Maple Finance Review

How Maple Finance scores in DeFi protocols

This entry rates Maple Finance, an on-chain lender whose pools of stablecoins make overcollateralized loans to crypto institutions, in our DeFi protocols ranking. It covers both product lines: the permissioned Maple Institutional pools, including the Cash Management Pool, and the Syrup tokens (syrupUSDC, syrupUSDT, syrupUSDG) open to eligible non-US users. The basis is desk research of Maple's documentation, its audits page, its legal pages and the maple-core-v2 repository, checked on November 6, 2026. No deposit was made. The category has five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.

The overall score is the plain average: (8 + 5 + 10 + 7 + 5) / 5 = 35 / 5 = 7.0, up from 6.6 at the July 24, 2026 check. Three marks moved. Audit disclosure rose from 9 to 10 because the audits page now lists 20 dated, linked reports, the latest from September and October 2026. Governance & control rose from 3 to 5 after the documentation began describing the GovernorTimelock and which actions bypass it. What it does & fees fell from 9 to 8: the July mark rested on the Cash Management Pool, but the fee page publishes no rates for the Syrup and institutional pools that carry most deposits. Licence and backing are unchanged.

Strongest criteria

A complete, dated audit archive (10)

Maple's security page maps audits to releases. The V2 launch in December 2022 was reviewed by Trail of Bits, Spearbit and Three Sigma. Later releases were checked by Three Sigma and 0xMacro (2023 and 2024), the GovernorTimelock upgrade by Sherlock and 0xMacro (September 2025), the withdrawal-manager upgrade by Spearbit and Sherlock (November 2025), the cross-chain CCIP receiver by Dedaub and Sigma Prime, and the November 2026 shared-strategies release by Sherlock and Cantina. Every entry has a report link. Two independent firms per release, with dates, is the standard this category gives full marks for. An audit reviews code, not borrower solvency.

A fee published to the basis point, for one pool (8)

The Cash Management Pool is the clearest fee statement in the category: 50 basis points a year, split into a 25 bps protocol fee taken from gross interest and a 25 bps borrower spread over SOFR, with "no upfront subscription fees, redemption fees" or other charges. The mark is not higher because that pool is permissioned, with a $100,000 minimum and accreditation checks. For the other pools and for Syrup, the fee page names the platform service fee, delegate service fee, management fee and two strategy fees, but gives no live rate or cap. Depositors see a net yield, not the cut taken from it.

Backing with an aggregate collateral feed (7)

Borrowers post liquid digital assets worth more than the loan. Maple publishes total loan value, total collateral value and the collateral ratio, along with assets held in strategies, through the Open Access Details page and a public API. The Cash Management Pool's borrower may invest only in US Treasury bills and reverse repos fully collateralized by them, under a Master Loan Agreement. The mark stays at 7, below Ondo Finance's 8, because no third-party attestation is described and the data is aggregate rather than per loan.

Weakest criteria

Source-available, not open source (5): a deficiency

The maple-core-v2 LICENSE is Business Source License 1.1, with Maple Labs Pty Ltd as licensor and GPL-2.0-or-later as the change licence. The stated change date is "to be determined", with a fallback of four years after each version's first public release. The category gives BUSL code 5, as it does for Ondo Finance. The mark should be revisited once the earliest V2 code passes its fourth anniversary.

Governance and upgrade control (5): partly disclosed

The documentation now says the Governor role is an on-chain GovernorTimelock managed by a multisig, with a minimum delay of one day and a one-day execution window, and that a delay cannot be cut instantly. The timelocks page is also explicit about the exceptions: the Security Admin can upgrade pool managers, loan managers, withdrawal managers and strategies "without a scheduled call", and a multisig can pause almost all functions. Neither multisig's signer count or threshold is given, and the governance page does not say who executes SYRUP Snapshot votes. That matches the 5 Derive receives for a timelock with a bypass path.

What the score does not cover

The score measures Maple's published disclosure. It does not rate borrower credit quality, the underwriting team or returns. Lenders carry borrower risk: Maple can impair or default a loan, and a lender who withdraws during an impairment takes that loss permanently. Syrup withdrawals join a first-in, first-out queue that the legal disclosure says has "no guaranteed maximum withdrawal period". Syrup is closed to US and Australian persons and a list of sanctioned regions, and every lender passes KYC. Our guide to reading a DeFi lending market covers what to check before lending, and how to assess a stablecoin explains why a yield-bearing token is not a dollar token.

Maple Finance vs Ondo Finance and Nexus Mutual

Ondo Finance, the closest product match because it also routes on-chain money into Treasury-backed instruments, scores 6.8. The two tie on fees (8) and licence (5, both BUSL). They also tie on audits (10). Maple leads on governance (5 against 3), while Ondo leads on backing (8 against 7) because of its daily attestations. Nexus Mutual scores 8.2: its GPL-3.0 code (10) and on-chain capital pool (9) outweigh Maple's audit lead (10 against 8), and the two sit close on governance (6 against 5).

Who it suits

On these marks, Maple suits eligible lenders who want a fully audited lending protocol with a published collateral ratio and a documented timelock, and who accept borrower credit risk and a withdrawal queue. The Cash Management Pool suits accredited lenders who want a fixed, stated fee. It suits less well anyone who needs open-source code, per-pool fee rates or signer thresholds for the admin keys.