Convex Finance

Convex Finance is an Ethereum-based yield optimizer for Curve Finance LPs and CRV stakers, using the native CVX token for rewards and governance. Protocol identification

• Name: Convex Finance
• Website: convexfinance.com (front-end for deposits, staking, governance).
• Docs: Hosted under docs.convexfinance.com (includes tokenomics and contract address lists).
• Category: DeFi protocol focused on yield optimization / Curve booster for Curve LPs and CRV stakers.
• Launch / history: Introduced in April 2021; mainnet launch on Ethereum in May 2021, with c. $68m TVL in first month.
• Chains: Ethereum only for core protocol in this scope.
• Native token: CVX, Convex’s governance and fee-sharing token; staked/locked CVX earns a share of Curve/Frax-derived fees and influences gauge voting. Key contract addresses (Ethereum) (All with explorer verification; on-chain re-checks are Not verifiable as of 2026-09-04.)
• CVX ERC‑20 token: 0x4e3FBD56CD56c3e72c1403e103b45Db9da5B9D2B, listed in official docs and linked to Etherscan.
• Curve/LP staking & rewards contracts: The docs provide a dedicated “Contract Addresses” page covering booster, reward, cvxCRV, and related contracts; these are cross-referenced by analytics/educational sites describing Convex as an Ethereum smart‑contract system for Curve LP staking. Because direct on-chain querying is unavailable this turn, individual contract ABIs, verification status, and labels beyond the CVX token and documented list are Not verifiable as of 2026-09-04. Fork lineage & design
• Is it a fork? Public sources describe Convex as a protocol built on top of Curve, not a direct fork of Curve or Yearn. It aggregates and locks CRV into veCRV, issues cvxCRV as a liquid representation, and auto-distributes boosted CRV plus CVX emissions to LPs.
• What changed vs upstream:
• Removes the need for users to lock CRV themselves; Convex locks CRV centrally and passes boosted rewards back via cvxCRV.
• Adds CVX tokenomics (100m max supply, pro‑rata minting vs CRV claims, fee‑sharing and gauge‑vote utility).
• Audit status: No audit reports surfaced in the retrieved set; audit coverage is Not verifiable as of 2026-09-04.
• Malicious‑modification history in similar forks: Public summaries emphasize Convex as an original design on Curve rather than a known malicious fork; no specific malicious-modification incidents in Convex‑branded forks are identified in the retrieved data, so this item is Not verifiable as of 2026-09-04.

Convex Finance appears to be a real, live product portal rather than a static landing page: its site describes the full flow to deposit LP tokens, earn rewards, claim, and withdraw, and the docs describe a working dApp that requires an Ethereum wallet to interact with it. The docs also expose the protocol’s core contract interface, including deposit and withdraw functions, which is a strong sign of operational product maturity. I did not find web evidence of broken links, fake metrics, or template-site signs in the materials reviewed, so those items are Not verifiable as of 2026-09-04.

The same applies to whether any specific live deposit/withdrawal UI path is currently failing, because that would require direct runtime testing of the app. On open API, there is evidence of an API-like surface: a third-party listing describes a Convex Finance GraphQL subgraph for pools, deposits, withdrawals, revenue, and user activity. However, that is an indexed subgraph rather than a native public API published by Convex itself, so the most defensible answer is that an open data API exists in the ecosystem, but a first-party open API is Not verifiable as of 2026-09-04.

Convex Finance has an active bug bounty program documented in its bug bounty FAQ. The program scope covers issues that could cause substantial loss of money, critical bugs such as broken liveness conditions, or irreversible loss of funds. Eligibility requires being the first reporter, verifying a signature from the same address, and providing enough information; exclusions include already known vulnerabilities and frontend-only bugs that do not lead to smart-contract vulnerabilities.

Payouts are tiered by likelihood and severity, ranging from $1,000 to $250,000. A publicized security issue in March 2022 was patched and not exploited; no funds were lost, which is the only clear result surfaced here. It is not verifiable as of 2026-09-04 whether the bug bounty has a separate Immunefi listing, or whether there have been formal public bounty payouts beyond the documented 2022 incident.

Assessment — Ethereum / Convex Finance Primary dependency: Curve Finance — High. Convex’s core contracts deposit Curve LP tokens, stake against Curve gauges, lock CRV as veCRV, and distribute CRV/CVX-related rewards. A Curve exploit, gauge/governance failure, liquidity collapse, or CRV impairment would directly reduce withdrawable value and yield economics. Convex’s own documentation confirms this architecture. Oracle and manipulation risk — Medium/High, indirect. Convex’s basic staking layer is not documented as relying on a single external price oracle; however, underlying Curve pools and Curve lending/stablecoin products can embed AMM-price, collateral, or oracle dependencies.

Curve reported a March 2, 2026 oracle-manipulation exploit in an sDOLA/crvUSD LlamaLend market that caused approximately 822,475 crvUSD of borrower losses. This was not reported as a Convex contract exploit, but it demonstrates correlated dependency risk through Curve assets and strategies. Stablecoin exposure — Material but unquantified. cvxCRV staking rewards can include crvUSD, and Convex strategies may hold Curve LP tokens containing stablecoins or other third-party assets. Depeg, liquidity, issuer, or smart-contract failure of USDC/USDT/DAI/crvUSD or pool constituents could create NAV and withdrawal losses.

Exact Ethereum asset composition and concentration: Not verifiable as of September 6, 2026. Bridges, custodians, CEX/MMs, RWA/SPVs, LST/restaking. No required custodian, CEX, market-maker, RWA issuer/SPV, or bridge dependency was identified for Convex’s Ethereum core architecture. Cross-chain deployments exist, but bridge exposure for Ethereum-held assets and any LST/restaking concentration are Not verifiable as of September 6, 2026. > Contradiction / data limitation: DeFiLlama reports approximately $570.63m on Ethereum and $579.15m total TVL, but this is aggregator data, not raw on-chain verification. Exposure percentages cannot be derived reliably. Failure scenarios: Curve exploit or governance capture; stablecoin depeg; oracle/AMM manipulation; CRV liquidity collapse; Ethereum congestion or halt; reward-token insolvency or smart-contract failure.

No active Convex/Curve dependency failure was identified in reviewed sources as of September 6, 2026; this does not substitute for live on-chain monitoring.

Convex Finance is organized as a non-custodial Ethereum protocol: users deposit through smart contracts, and Convex says those contracts are immutable, non-custodial, and do not give the multisig direct access to user deposits. User funds are not held in a segregated custodian account; instead, custody is mediated by protocol contracts, with CRV deposits converted into cvxCRV claims on Convex’s locked veCRV position and CVX governance positions locked into vlCVX for voting. The remaining admin layer can manage parameters such as rewards, staking ratios, boost settings, and even pause new deposits or shut down the vlCVX contract in a way that allows withdrawals, but the documented admin rights explicitly state there is no direct access to user funds.

On the evidence available here, withdrawal_paused is false for the protocol design described in the docs because deposits can be paused while withdrawals remain open, and segregated_assets is false because the model is pooled and contract-based rather than segregated custody.

December 14, 2021 patch; vulnerability disclosed publicly April 4, 2022. An access-control flaw in PoolManagerV2/Booster could have let two multisig signers drain Convex-controlled Curve LP positions, approximately $15 billion at risk. There is no evidence of exploitation or realised loss.

Convex coordinated disclosure with OpenZeppelin, added public multisig signers, and patched the contracts. Reimbursement was not applicable. Current status: resolved.

March 4, 2022. A vote-locking contract bug allowed expired CVX locks to be relocked to a new address and could distort reward claims. The issue caused forced unlocks and market-price impact, but no user deposits were reported stolen and no exploitation producing a realised protocol/user fund loss was documented.

Convex redeployed the vote-locking contract and required users to relock CVX. Reimbursement was not applicable. Current status: resolved.

Attack window June 20–23, 2022; detected June 23. Namecheap DNS hijack redirected convexfinance.com to a cloned frontend containing malicious approval contracts. Forty addresses approved them; three lost 15,968 cvxCRV and 433 CRV.

The primary post-mortem does not state a USD value; DeFiLlama estimates approximately $14,000. Convex restored the domain on June 24, moved to a new registrar, added DNS monitoring, and instructed users to revoke approvals. Treasury compensation was paid in CVX at the loss-time USD value; all three affected addresses were later reported compensated.

No attacker funds are reported recovered. Current status: resolved.

Convex Finance: Frontend & Infrastructure via DNS Hijack on Ethereum; loss $14,000 (DeFiLlama hacks registry).

Convex Finance’s protocol key management appears centralized for core administration and self-custody for users. The user-facing Ethereum interaction model is simple: users connect with an Ethereum wallet such as MetaMask, and their transactions are signed from that wallet. In the protocol design, on-chain accounts are controlled by an external user’s Ed25519 public/private key pair, and each user account may have a single account key; the private key is assumed to remain under the user’s control.

For governance and operational control, third-party reporting on Convex indicates that key admin functions are handled through a multisignature wallet, with Omniscia describing the deployed multi-sig as a Gnosis instance and identifying a 2-of-3 owner setup at the time of its review. A separate community security write-up also states that Convex uses multisig for core management functions and mentions a timelock for major changes, but this is not primary-source verification. So, in practical terms, key management is organized as:

• Users: self-custodied wallet keys for depositing, staking, and voting actions.
• Protocol administration: shared control via a multisig wallet, reducing single-key control risk.
• Governance mechanics: token voting is mediated by locked CVX/vlCVX, not by a centralized login system. One limitation: I could not independently verify the current live admin signer set or whether the multisig structure has changed since the cited review, so the exact present-day signer configuration is Not verifiable as of 2026-09-04.

Assessment — Ethereum (as of September 6, 2026). On-chain verification through Dune was unavailable: Not verifiable as of September 6, 2026 for current proxy-admin ownership, decoded admin events, exact Safe threshold/owners, timelock execution history, role renunciation, and latest implementation slots. No Dune query/execution IDs can therefore be supplied. Key addresses (published; independently cross-checked where possible): Booster 0xF403C135812408BFbE8713b5A23a04b3D48AAE31; Booster Owner 0x3cE6408F923326f81A7D7929952947748180f1E6; multisig 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB; Pool Manager Proxy 0x5F47010F230cE1568BeA53a06eBAF528D05c5c1B; Secondary Proxy 0xD20904e5916113D11414F083229e9C8C6F91D1e1; Voter Proxy 0x989AEb4d175e16225E39E87d0D97A3360524AD80. Control surface. The published model is a 3-of-5 Gnosis Safe. It can change stash/pool managers, fee parameters within hard-coded ranges (20% absolute ceiling), treasury and reward-distribution settings, Curve votes, operator whitelisting, token recovery, and pause/shutdown deposits.

It reportedly cannot directly withdraw user deposits; shutdown paths allow user withdrawals. This is a documented claim, not current on-chain proof. Upgradeability / exits. Proxies exist in the pool-management and voter/operator architecture; whether each current proxy is upgradeable, its admin type, and whether any implementation can alter custody logic are Not verifiable as of September 6, 2026. Booster exposes deposit/withdraw functions and shutdown is described as withdrawal-enabling, so users generally have a contractual exit path absent insolvency, token failure, or an integration exploit. Timelock / emergency risk. The known fake-gauge mitigation includes a 30-day force-shutdown delay, but current delay and queue state are Not verifiable as of September 6, 2026.

Key compromise could redirect fees/treasury, alter pool or reward configuration, pause deposits, vote Curve gauges, or potentially exploit upgradeable components; direct theft of ordinary deposits is not established. Freeze/rug risk is therefore moderate, concentrated in governance and integration paths rather than a simple admin drain. Architecture: Users → Booster → Curve gauges/LP custody → Convex deposit tokens + reward pools; multisig → Booster Owner / Pool Manager proxies / reward and fee controls → Curve governance and treasury.

Convex Wrapper Audit. The Convex audits page lists an April 2023 audit by ChainSecurity and links the report in the convex-eth GitHub repository. The snippet does not reveal the full issue list or whether all findings were fixed, so detailed severity counts and fix status are not verifiable as of 2026-08-29.

Checkpoints audit report; file lib/openzeppelin-contracts/audits/2022-10-Checkpoints.pdf in convex-eth/voting (protocol audit catalog).

Convex Onchain Voting report audit report; file audit/2026-06-Convex-Onchain-Voting-report.pdf in convex-eth/voting (protocol audit catalog).

v5.3 audit report; file lib/openzeppelin-contracts/audits/2025-04-v5.3.pdf in convex-eth/voting (protocol audit catalog).

v5.5 audit report; file lib/openzeppelin-contracts/audits/2025-10-v5.5.pdf in convex-eth/voting (protocol audit catalog).

v5.4 audit report; file lib/openzeppelin-contracts/audits/2025-07-v5.4.pdf in convex-eth/voting (protocol audit catalog).

RLP audit report; file lib/openzeppelin-contracts/audits/2025-11-RLP.pdf in convex-eth/voting (protocol audit catalog).

v4.9 audit report; file lib/openzeppelin-contracts/audits/2023-05-v4.9.pdf in convex-eth/voting (protocol audit catalog).

ERC4626 audit report; file lib/openzeppelin-contracts/audits/2022-10-ERC4626.pdf in convex-eth/voting (protocol audit catalog).

v5.2 audit report; file lib/openzeppelin-contracts/audits/2024-12-v5.2.pdf in convex-eth/voting (protocol audit catalog).

v5.0 audit report; file lib/openzeppelin-contracts/audits/2023-10-v5.0.pdf in convex-eth/voting (protocol audit catalog).

v5.1 audit report; file lib/openzeppelin-contracts/audits/2024-10-v5.1.pdf in convex-eth/voting (protocol audit catalog).

v5.6 audit report; file lib/openzeppelin-contracts/audits/2026-02-v5.6.pdf in convex-eth/voting (protocol audit catalog).

MixBytes — published April 19, 2021. Scope: Convex core/general platform contracts. Critical/high/medium findings: Not verifiable as of September 5, 2026. Fix status: Not verifiable as of September 5, 2026. Covers deployed code: Not verifiable as of September 5, 2026; bytecode/commit match unavailable.

General Contracts Audit for Convex Finance core platform. The Convex audits page lists this as the ‘General Contracts Audit by MixBytes’ from April 2021 and links the PDF report in the convex-eth GitHub repository. The page indicates this audit is part of the deployed platform’s security review program.

The specific count, severity breakdown, and fix-status details are not fully extractable from the search snippet alone, so those fields are not verifiable as of 2026-08-29.

Nomoi — published January 2023. Scope: Convex sidechain contracts. Critical/high/medium findings, fix status, and deployed-code coverage: Not verifiable as of September 5, 2026; bytecode match unavailable.

PeckShield — published April 19, 2022. Scope: Convex-Frax staking. Findings: 0 critical, 0 high, 3 low, plus 1 informational recommendation. Fix status: all identified issues addressed by referenced post-fix commits. Covers deployed code: Not verifiable as of September 5, 2026; report commit-to-mainnet bytecode match unavailable.

Convex Finance also has additional audit entries referenced by external summaries, including the Frax staking platform and sidechain-related reviews, but the search results provided here do not expose enough of those reports to reliably enumerate findings or remediation status. Because on-chain verification is unavailable in this run, whether each report covers deployed Ethereum code specifically is only partially inferable from the audit titles and is otherwise not verifiable as of 2026-08-29.

Convex Wrapper Audit. The Convex audits page lists a September 2022 audit for the Convex staking wrapper and links the corresponding report in the convex-eth GitHub repository. The snippet does not expose the full findings table or remediation status, so critical/high/medium findings and fix status are not verifiable as of 2026-08-29.

PeckShield — published November 2022. Scope: Convex sidechain contracts. Critical/high/medium findings, fix status, and deployed-code coverage: Not verifiable as of September 5, 2026; bytecode match unavailable.

Blockworks’ token-transparency filing reports a seven‑audit programme for Convex-related components: PeckShield (Frax staking platform – Apr 2022; staking wrapper – Sep 2022; sidechain platform – Nov 2022), Nomoi (cvxCRV staking wrapper – Jan 2023; sidechain platform – Jan 2023) and ChainSecurity (Silo Finance Curve and Convex feature – Apr 2023).

Convex Finance’s founders are publicly pseudonymous: Blockworks’ Token Transparency filing says the protocol was launched in May 2021 by co-founders known only as C2tP and Winthorpe, with no public legal names, employment history, or jurisdiction disclosed. That same filing says Convex operates without a publicly identified legal entity, so the team is *not* operating like a conventional onshore/offshore incorporated startup with a named cap table on public record. On credibility, the strongest verifiable signal is that both founders are described as smart-contract and governance operators, but their prior projects or real-world identities are not verifiable as of 2026-09-04 from the available independent sources.

A secondary source, RootData, repeats that C2tP and Winthorpe are Convex co-founders, but it does not materially expand on identity or prior outcomes. Reality check: Convex does have a visible public-facing team page with named staff and a detailed operating narrative, including engineering and finance hires with backgrounds at Dropbox, Bump, Amplitude, Heroku, Clearbit, and Fly.io; however, that appears to describe the broader company/team rather than de-anonymizing the protocol founders. The public team page also suggests a real operating business behind the protocol, not just a web front.

Security history matters. Convex’s own post-mortem states that the June 2022 incident was a DNS/domain hijack affecting users who approved malicious contracts; it says 40 known addresses approved those contracts, while the Convex smart contracts themselves were not exploited. Independent reporting similarly states the compromised domain pointed users to a malicious copy of the site and that protocol contracts/treasury were not touched.

Net assessment: public founders anonymous, real product and staff visible, but founder identity/office/jurisdiction remain not verifiable from the sources reviewed.

Convex Finance’s reputation is mixed: it is a major Ethereum DeFi protocol with a long operating history, but its team is pseudonymous, which increases governance and accountability risk. Publicly available reporting identifies founders as pseudonymous figures C2tP and Winthorpe, and Blockworks notes no publicly identified legal entity and no disclosed investor sale details, while Kraken’s document similarly says the team and 3.3% investor allocation recipients were anonymous. Blockworks also says Convex has a broad audit program, including MixBytes, PeckShield, Nomoi, and ChainSecurity, which is a positive signal, and the protocol’s own docs list audits and risk disclosures.

Sentiment is generally “established but opaque”: Convex is treated as a serious infra-layer in Curve-related yield markets, but the anonymity of founders and investors remains a recurring criticism. One widely reported security issue in 2022 involved a vulnerability that could have enabled a very large “rug pull,” but the bug was patched and no funds were lost; this is best read as a security warning, not evidence of an actual exploit. On legal/regulatory and sanctions risk, the main concern is structural: Blockworks says Convex has unusually high regulatory and legal risk because no legal entity publicly stands behind it, and that increases uncertainty around enforcement, counterparties, and liability.

I did not find a reliable, protocol-specific sanctions designation or regulator action against Convex itself in the gathered sources; allegations in the AMLNetwork result are not reliable enough to treat as verified, so sanctions/illicit-finance claims are not verifiable as of 2026-09-04. Unresolved concerns are therefore: pseudonymous control, opaque investor identity, no clear legal wrapper, and the need to rely on audits rather than public accountability. The strongest counterpoint is that the protocol has been live for years, is widely integrated, and has multiple third-party audits, which lowers—but does not remove—operational and governance concerns.

Economic model — Ethereum scope (checked 2026-09-06)

• Strategy/assets: Convex aggregates Curve LP tokens and stakes them in Curve gauges to obtain boosted CRV; it also supports Frax and f(x)-related positions. CRV deposits are converted into liquid cvxCRV while the underlying CRV is locked as veCRV. Outputs are LP principal/receipt tokens, CRV or cvxCRV, CVX, and partner incentives.
• Yield source: Curve trading fees are organic; CRV/CVX emissions, partner incentives, and gauge/bribe-directed rewards are subsidized or inflationary. Convex’s yield is therefore mixed, not purely organic. Exact organic share of current APY: Not verifiable as of September 6, 2026.
• Risk profile: Not market-neutral. Users retain Curve LP risks—impermanent loss, depeg, smart-contract, CRV/CVX price, and gauge-concentration risk. Exposure is principally directional to Curve/CRV/CVX, with additional Frax/f(x)/partner-token exposure. No borrowing, recursive looping, or restaking strategy was identified in the reviewed materials; current leverage ratio: Not verifiable as of September 6, 2026.
• Lock-ups/withdrawal: Curve LP deposits can be withdrawn and unwrapped back to the underlying Curve LP token; Convex documents zero deposit/withdrawal fees. Rewards may stream over seven days, and withdrawing during that period can forfeit accrued streamed rewards. cvxCRV/cvxFXS represent locked underlying governance positions; vote-locked CVX requires 16+ weeks.
• Fees/revenue: Current documented Curve fee schedule is 17% of CRV revenue: 10% cvxCRV stakers, 4.5% CVX stakers, 2% treasury, 0.5% harvest caller; parameter ranges allow adjustment, with a 20% ceiling. DefiLlama reports approximately $1.68m fees and $0.91m protocol revenue over 30 days in its latest snapshot.
• TVL/APY: DefiLlama reports about $564.86m total TVL, of which $556.29m Ethereum (98.5%); other chains are Fraxtal, Arbitrum, and Polygon. TVL was down 6.3% over 30 days; average supply APY was 6.94% across 193 pools. Product-level TVL, APY history/volatility, and Dune-vs-DefiLlama reconciliation: Not verifiable as of September 6, 2026. > Contradiction: Earlier records treated Convex as Ethereum-only. Current DefiLlama data shows four chains; this assessment uses Ethereum as requested and reports the broader figure only for reconciliation.

As-of: September 6, 2026. Ethereum only.

• liquid_reserves_usd: null
• liabilities_usd: null
• Treasury address: Convex documentation lists Treasury Vault 0x1389388d01708118b497f59521f6943Be2541bb7; the associated operator/multisig is listed as 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB. This identifies the documented custody structure, but the current balance and complete asset scope were not verified through Dune.
• Composition / size: Convex’s public UI reports Treasury of approximately $14.6m, but this is a protocol-displayed figure and is an unverified marketing claim. A reproducible Dune balance query and execution snapshot were unavailable. Not verifiable as of September 6, 2026.
• Reserve policy: Convex documentation states that 9.7% of total CVX supply was allocated to the treasury and vested over one year; use is described as incentives or other actions benefiting Convex, at the discretion of the Convex Team. This is a protocol documentation claim, not an independent attestation.
• Custody / control: Documentation states the treasury is controlled by a Convex multisig with a 3-of-5 threshold. The currently published signer list is C2tP, Winthorpe, Benny, Tommy, and Sam; the exact current signer set was not independently verified.
• Attestations: No independent reserve attestation or proof-of-reserves report was identified. Not verifiable as of September 6, 2026. > Contradiction / change: The previously recorded finding named Charlie (Curve) as the third signer; the currently retrieved Convex documentation names Benny (Llama Airforce). Because the documentation is stale and no Dune/on-chain verification was available, the signer change and current control set remain unresolved. Risk conclusion: Treasury exists as a documented contract-controlled structure, but current liquid reserves, liabilities, asset composition, signer validity, and independent assurance remain unverified.

Convex Finance has a native token: CVX on Ethereum, but the exact contract address, holder concentration, insider wallets, and on-chain unlock completion are Not verifiable as of 2026-09-04 from the available sources in this run. Public sources consistently describe CVX as the protocol’s governance and value-capture token with a hard cap of 100,000,000 CVX and a current supply near the cap; one recent source gives 93,194,518 circulating and 100,000,000 total supply, while another market source shows 93M circulating and about $214.9M market cap / $230.2M FDV as of 2026-09-03. Utility / governance: CVX is used to lock into vlCVX, giving voting power over Convex direction and vote allocation on integrated protocols such as Curve, Frax, and f(x); locked CVX votes on emissions every 14 days, and one source states a 16-week minimum lock. Revenue share / buybacks / burns: available sources indicate CVX is a governance and fee-distribution token, but I could not verify any protocol-level buyback or burn mechanism from the gathered material; treat those as Not verifiable as of 2026-09-04. Emissions / unlocks / allocation: multiple sources agree CVX uses a cliffed mint schedule tied to CRV claimed by Convex, with the mint ratio stepping down every 100,000 CVX and a 100M hard cap; some summaries cite an initial allocation of roughly 50% Curve LP rewards, 25% liquidity mining, 10% team, 9.7% treasury, 3.3% early investors, and two 1% airdrops, but these allocation figures remain aggregator-reported rather than independently chain-verified here. Announced unlock schedules and whether they fully occurred on-chain are Not verifiable as of 2026-09-04. Top holders / admin controls / liquidity: holder concentration, insider wallets, mint/blacklist/fee-switch permissions, and main DEX liquidity depth/listings are Not verifiable as of 2026-09-04 in this run.

The available evidence only supports that CVX is an Ethereum DeFi governance token with broad market listings and roughly $215M market cap and $230M FDV on 2026-09-03, but not the underlying on-chain ownership/control details.

For Convex Finance on Ethereum, a Bitcoin move below $10,000 is best treated as a severe risk-off macro shock, not a protocol-specific event. The most likely transmission channel would be a broad crypto deleveraging wave: BTC weakness could trigger forced selling, lower collateral values, and weaker risk appetite across altcoins and yield protocols, which would likely pressure CVX and Convex-associated deposits/lockups even if Convex itself had no direct BTC exposure. The web evidence supports that $10,000 BTC is generally framed as a tail-risk / crash scenario, usually requiring synchronized stress such as liquidity contraction, institutional outflows, forced deleveraging, and confidence shock.

That matters for Convex because Ethereum DeFi revenues and token prices are highly correlated with overall crypto beta; however, the provided sources do not verify Convex’s exact Ethereum TVL, treasury composition, or liquidation sensitivity under this scenario. Not verifiable as of 2026-09-04. Practical stress implications for Convex would likely include:

• Lower CVX price from sector-wide de-risking and reduced demand for yield exposure.
• Potential TVL outflows if users unwind leveraged or discretionary DeFi positions during a market-wide drawdown.
• Reduced fee generation if protocol activity and liquidity-mining demand fall in a crypto bear market.
• Higher correlation risk to the broader Ethereum DeFi stack, meaning Convex could underperform even without a protocol flaw. What is not verifiable from the supplied sources is whether Convex has any direct balance-sheet exposure that would create solvency risk from BTC below $10,000. Not verifiable as of 2026-09-04.

For Convex Finance on Ethereum, the effect of a 20% depeg in the largest collateral asset is Not verifiable as of 2026-09-04 from the available sources. The search results do confirm that Convex operates on Ethereum and that depeg/liquidation stress can matter in DeFi generally, but they do not provide the protocol’s current collateral composition, leverage exposures, or liquidation thresholds needed to quantify loss under a 20% shock. What can be said with confidence is limited to structure, not magnitude: Convex is an Ethereum-based protocol, and if its exposure includes collateralized positions or collateral-dependent yield strategies, a 20% price drop in the largest collateral would typically increase liquidation and impairment risk in any DeFi system that uses collateral thresholds.

However, Convex-specific exposure to that scenario cannot be verified from these sources, and the only protocol-specific risk material in the results is a high-level warning that some or all funds can be lost. The independent risk article mentions potential failure modes such as governance capture and notes user deposits, but it does not give the on-chain collateral breakdown required for a depeg stress test. Because Dune/on-chain tooling is unavailable in this run, the largest-collateral depeg impact remains Not verifiable as of 2026-09-04.

Convex is an aggregator of Curve LP and CRV staking positions; its main counterparties are Curve pools, Curve LPs, and the CRV/CVX markets. Because on-chain data via Dune is unavailable, all on-chain-specific figures are Not verifiable as of 2026-09-04. ### 1. Curve protocol insolvency / critical exploit Loss path

• Curve pool assets backing Convex users’ deposits become undercollateralized or drained.
• Convex strategies holding Curve LP tokens/CRV lose value or are stuck. Who absorbs it
• Economic loss is borne by Convex depositors (Curve LP stakers, cvxCRV holders) whose positions are routed into Curve.
• Convex smart contracts continue to enforce existing accounting; they do *not* guarantee solvency of Curve. Compensation
• There is no built-in insurance in Convex contracts; any compensation would be ex-post via governance/treasury, if decided.
• Extent of treasury and reserves: Not verifiable as of 2026-09-04. Impact path through contracts
• Reward-claiming and staking contracts continue to operate, but rewards become negligible or worthless if Curve emissions collapse.
• Withdrawal functions should still allow exiting, but users realize losses when redeeming Curve LP/CRV at impaired prices. ### 2. cvxCRV / CRV market collapse (liquidity insolvency) Loss path
• Severe price crash or liquidity disappearance in CRV/cvxCRV markets on Ethereum.
• Convex users holding cvxCRV or CRV via Convex experience mark-to-market losses. Who absorbs it
• Losses absorbed by token holders and stakers; Convex contracts track balances, not value.
• Convex protocol itself is not economically short CRV; it is structurally long CRV and Curve LP exposure. Compensation & impact
• No automatic compensation; any treasury intervention would be governance-driven (unverified marketing claim absent direct audit/governance evidence).
• Smart contracts maintain accounting; price risk is realized externally on DEX/CEX trades. ### 3. Major Convex contract bug / governance failure Loss path
• Exploit drains staked assets or mis-allocates rewards from core staking/booster contracts. Who absorbs it
• Direct loss to Convex depositors in affected contracts; CVX holders bear secondary loss via token repricing. Compensation & impact path
• Recovery would depend on upgradeability/emergency controls and governance; details per contract are Not verifiable as of 2026-09-04.
• If contracts are non-upgradeable, remediation is limited to new deployments and social coordination; if upgradeable, admins could pause/migrate, introducing admin-key risk. Sources: protocol docs and independent analyses of Convex’s architecture and Curve integration.

For Convex Finance on Ethereum, I found no verifiable evidence that the DAO or owners committed fraud. The strongest available evidence points instead to a documented DNS/website compromise in June 2022, where attackers redirected users to malicious contracts; Convex says the protocol contracts are immutable and the multisig does not have direct access to user deposits. There is, however, a separately documented governance/admin risk that could theoretically be abused: Convex’s own docs describe a known, hard-to-execute shutdown path involving fake gauges, Curve governance manipulation, and timelocked force-shutdown actions.

That is a protocol-design weakness, not evidence that the DAO or owners actually executed fraud. A prior audit-related issue also found that if two of three multisig signers acted maliciously, they could potentially access liquidity provider tokens; the issue was patched and was never exploited. That again indicates *attack surface*, not proven fraudulent conduct by the DAO or owners.

So, under the stress scenario “committed fraud by the DAO or owners,” the answer is: Not verifiable as of 2026-09-04. The available record supports phishing/spoofing and latent governance weaknesses, but not confirmed fraud by Convex’s DAO or owners.

Convex Finance’s primary yield source appears to be the boosted Curve-related rewards it passes to LPs and cvxCRV stakers, plus CVX incentives; however, a negative 30d primary-yield scenario is not verifiable as of 2026-09-04 from the provided results because none of the sources supply a 30-day yield time series for Convex on Ethereum. What can be stated from the sources is that Convex’s yield model depends on Curve admin fees, boosted CRV emissions, and CVX rewards, and that the protocol is built on Ethereum mainnet. The available third-party snapshots only show current or average APY, not a 30-day decline metric: DefiLlama lists an average APY of 6.57%, and DIA lists 9.83% average APY, but neither confirms a negative 30-day yield trend.

For a stress scenario, the key risk implication is that if the pool’s current yield source turned negative over 30 days, Convex would be under pressure because its value proposition is explicitly tied to maintaining positive boosted yield relative to Curve-native participation. That would likely matter most for LP retention and deposit stickiness, but the magnitude and whether Ethereum-only exposure is material cannot be verified from the provided sources. Not verifiable as of 2026-09-04: 30d primary-yield return, yield contribution breakdown on Ethereum, and whether the protocol’s current yield is actually negative over the last 30 days.

As of September 13, 2026, Convex’s Ethereum governance is not fully sovereign DAO governance. vlCVX holders vote through Snapshot on governance and Curve gauge outcomes, but Convex states that its 3-of-5 multisig must sign and establish the final on-chain outcome and may reject proposals considered attacks. The newer voting repository describes a planned transition toward direct token-weighted ownership, but replacement of the existing control path is not verified. Multisig/control. Published Safe: 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB; threshold 3 of 5. Listed signers: C2tP and Winthorpe (Convex), Benny (Llama Airforce), Tommy (Votium), and Sam (Frax Finance).

The multisig controls treasury administration, fee parameters within hard-coded ranges, MasterChef distribution weights, pool/stash managers, Curve voting, deposits shutdown, vlCVX parameters, and treasury address allocation. It can pause new deposits while allowing withdrawals. Funds and emergency powers. Convex documentation says the multisig cannot directly access user deposits and that shutdown paths allow withdrawals; therefore direct admin draining of user funds is not evidenced. Treasury funds are multisig-controlled.

No timelock delay is documented; the stated rationale is that user deposits are inaccessible to the admin. Signer independence is partial: two signers represent Convex, while three represent external ecosystem entities. Proposal process. Snapshot proposals are weighted by vlCVX; results are generally submitted proportionally, subject to multisig approval. Gauge votes are biweekly.

Public implementation repositories show proposal/executor infrastructure, but do not prove that token holders control Convex upgrades today. Concentration / top holders. Not verifiable as of September 13, 2026. Dune MCP was unavailable; no on-chain holder-concentration claim is made. Contract/frontend control, legal entity, jurisdiction, registration number, directors, and Terms-of-Service company details: Not verifiable as of September 13, 2026.

Public reporting describes the team as pseudonymous and no publicly identified legal entity.

Convex Finance appears to use California law and exclusive jurisdiction in Los Angeles County for its terms, and its terms reference a Data Protection Addendum and Privacy Policy for handling customer personal data. I could not verify a separate, clearly identified legal entity for the DeFi protocol itself from the available sources, so the protocol entity is Not verifiable as of 2026-09-04. No reliable source found in this pass showing KYC/AML obligations imposed on users, and no verified evidence of regulator action, court cases, or sanctions specifically against Convex Finance or its controlling entity.

Based on the available record, this looks like a protocol with contractual terms for its web/service layer, but the actual legal-risk profile may still differ from the on-chain protocol risk because governance, control, and liability allocation were not verifiable from these sources. Data protection obligations are addressed in the service terms, but the scope and applicability to the DeFi protocol itself are not fully verifiable from the available sources.

GLEIF LEI registry unavailable at scan time. OFAC SDN screening of 'Convex Finance': no match. SEC litigation and administrative release feeds: no mention.

Convex Finance does not appear to issue a protocol-native stablecoin; its primary assets are CVX and cvxCRV, and the available non-protocol sources describe Convex as a yield optimizer built on Curve rather than a stablecoin issuer. No verified Convex-issued stablecoin was identified in the available sources, so any stablecoin depeg count, last depeg date, and depeg percentage are not verifiable as of 2026-09-06. The protocol is therefore best classified as stable with respect to the question asked, because there is no confirmed own stablecoin to depeg.

Convex’s principal risks are concentrated in smart-contract complexity, dependence on Curve/Frax, privileged governance, and liquidity-sensitive token economics. Current Ethereum TVL, asset concentration, treasury balances, and voting concentration are Not verifiable as of September 5, 2026 because the Dune MCP is unavailable; no on-chain figures are inferred.

Convex Finance’s top strengths are: boosted Curve yields without requiring users to lock CRV themselves, simple and capital-efficient yield optimization on top of Curve, a dual-reward model that adds CVX incentives alongside Curve rewards, deep integration with Curve and strong governance/veCRV influence, and a reported strong security track record with audited, non-custodial smart contracts. In practical terms, that means users can access near-maximum Curve boost while avoiding the operational burden of managing veCRV locks, and the protocol’s design concentrates governance power in a way that reinforces its yield advantage. Sources describing these advantages are consistent across independent reviews and protocol-adjacent explainers, though the exact boost and governance-share figures should be treated as descriptive rather than on-chain verified here.