered the Maple core smart contracts (maple-core) on commit 05ef95f. The report states 1 critical, 1 high, and 0 medium findings, with issue resolution marked as resolved for the reviewed issue set. It explicitly notes that the audit was performed before the v1.0.0 release commit, so it does not by itself prove coverage of deployed Ethereum code unless the deployed bytecode matches the audited commit.

Bytecode-match note: Not verifiable as of 2026-08-30.

New report.

New/corrected published report; separate from previously recorded June-2023 audit.

New report.

New report.

New report.

New report; publication date corrected from the engagement start date 2023-11-27 to 2023-12-15.

New report.

New report.

PeckShield performed a security audit on Maple smart contracts, focusing on lending functionality and risk vectors on Ethereum. Scope included pool and token contracts and key protocol flows. Bytecode match and coverage of all current deployed contracts: Not verifiable as of 2026-09-03.

Maple Finance engaged Quantstamp for an additional smart contract security audit focused on lending pool logic and upgrades on Ethereum. Scope covered core contracts and interactions between pools, borrowers, and liquidity providers. Not verifiable on-chain as of 2026-09-03 whether audited bytecode fully matches current deployments.

Spearbit — 2022-10-17. Scope: Maple V2 December-2022 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Maple’s security page lists a Spearbit audit for the December 2022 release. The snippet confirms the report link and that all relevant issues were addressed prior to V2 launch, but it does not provide critical/high/medium counts in the excerpt. Bytecode-match note: Not verifiable as of 2026-08-30.

Maple’s November 2025 withdrawal manager upgrade was audited by Spearbit and Sherlock. The source says the upgrade underwent these audits, but the snippet does not provide critical/high/medium counts. Fix status is implied as completed prior to release. Bytecode-match note: Not verifiable as of 2026-08-30.

Spearbit via Cantina — 2023-06-05. Scope: June-2023 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Three Sigma — 2022-10-24. Scope: Maple V2 December-2022 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Maple’s security page lists a Three Sigma audit for the December 2022 release. The snippet confirms the report link and that all relevant issues were addressed prior to V2 launch, but it does not provide critical/high/medium counts in the excerpt. Bytecode-match note: Not verifiable as of 2026-08-30.

Three Sigma — 2023-04-10. Scope: June-2023 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Maple’s security page and framework summary list audits for the August/December 2024 releases by Three Sigma and 0xMacro, with all relevant issues addressed before release. The provided excerpts do not include finding counts. Bytecode-match note: Not verifiable as of 2026-08-30.

Maple Finance (core lending protocol and smart contracts on Ethereum) were audited by Trail of Bits in 2021. Report includes security review of protocol architecture and smart contract implementation, including loan pools, debt tokens, staking, and upgrade mechanisms. Not verifiable on-chain as of 2026-09-03 whether this exact audited bytecode matches all currently deployed contracts.

Trail of Bits — 2022-08-24. Scope: Maple V2 December-2022 release. Report: https://github.com/maple-labs/maple-core-v2/tree/main/audits. Deployed-code match: Not verifiable as of 2026-09-05.

Maple’s security page lists a Trail of Bits audit for the December 2022 release. The provided source confirms the audit existed and links the report, but does not expose the finding counts in the snippet. Fix status is stated at the release level as: all relevant issues identified by auditors were addressed prior to launch of V2.

Bytecode-match note: Not verifiable as of 2026-08-30.

Maple is a fully public, non‑anonymous institutional lending and on‑chain asset management business founded in 2019–2020 by Sidney Powell and Joe Flanagan. Founders & leadership

• Sidney Powell – Co‑Founder & CEO. Background in traditional debt capital markets; described as originally from Australia and now running Maple from South Beach (Miami).
• Joe Flanagan – Co‑Founder & Executive Chairman. Co‑founded Maple in 2019 to build institutional‑grade credit infrastructure on‑chain.
• Matt Collum – CTO. ~25 years of experience in fintech/SaaS/enterprise infrastructure.
• Ryan O’Shea – COO. Leads operations and scaling of the company. All are doxxed with full names and LinkedIn‑style bios on the Maple “About” page and in independent transparency filings, indicating a non‑anonymous, institution‑facing team. Team depth & prior experience
• Leadership and broader team have prior roles at J.P. Morgan, Bank of America, Deutsche Bank, BlackRock, PIMCO, Amazon, Galaxy Digital, etc., suggesting material TradFi and tech pedigrees.
• External profiles list multiple department heads (Capital Markets, Product, Design, Engineering, Ops, Solana) and ~40–80 employees, consistent with a mid‑size operating company, not a small dev collective. Corporate reality: office, jurisdiction, structure
• Multiple independent sources identify Maple Finance’s HQ in Melbourne, Victoria, Australia, with a physical office address at 452 Flinders Street.
• An issuer profile and transparency materials describe an Australian dev/labs entity (Maple Labs Pty Ltd / Maple Finance Co) regulated under ASIC, plus Cayman Islands entities for the lending pools/wrappers.
• Separate Canadian documentation shows Maple Digital Financial Solutions registered in British Columbia and supervised by FINTRAC as a Money Services Business for electronic money issuance, with a registered office in Burnaby, BC. Onshore vs offshore; real business vs web front
• Presence of Australian corporate registration, Canadian MSB licensing, and a disclosed HQ address point to a multi‑jurisdiction, predominantly onshore corporate footprint, with offshore (Cayman) entities used for pool structuring.
• Independent company databases, transparency filings, and media profiles (not just Maple’s own site) consistently treat Maple as an operating fintech with staff, governance and physical offices, supporting the view that it is a real business, not merely a web‑front protocol. History of hacks/incidents (founder track record)
• Current searches focus on Maple’s commentary on broader DeFi exploits and risk management; they do not surface a direct smart‑contract hack of Maple itself or prior founder‑linked protocol failures. Not verifiable as of 2026‑09‑04.

Maple Finance has a mixed but generally non-fraud-tainted reputation: it is viewed as a serious institutional undercollateralized lending protocol that suffered major credit events in 2022, which raised structural risk concerns but have not led to public fraud or regulatory-sanctions findings as of 2026. Protocol & founders/investors Independent overviews describe Maple as a leading on-chain institutional credit platform that originated over $500m+ in loans pre-FTX, positioning it as a major player in private credit on Ethereum. These analyses treat Maple as a legitimate, professionally run project; however, detailed founder and investor lists and their track records are Not verifiable as of 2026-09-04 under current constraints. Key reputation events & criticisms Maple’s reputation is dominated by the Orthogonal Trading and broader 2022 credit defaults:

• Orthogonal Trading defaulted on roughly $36m of loans on Maple following losses tied to FTX; Maple publicly alleged Orthogonal had misrepresented its financial position and operated “effectively insolvent,” and severed all business ties.
• Depositors in affected pools faced up to 80% losses, highlighting lender loss severity and reputational damage for Maple’s risk framework.
• Research pieces and protocol overviews explicitly state that the $36m default and 2022 bear-market contagion exposed “critical weaknesses” in Maple’s original undercollateralized lending model, particularly correlated counterparty risk and reliance on off-chain credit assessment. These events drive ongoing criticisms: Maple’s early model is seen as highly pro‑cyclical, vulnerable to opaque borrower behavior, and dependent on delegate due diligence that proved insufficient under stress. Fraud/rug/insolvency allegations (Maple itself) The default and insolvency allegations were directed at Orthogonal Trading, not Maple; Maple is portrayed as the creditor platform reacting to borrower misconduct, removing Orthogonal as borrower and pool delegate. No credible sources allege Maple itself conducted fraud or a rug pull as of the latest reports. Legal / regulatory / sanctions Public reporting focuses on private-credit losses and restructurings; it does not reference enforcement actions, sanctions lists, or court cases specifically against Maple. Those aspects are Not verifiable as of 2026-09-04. Audits / security / bug bounty Specific auditor names, scope, audit dates, and bug bounty details are not present in the retrieved independent coverage and are Not verifiable as of 2026-09-04. Unresolved concerns
• Structural risk of undercollateralized, institution-based lending in crypto remains a central concern; Maple’s 2022 losses are frequently cited as evidence of model vulnerability.
• Lender confidence depends on how effectively Maple 2.0 and later iterations have tightened credit standards, diversification, and transparency—these improvements are discussed in secondary commentary but their full effectiveness is Not verifiable as of 2026-09-04. Overall sentiment: Maple is seen as a serious, innovative credit protocol with material historical credit losses and model-risk concerns, but not as a known fraud or rug, making reputational risk primarily credit‑model and governance rather than malfeasance by protocol operators.

Economic model (as of September 6, 2026): Maple is an institutional lending/credit protocol. Lenders deposit stablecoins (syrupUSDC, syrupUSDT, syrupUSDG) or access Maple Institutional pools; capital is lent to permissioned institutional borrowers against primarily BTC, ETH and other liquid crypto collateral. Yield is borrower interest from short-duration, overcollateralized loans—not token emissions.

The model is economically directional to crypto-credit/default risk, not market-neutral: collateral volatility, borrower default, liquidation and counterparty risks remain. Assets and mechanics: Users receive yield-bearing syrup tokens or pool claims. syrup withdrawals enter a FIFO queue, continue accruing while queued, and are normally processed within 24 hours but may take up to 30 days; secondary-market swaps can provide immediate liquidity but add slippage/market risk. Institutional lending requires KYC and a $100,000 minimum; retail syrup products are advertised as open to non-US users with no minimum. Leverage/external exposure: No protocol-level leverage, looping or restaking was verified for the Ethereum products. Borrower trading/treasury activity creates indirect external exposure.

Leverage ratio: null. Organic yield percentage: null—loan interest is the stated source, but historical Drips/incentives and any embedded subsidies cannot be quantified from the available evidence. Fees/revenue: Borrowers can pay origination, service and management fees; strategy performance fees may also be charged, with allocations to delegates and Maple Treasury. DefiLlama reports approximately $3.01B TVL, $1.83B active loans, $9.17M 30-day fees and $1.18M 30-day revenue; 100% of tracked TVL is attributed to Ethereum, with Solana shown at zero. Contradiction / methodology gap: Maple’s own transparency page reports $4.85B AUM, versus DefiLlama’s ~$3.01B TVL; product AUM is syrupUSDC $2.68B, syrupUSDT $993.43M, syrupUSDG $331.99M and Institutional $845.34M.

The gap likely reflects different inclusion methodologies, but the cause is Not verifiable as of September 6, 2026. Dune on-chain TVL, chain split, product balances, trend, APY volatility and leverage are Not verifiable as of September 6, 2026. Current advertised APYs are roughly 4.8–5.2%; historical evidence shows materially higher periods, including 8.93% average total APY in 2025 and 15.7% net APY in an earlier three-month window, so sustainability is rate- and utilization-dependent.

Assessment — Ethereum; as of September 6, 2026. Reported treasury size and composition. Maple’s transparency page currently renders $35.80m Balance Sheet (Treasury), comprising 77.57m SYRUP and $4.51m liquid assets. A separate same-day page snapshot/search result shows $34.84m, 77.89m SYRUP, and $4.46m liquid assets. This internal inconsistency is a material data-quality finding; both figures are unverified marketing claims, not independently reconciled reserves. > Contradiction: Previously recorded figures ($34.84m / 77.89m SYRUP / $4.46m liquid) still appear in one current page snapshot, while the directly opened page shows $35.80m / 77.57m / $4.51m.

No Dune query was available to determine which is correct. Known address and control. The primary DAO treasury is Safe 0xd6d4Bcde6c816F17889f1Dd3000aF0261B03a196, Ethereum, with a 4-of-7 threshold. The June 2026 transparency filing states that it manages stablecoins and SYRUP; the DAO multisig holds proposer/admin authority over the GovernorTimelock, with a 3-day delay for treasury, admin, asset, and role changes. Additional addresses in the prior record (0x6a01…AAcF, 0x9e78…9423, 0xa946…0B19) were not independently re-verified in this run. Custody and reserve policy. Treasury custody is represented by the DAO Safe; independent custodian arrangements for treasury assets were Not verifiable as of September 6, 2026.

MIP-019 allocated 25% of protocol revenue to the Syrup Strategic Fund for buybacks and balance-sheet reserves; MIP-020 extended that allocation through Q1–Q2 2026. The governance process describes treasury use for operations, ecosystem growth, and approved investments. Attestations. Maple launched third-party Proof of Reserves with The Network Firm for syrupUSDC and syrupUSDT loan collateral. This is not evidence that the DAO treasury balance itself has been attested. On-chain/Dune balances: Not verifiable as of September 6, 2026. Liabilities: Not verifiable as of September 6, 2026.

Maple tokenomics — Ethereum (as of September 4, 2026). Native token: SYRUP; contract 0x643C4E15d7d62Ad0aBeC4a9BD4b001aA3Ef52d66. MPL was migrated at 1:100; MPL/xMPL no longer have utility or governance rights. Supply/valuation. CoinGecko reports ~1.167B circulating, 1.245B total, market cap $264.7M, FDV $282.2M; DeFiLlama reports ~1.167B circulating and $260.6M market cap.

Contradiction: Maple documentation projected 1,228,740,800 SYRUP by September 2026, while current aggregators show ~1.245B total; Dune/on-chain reconciliation is unavailable. Not verifiable as of September 4, 2026. Utility/governance. SYRUP is the Maple DAO governance token; voting covers treasury recapitalization, token distribution, products and contract upgrades. stSYRUP is the voting/staking wrapper. Governance-approved economics include protocol-fee-funded buybacks distributed to stakers; 25% of protocol revenue is currently described as allocated to the Syrup Strategic Fund for buybacks/reserves. No burn mechanism is documented.

Emissions/unlocks. Approved policy: ~5% annual inflation for three years, plus the 100M SYRUP recapitalization and historical emissions. The published initial allocation is: public sale 5%, SAFT/investors 30.5% (26% + 4.5%), ecosystem/community 29.5%, foundation/treasury 10%, team 25%. Vesting: public sale/treasury liquid; SAFT-0 one-year cliff plus 24-month linear; SAFT-1 one-year cliff plus six-month linear; ecosystem 18 months; team three-year vest.

Whether every announced unlock occurred on-chain: Not verifiable as of September 4, 2026. Control/concentration. DAO administration is reported as a 4-of-7 multisig; exact mint, blacklist, fee-switch permissions, controlling signers, top-holder concentration and insider-wallet attribution: Not verifiable as of September 4, 2026. Markets/liquidity. Main listings include Binance, Coinbase, Kraken, Upbit, Gate, Bitstamp, KuCoin and others; Ethereum DEX venue is Uniswap. Current DEX depth: Not verifiable as of September 4, 2026. CoinGecko shows Binance SYRUP/USDT as the largest listed market, with roughly $2.98M 24h volume and ~$84k/+2% and ~$69k/−2% depth in its snapshot.

If Bitcoin falls below $10,000, Maple’s risk profile would be driven by whether the shock causes borrower collateral to breach margin-call and liquidation thresholds, because Maple states that loans are managed with conservative collateralization, 24/7 monitoring, margin calls, and liquidation rights to protect lender principal. Maple also says it uses multiple price feeds and OTC/CEX/DEX execution paths to reduce liquidation risk in falling markets. However, the user-visible web results do not provide a verified, current on-chain breakdown of Maple’s active Ethereum exposures, collateral composition, or liquidation buffers, so the protocol-wide impact under a BTC < $10k scenario is Not verifiable as of 2026-09-04.

What can be said from the available sources is narrower: Maple reports that it has previously survived major crypto selloffs with zero liquidations and successful margin-call cures, including an October 2025 volatility event where it said collateral remained above 150% and about 84% of total collateral was BTC, and a later stress event where it reported zero liquidations again. Those claims suggest Maple’s underwriting is designed to absorb sharp BTC moves, but they are historical resilience claims, not a guarantee for a deeper BTC crash. For the specific stress question, the most likely risks would be: higher margin-call frequency, borrower top-up pressure, faster collateral sales, lower utilization/loan demand, and possible mark-to-market stress if borrower collateral is correlated with BTC.

Any statement about actual losses, impaired principal, or TVL drawdown under BTC < $10k is Not verifiable as of 2026-09-04 without current on-chain data.

Maple’s published risk material does not provide a pool-level or portfolio-wide loss estimate for a 20% depeg of the largest collateral. The closest disclosed stress case is a 20% BTC decline, where overall collateralization would fall to 144% and remain above immediate liquidation territory, while a 40% crash would reduce collateralization to 114% and trigger liquidations. That indicates Maple’s disclosed stress posture is sized to absorb a moderate shock, but a direct 20% depeg of the single largest collateral cannot be quantified from the available sources.

Maple’s own incident writeups also emphasize that it has historically managed volatility through margin calls, top-ups, and early repayments, with zero liquidations in the cited events; however, those are historical outcomes, not a verified estimate for this specific stress scenario. Not verifiable as of 2026-09-04: the dollar loss, %TVL impairment, and borrower-by-borrower impact from a 20% depeg of Maple’s largest collateral on Ethereum. The available sources do not disclose the current collateral mix, largest-collateral concentration, or a corresponding stress-test output for that exact shock.

For Maple, a top-counterparty insolvency propagates first through the loan accounting of the affected pool: the defaulted loan’s principal and accrued interest are removed from pool assets, any collateral is repossessed and liquidated, and any remaining shortfall is recorded as unrealized losses in the pool. The economic loss is then absorbed in this order: recoveries from collateral, then first-loss capital / cover pool capital if present, and only after that do pool lenders or depositors bear impairment. If the loan is undercollateralized, the loss path is much harsher: Maple’s own disclosures and contemporaneous reporting on the Orthogonal Trading defaults describe the loss being realized directly by lenders in the impacted pools, with roughly $31m concentrated in the M11 USDC pool and about $5m in the Maven M11 WETH pool; other pools were not impacted.

Reported outcomes at the time were about an 80% hit to remaining investors in the main affected pool and a 17% hit in the smaller pool, with Maple expecting at least $2.5m of recoveries to reduce losses. Compensation / recovery is not automatic insurance. Maple’s process is to pursue collateral liquidation and, where applicable, recoveries after default; lenders may later benefit from those recoveries, but if they withdraw during an impairment period they can crystallize a permanent impairment loss and forgo later restitution. Smart-contract impact path: borrower non-payment past grace period → default is declared → loan becomes immediately payable / pool accounting recognizes loss → principal and interest are written down → collateral is liquidated if it exists → first-loss capital is depleted if needed → lender balances / pool share value are reduced, with any residual recovery distributed later through the pool accounting.

For the stress scenario of committed fraud by the DAO or owners, I found no verifiable evidence that Maple’s DAO or owners have been proven to commit fraud. The strongest available third-party reports instead show allegations and litigation, not a confirmed fraud finding: Core Foundation alleges Maple misused confidential information and breached an exclusivity arrangement around a Bitcoin yield product, while Maple denies wrongdoing. There is also evidence of governance centralization and custody/control risk, which matters for a fraud stress test even if it is not fraud itself.

Maple’s governance documentation says a council can act decisively in urgent situations, and security docs note a multisig can trigger a protocol pause. That means governance power is not fully decentralized, so an insiders/owners misuse scenario is structurally plausible, but it is not the same as a documented fraud event. Separately, historical audit findings show that earlier Maple contracts had severe technical issues that could have enabled fund theft if they had shipped unpatched, including malicious fee-manager, origination-fee, and withdrawal-manager paths; the audit notes these were addressed before mainnet release.

These are relevant to operational and insider-control risk, but they do not establish actual DAO fraud. Assessment: committed fraud by the DAO/owners is not verifiable as of 2026-09-04. The better-supported stress case is governance abuse / confidential-information misuse / centralized-control failure, not confirmed fraud.

Maple’s primary yield source is not showing a negative 30d APY in the available sources; the most direct product page available shows Maple Institutional at 5.2% Last 30d APY. Maple also describes its yield as coming from borrower interest on secured, overcollateralized loans, not from token emissions alone. For a stress scenario where the primary yield source turns negative over 30 days, the likely interpretation is that Maple’s lending book would need to absorb a severe compression in borrower interest or an offsetting loss from fees/expenses; however, a *negative* lender APY is not verifiable as of 2026-09-04 from the provided sources.

What is verifiable is that Maple’s yield is designed to be driven by loan interest, and the protocol itself emphasizes that volatility can affect DeFi yield broadly while its own pools have historically remained overcollateralized during stress events. The key risk implication is that if loan demand weakens materially, lender returns would likely fall first, while negative APY would require additional adverse factors beyond ordinary spread compression; that specific outcome is not verifiable as of 2026-09-04.

Maple (Ethereum) — governance assessment as of September 13, 2026. Control. SYRUP and stSYRUP are the stated governance tokens; MPL no longer has governance rights. The documented process is forum discussion → Snapshot vote → implementation. However, execution is controlled by a GovernorTimelock administered by the DAO multisig and designated admins.

The multisig holds proposer/admin authority; therefore Snapshot is primarily signaling/mandate, not binding autonomous DAO execution. Contract powers. Governor controls MapleTreasury, global parameters, valid assets/contracts, role assignments, pause controls, and certain upgrades/admin functions. Security Admin can emergency-pause the protocol; Operational Admin has limited routine powers. The GovernorTimelock supports scheduled execution and token withdrawal functions. Timelock/multisig. Reported configuration is a 72-hour / 3-day timelock and 4-of-7 DAO multisig.

Signer identities, independence, and any changes since the prior check are Not verifiable as of September 13, 2026 because Dune was unavailable. Emergency pause creates an emergency bypass for availability protection, but does not itself authorize unrestricted fund withdrawal. Funds risk. admin_can_drain=true: the Governor/multisig has treasury and administrative powers, and execution does not require a binding token-holder on-chain vote. This is a material trusted-admin risk; pool delegates also remain trusted actors for pool-level fund administration. Voting concentration/top holders. Not verifiable as of September 13, 2026 (Dune unavailable; no on-chain substitute used). Company/frontend control. The interface Terms identify Maple Labs Pty Ltd, an Australian private company, ACN 635 342 880 / ABN 34 635 342 880, with main business location Victoria.

Directors: Not verifiable as of September 13, 2026. Terms are governed by Florida law and provide for AAA individual arbitration. Conclusion: real token-holder consultation exists, but contract execution and key administrative powers remain multisig/company-admin controlled; DAO governance is therefore symbolic/conditional rather than fully sovereign.

Assessment (as of September 4, 2026): Maple’s principal interface operator is Maple Labs Pty Ltd, an Australian proprietary company registered in Victoria, with a Melbourne contact address. Product-specific structures also use Maple International Operations SPC, a Cayman Islands segregated portfolio company; its LEI record identifies it as active and Cayman-domiciled. ToS/restrictions: Interface terms are with Maple Labs Pty Ltd, governed by Florida law, include broad liability disclaimers, individual-action/class-action waivers, and arbitration provisions.

The terms prohibit using the interface for transactions that require securities, commodities, money-transmission, or other regulatory registration. Syrup-related terms exclude U.S. and EEA persons for at least some programs and require KYC/AML completion; certain jurisdictions are ineligible for deposits. KYC/AML and classification: Maple states that institutional borrowers and pool delegates undergo KYC/AML and underwriting.

This is a permissioned-counterparty model, but it does not establish that Maple Labs or the protocol is licensed as a bank, broker-dealer, investment adviser, money-services business, or regulated fund in every relevant jurisdiction. Regulatory classification/licensing: Not verifiable as of September 4, 2026. Warnings/enforcement and litigation: The protocol’s own disclosures warn of smart-contract, borrower-default, liquidity, and total-loss risks. I found no regulator enforcement action against Maple Labs, Maple DAO, or Maple International Operations SPC in the reviewed sources. A Cayman Islands dispute involving Core Foundation and Maple International Operations SPC proceeded through arbitration and Grand Court proceedings, but the parties announced a confidential full-and-final settlement on May 22, 2026, without admission of liability.

Data protection/legal-vs-actual risk: Maple publishes privacy rights for EEA/UK and California residents, but blockchain transaction data cannot be deleted. Legal segmentation among Maple Labs, DAO entities, Cayman SPVs, and pool-specific vehicles may limit recourse and does not remove credit, counterparty, governance, insolvency, or enforcement risk.

No exact GLEIF LEI record for 'Maple Labs Pty Ltd', 'Maple'. OFAC SDN screening of 'Maple Labs Pty Ltd', 'Maple': no match. SEC litigation and administrative release feeds: no mention.

Maple does not appear to issue a protocol-native base stablecoin on Ethereum; its user-facing products are yield-bearing receipt tokens such as syrupUSDC and syrupUSDT, which are minted from deposits of existing stablecoins rather than representing a Maple-issued stablecoin. The available web evidence does not verify any depeg event for the stablecoin exposure used by Maple, so depeg_count, max_depeg_pct, and last_depeg_date are not verifiable as of 2026-09-06. On that basis, stable is not verifiable as of 2026-09-06.

Maple’s principal risk is credit loss transmitted through institutional borrowers, collateral liquidation, and constrained pool liquidity; these risks are amplified by protocol-admin privileges and oracle dependencies. Available documentation is stale data (>7 days old), and Ethereum exposure, concentration, defaults, and current liquidity cannot be independently verified on-chain: Not verifiable as of September 5, 2026.

Maple’s top strengths appear to be: institutional-grade lending and underwriting, on-chain transparency, strong risk management, deep DeFi composability/access to yield products, and institutional-grade service/compliance positioning. Maple describes itself as an onchain asset-management platform with “full transparency” for loans, collateral, and transactions, and emphasizes robust risk management and global client support on its site. Independent coverage also highlights Maple’s bridge between traditional credit markets and DeFi, using credit assessment expertise and delegated lending pools to serve institutional borrowers.

• Institutional credit underwriting: Maple’s core differentiator is its ability to extend institutional lending with professional credit assessment rather than purely overcollateralized DeFi mechanics.
• Transparency: Loan terms, collateral, and transactions are designed to be visible and verifiable on-chain, which lowers information asymmetry for lenders.
• Risk management: Multiple sources point to Maple’s emphasis on conservative underwriting, principal protection, and structured risk controls as a major strength.
• Yield product innovation and composability: Coverage of syrupUSDC/syrupUSDT and Maple’s broader product design highlights its ability to package institutional credit exposure into DeFi-native yield assets and integrate with the wider ecosystem.
• Institutional market fit and service: Maple’s positioning around KYC/compliance, borrower diligence, and white-glove service is repeatedly cited as a strength for attracting sophisticated allocators and borrowers. If you want, I can turn this into a more investor-style SWOT or separate *strengths by chain/product line* for Ethereum.