Full Stack Security
Maple Finance needs security that keeps pace with development across every layer of their stack. Point-in-time audits that lands weeks after architecture choices are already locked in aren't suitable when the goal is to build security in from the first day of development.
The traditional approach to security left gaps Maple couldn’t accept. Manual review is bounded by human attention. Static analyzers only flag what someone already wrote a rule for. And few crypto-native audits look past smart contracts into the TypeScript, GraphQL, and React layers that Maple's institutional capital interacts with daily.
Meet Maple
Maple Finance is one of onchain finance’s most significant lending protocols and the leader in onchain asset management. The platform connects institutional borrowers with onchain capital, originating over $3 billion in loans since 2021.
Its technology stack reflects the complexity of that business. Solidity smart contracts govern loan logic. A TypeScript, GraphQL, and Node.js backend processes compliance and collateral workflows. React powers the two frontends through which users deposit and withdraw funds. Every layer is mission-critical and each carries its own distinct attack surface.
At 97% precision, we spend much less time on triage and much more time building on a secure foundation.
Full Stack Findings
Maple brought Octane in for continuous, AI-native security coverage across its entire codebase. Over three months and more than 50 analyses, Octane scanned 10 repositories spanning Solidity, TypeScript, GraphQL, and React, and delivered 152 validated vulnerabilities, including 1 critical and 13 high-severity findings.
Most audits of onchain protocols cover Solidity and stop there. Octane covered the entire stack — from contracts to web applications — surfacing issues in the TypeScript and React layers that Maple’s team previously had much less visibility into.
Maple’s first month with Octane started at an already-strong 74.4% true positive rate. That's well above what teams expect from automated tooling. Two months of continuous use drove that figure up to 97.4%.
Engineers act on findings directly, without lengthy back-and-forth about whether something is real. With precision approaching 100%, Maple gets faster remediation cycles, higher confidence in every release, and a finding history that compounds over time into deep structural knowledge of its own codebase.
Over time, Octane builds a model of how a specific protocol thinks. Adversarial reasoning gets exponentially more effective when it understands the intent behind the design, not just individual lines of code. That accumulated context is what drove Maple from 74% to 97% precision in two months — and it’s what every long-term engagement with Octane produces: signal that keeps improving as the system fine-tunes itself.
Gio Vignone
CEO of Octane Security
The attack surface of a modern DeFi protocol doesn’t stop at the last line of smart contract code. For Maple, the compliance bypass was in TypeScript. The fund drain was in React. And the critical accounting bug was in Solidity, which was a finding that required tracing state across three interdependent functions that no rule-based tool would ever connect.
- 10 repositories analyzed across Solidity, TypeScript, GraphQL, and React
- 152 validated vulnerabilities delivered, including 1 critical and 13 high-severity
- 50+ analyses over three months of continuous coverage
- True positive rate climbed from 74.4% to 97.4% in two months
Secure Your Entire Stack with Octane
Don’t get lost in the noise from substandard automated tooling. High-stakes software demands AI-scale discovery plus human-grade precision — the exact model Octane was built around from day one.
Subscribe to our newsletter
