Curve DEX

Curve is a decentralized exchange (DEX) and automated market maker (AMM) optimized for swaps between stablecoins and similarly priced assets using the StableSwap invariant. ### Protocol identification

• Name: Curve Finance / Curve DEX
• Category: DeFi DEX / AMM for stable and pegged assets (stablecoins, wrapped BTC/ETH, LSTs).
• Launch date: Protocol launched on Ethereum in January 2020 (mainnet launch around 3 January 2020).
• Website: Public sources identify curve.fi as the primary front-end and hub for the protocol (not directly cited here per constraints; treat as standard industry knowledge).
• Docs: The Curve Knowledge Hub / Technical Docs are hosted under the protocol’s documentation domain, describing user, developer, and factory documentation.
• Native token: CRV – governance and incentive token of the Curve DAO; launched August 2020 on Ethereum, max supply ~3.03B.
• Chains: Documentation and analytics sources confirm deployments on Ethereum mainnet and multiple EVM L2/sidechains, including Arbitrum, Avalanche, Fantom, Optimism (OP Mainnet), Polygon, Gnosis/xDai and others.
• Presence on some newer chains in your list (Base, Fraxtal, Kava, Monad, Plasma, Sonic) is mentioned in factory/deployment docs for “EVM-compatible sidechains/L2s” and specific implementations (e.g., Sonic admin blueprint), but per-contract, chain-specific deployment details are Not verifiable as of 2026-09-04 from the retrieved data. ### Main contracts (high level)
• Curve uses pool implementation contracts and factory contracts (ERC‑5202 blueprints) from which pools, gauges and LP tokens are deployed.
• Pools are categorized as plain pools, lending pools, and metapools implementing the StableSwap invariant.
• Exact “main” contract addresses and explorer verification status per chain are Not verifiable as of 2026-09-04 from the available data (would normally require direct explorer/on-chain checks). ### Fork lineage and design
• Curve is not described as a fork of another DEX; it is generally treated as an original protocol introducing the StableSwap algorithm, later forked by others.
• The StableSwap AMM is presented as its own invariant, distinct from Uniswap’s constant product, concentrating liquidity near the peg.
• The documentation highlights additional innovations such as crvUSD and Curve Lending with LLAMMA liquidation mechanisms, which are native developments of Curve.
• Audits: Public sources and industry practice indicate Curve has undergone multiple formal audits, but specific reports, auditors, and coverage of incremental changes are Not verifiable as of 2026-09-04 from the retrieved snippets.
• Malicious-modification history in similar forks: Many later DEXes and stable-swap AMMs adopted or forked Curve’s design, and some forks have had incidents; however, no concrete, source-backed catalog of malicious modifications in Curve-style forks is available in the retrieved data, so this item is Not verifiable as of 2026-09-04.

Curve DEX appears to be a real, functional product rather than a pure landing page: the documentation site includes user guides for depositing, staking, unstaking, and withdrawing, and the docs explicitly describe live UI actions for those flows. The documentation portal also contains developer material and an API reference, which is a strong sign of product maturity and integration readiness. The best-supported open-API signal is the published Curve API documentation and OpenAPI spec referenced in the project’s public GitHub repository, plus the docs site’s dedicated curve-api section.

That indicates an open, documented API exists. What is not verifiable from the gathered web evidence is the live operational state of the app today across the listed chains, including whether deposits/withdrawals are currently working on each network, and whether any broken links, fake metrics, or template-style placeholders exist. Not verifiable as of 2026-09-04.

Overall assessment: high maturity on documentation and developer tooling; likely a real portal with functional user flows; open API present; live-chain execution status and any UI defects remain unverified as of 2026-09-04.

Curve appears to have an active bug bounty/security reporting program. The program is documented in Curve’s security page and in Curve DAO contracts/GitHub as an active bounty for issues that can cause substantial loss of money, broken liveness, or irreversible loss of funds. It is not verifiable as of 2026-09-04 whether this is run through a formal third-party platform or managed directly by Curve; the public documentation reviewed does not show a named platform.

The documented payout matrix on Curve’s security page shows rewards from $250 to $250,000 depending on likelihood/severity, with the top tier at $250,000. The security page itself is dated 2020-07-10, which is the earliest public evidence found for this program. No independently verifiable results table or total paid-out amount was found in the reviewed sources, so the program’s realized results are Not verifiable as of 2026-09-04.

As of September 6, 2026 — Curve DEX dependency and counterparty risk Assessment: HIGH and multi-layered. Curve has no inherent centralized custodian or mandatory CEX/MM dependency; however, pool users inherit the solvency, oracle, bridge, and governance risks of every listed asset and integration.

• Bridges/cross-chain: Curve uses canonical L2 bridges for some crvUSD routes and a LayerZero-based FastBridge for Arbitrum, OP Mainnet, and Fraxtal. FastBridge can release temporarily “unbacked” crvUSD before canonical settlement; compromised DVNs or messenger contracts could censor transfers or mint excess destination tokens. Curve paused LayerZero infrastructure in April 2026 after an external rsETH exploit, then resumed selected CRV bridges with conservative 10,000-CRV chain limits and reduced daily limits.
• Oracle/manipulation: crvUSD/LlamaLend markets depend on Curve-derived and external pricing. ChainSecurity identified oracle-update sandwich risk and liquidation feedback loops in illiquid pools. A 2026 LlamaLend sDOLA incident reportedly caused approximately 822,475 crvUSD of borrower-equity losses through rate manipulation, distorted oracle pricing, and liquidations.
• Stablecoin, LST/LRT, RWA and issuer exposure: Curve pools can contain USDC/USDT-like stablecoins, ETH derivatives/LSTs, protocol-issued stablecoins, and newer RWA-linked assets such as FIDD. A depeg, issuer freeze, redemption failure, rehypothecation loss, or bridge failure can create LP losses and liquidation cascades. Exact asset-by-asset exposure by chain is Not verifiable as of September 6, 2026 because Dune MCP is unavailable.
• crvUSD/scrvUSD dependency: crvUSD is exposed to collateral liquidity, LLAMMA liquidation mechanics, PegKeeper/governance parameters, and cross-chain liquidity fragmentation; scrvUSD adds vault/accounting and redemption-liquidity dependence. The protocol reported crvUSD remained near peg through the 2026 market decline, but this is protocol-sourced and not an independent on-chain verification. > Contradiction / update: Prior notes cited Superbridge for some crvUSD routes. Current evidence confirms LayerZero FastBridge for Arbitrum, OP Mainnet, and Fraxtal; a current Superbridge dependency is Not verifiable as of September 6, 2026. CEX/MM, custodian, issuer concentration, chain-level TVL shares, and maximum counterparty exposure are Not verifiable as of September 6, 2026 without raw on-chain analysis. No Dune query ID or execution ID is available. Failure scenarios: bridge minting or censorship; stablecoin/LST/RWA depeg; oracle manipulation; thin-pool liquidation spiral; crvUSD bank-run/redemption stress; issuer insolvency or sanctions freeze; governance/admin-key compromise. Structured fields: dependency_failure_active: null; max_exposure_pct: null

Curve DEX is organized as a non-custodial protocol: users interact with smart contracts/pools directly, and Curve does not take possession of user private keys or hold user assets in the way a centralized custodian would. Governance is organized through Curve DAO, with CRV holders able to lock tokens as veCRV to vote on protocol parameters, gauges, fees, and related changes. For chain-native and ERC-20 assets managed by the DAO across non-Ethereum chains, Curve documentation describes a DAO-controlled Vault contract, but that is protocol treasury/governance custody rather than user custody.

Withdrawal status is not verifiable as of 2026-09-06.

Curve DEX: Frontend & Infrastructure via DNS Hijack on Ethereum; loss $575,000, returned $575,000 (DeFiLlama hacks registry). Remediation status: resolved (retained evidence).

Curve DEX: Reentrancy via Vyper Compiler Bug on Ethereum; loss $61,700,000 (DeFiLlama hacks registry). Remediation status: resolved (retained evidence).

2024-06-12 — crvUSD upward depeg and sUSDe LlamaLend liquidation cascade (Ethereum): PegKeeper V2’s deviation check failed to stabilize crvUSD during liquidation demand, causing improper liquidation of sUSDe borrowers. Reported user loss was approximately $31,000. Curve proposed 112,637 CRV compensation, but governance commentary records that the compensation vote was rejected and payment was not executed.

PegKeeper and market-design mitigations were pursued. Status: remediation_in_progress; reimbursement unresolved.

2025-05-12 — Curve.fi frontend/domain hijack: registrar/DNS compromise redirected users to a malicious imitation site that solicited wallet signatures. Curve contracts and infrastructure were not compromised. Media reported approximately $450,000 stolen and substantial recovery, while a later governance proposal documented materially different claimant totals and said any DAO reimbursement was discretionary and not guaranteed.

Therefore final recovered amount and reimbursement completion are Not verifiable as of September 6, 2026. The domain was taken offline and Curve moved users to curve.finance. Status: remediation_in_progress.

August 2025 DNS/domain compromise affecting Curve front-end access: reporting says Curve shifted to a new domain after a DNS attack. Reported impact was about $450,000 stolen, with more than 83% reportedly recovered and reimbursed to impacted users. Because only media coverage was available in this run and no on-chain verification was possible, this should be treated as an incident report rather than a fully verified chain-level accounting.

Current status: resolved.

2025-10-10 — CRV-long LlamaLend market (Ethereum): liquidation-mechanism failure and accumulated bad debt, with no identified external attacker. Lenders became unable to withdraw fully; vault assets were reported around 70% backed, implying approximately $700,000 of lender loss/underbacking. Curve deprecated the market and proposed a permissionless recovery pool using impaired vault tokens, but this is not a guaranteed repayment.

No reimbursement was verified. Status: unresolved.

2026-01-20 — DUSD/USDC Curve pool (Ethereum): flash-loan manipulation of Makina’s MIM/3CRV accounting instruction inflated DUSD’s external Curve oracle and drained USDC. Affected users were LPs, not funds inside Makina machines. Gross user loss was approximately $6.16m: $4.2m direct exploit loss, $884k execution costs, and $1.076m post-exploit toxic flow.

Attacker/MEV proceeds were approximately 1,299 ETH (~$4.2m). Recovery mode, withdrawals and redemptions were paused; accounting was hardened, permissioned keepers enabled, and operations restored on January 26. Approximately $3.65m was recovered or committed for distribution, but about $2.15m remained unrecovered in the latest disclosed accounting.

Users received partial restitution; full reimbursement is not verified. Status: remediation_in_progress.

2026-03-02 — sDOLA/crvUSD LlamaLend (Ethereum): flash-loan/oracle manipulation inflated the sDOLA rate and triggered hard liquidation of 27 borrowers. Borrower equity loss was approximately 822,475 crvUSD; lenders and Curve incurred no bad debt. Attacker proceeds were estimated at $240,000–$245,000.

The market was deprecated and removed from the UI; higher borrow rates and oracle redesigns were pursued. Compensation proposals remained pending, with the funding-source proposal explicitly stating that final repayment terms were not agreed. Status: remediation_in_progress; reimbursement not executed.

Curve DEX does not appear to organize key management around a protocol-controlled custody or wallet layer. The core architecture is a set of smart contracts for swaps, liquidity, gauges, fee distribution, and governance, while user control is centered on CRV/veCRV governance rather than any protocol-managed private-key system. For users, key management is therefore self-custodial by default: interacting with Curve means using an external wallet that the user controls, and Curve itself does not disclose a proprietary MPC, multisig wallet product, or embedded key-rotation system in the materials provided.

The governance model instead relies on locking CRV into veCRV, which gives voting power over gauge weights and protocol decisions; that is governance access, not custody of private keys. What is verifiable from the available sources is that Curve’s operational control is organized through on-chain contracts and DAO governance, not through a centralized key-management service. Not verifiable as of 2026-09-04: whether any specific admin, upgrade, or emergency controls use multisig, timelocks, or other off-chain key-management arrangements, because the provided sources do not confirm those details.

Assessment — as of 2026-09-06. Dune was unavailable; therefore no raw on-chain state, decoded proxy-admin events, current role reads, timelock measurement, or Dune query/execution IDs are available. Architecture / addresses ``text veCRV holders → Curve DAO governance → Agent / cross-chain relayer → Ownership / Parameter / Emergency Admins → factories, gauges, pools, fee vaults Users → Router/Registry → pool contracts → LP tokens / gauges ` The documented legacy control path is DAO → Aragon Agent → Ownership Proxy → Contracts; PoolProxy controlled pool administration and GaugeProxy controlled gauges. Governance had separate ownership, parameter, and emergency authorities. A canonical Address Provider is 0x0000000022d53366457f9d5e68ec105046fc4383` on Ethereum and sidechains in the legacy registry documentation/source.

The current Curve Core registry defines slots for Ownership Admin, Parameter Admin, Emergency Admin, governance agent/relayer, and fee vault, but the registry itself is not proof of live state. An Ethereum explorer labels 0x40907540d8a6C65c637785e8f8B742ae6b0b9968 as “Curve: Ownership Agent”; this is an explorer attribution, not a verified cross-chain admin map. Admin powers / exit risk

• Pool admin code includes fee withdrawal, pool kill/unkill, parameter changes, ownership/admin rotation, burner controls, and selected oracle/parameter configuration.
• Emergency authority can kill pools/gauges; parameter authority can change pool parameters. Governance execution historically required voting delays/quorum, but the live timelock delay is Not verifiable as of 2026-09-06.
• Ordinary LPs generally retain direct pool withdrawal paths; however, ability to exit every listed deployment, and whether any vault/strategy can block or redirect withdrawals, is Not verifiable as of 2026-09-06.
• Key compromise worst case: malicious parameter/fee changes, pool/gauge shutdown, admin-fee extraction, replacement of admin authorities, or—where an upgradeable/vault component exists—malicious implementation or asset-routing changes. Arbitrary draining of all user funds by the core pool admin is Not verifiable as of 2026-09-06. Contradiction / limitation: Curve publishes audited components, but audit coverage does not prove every listed chain deployment matches audited bytecode. Deployment-to-audit matching and unresolved finding counts are Not verifiable as of 2026-09-06.

ETH/sETH pool implementation (Curve v1 style stableswap‑like pool on Ethereum).

ChainSecurity — Curve Tricrypto

Curve Stablecoin Smart Contracts (crvUSD AMM)

ChainSecurity has multiple independent audits for Curve’s stablecoin stack and scrvUSD, which are tightly coupled with Curve DEX liquidity flows. Scopes:

• Curve Stablecoin (crvUSD) – code assessment focusing on solvency, rounding, oracle design, and systemic risk; multiple review iterations.
• Curve scrvUSD – audit focused on Yearn vault usage, access control, and accounting correctness. Severity & findings:
• For crvUSD, ChainSecurity reports that all high severity findings were resolved, while some medium and numerous low severity issues remain, judged mostly benign given fixes to severe issues.
• For scrvUSD, the report states security regarding core subjects is “high”, with the final summary indicating a high level of security. Fix status / deployed code coverage:
• ChainSecurity explicitly tracks resolved vs. open findings across audit iterations, confirming high‑severity items were fixed in the reviewed codebase.
• No public bytecode‑matching vs. multi‑chain deployments; whether audited versions match live contracts on Arbitrum, Avalanche, Base, Ethereum, Fantom, Fraxtal, Gnosis, Kava, Monad, OP, Plasma, Polygon, Sonic is Not verifiable as of 2026‑08‑29. These audits materially cover Curve’s stablecoin‑integrated AMM behavior but are not full‑stack attestations of every DEX pool implementation on each listed chain.

Curve scrvUSD — ChainSecurity code assessment

Curve Stablecoin — ChainSecurity cumulative code assessment

Curve Lending — StateMind audit report

Curve Lending / LlamaLend — MixBytes audit report

Curve PegKeeperV2 — ChainSecurity audit

Curve Tricrypto-NG — ChainSecurity audit

Curve DAO BalanceTimeForwarder (voting forwarder) contract.

Curve DAO Voting.sol (Aragon voting fork) smart contract.

Curve DAO Voting Forwarder

Curve DAO Voting (Aragon Voting)

Curve’s official audit catalog lists MixBytes across DAO, DEX, lending and crvUSD components. Relevant scopes for the DEX stack:

• Aragon voting fork / DAO voting – governance contracts used for Curve DAO voting; MixBytes reports in 2022.
• Curve Stablecoin (crvUSD) & LLAMMA – audits in Apr–Jun 2023 with three auditors; covers solvency, liquidation and AMM mechanics which are tightly integrated with Curve pools.
• Curve Lending (TwoWayLendingFactory, hybrid vaults) – audits Feb–May 2024 with multiple re‑audits to July 2024; includes interactions with Curve pools and vault‑style DEX liquidity. Severity & findings:
• MixBytes crvUSD and lending reports describe inflation attacks, liquidation edge cases and numerical/rounding risks, typically classified medium–high in text, all marked as fixed in specific commits (e.g., commit 9e20913f… for an inflation‑attack fix).
• Final DAO voting reports state the fixed contract doesn't have any vulnerabilities according to our analysis, implying no remaining critical/high findings at report time. Fix status / deployed code coverage:
• MixBytes README files map findings directly to commit hashes marked as “Final commit” or "commit for re‑audit", indicating fixes were implemented in the reviewed code.
• Whether these exact audited commits match the currently deployed bytecode on each chain is Not verifiable as of 2026‑08‑29. Scope spans Ethereum‑centric core systems (DAO voting, crvUSD, lending) that underpin Curve’s multi‑chain DEX but does not provide chain‑by‑chain attestations for Arbitrum, Avalanche, Base, Fantom, Fraxtal, Gnosis, Kava, Monad, OP, Plasma, Polygon, Sonic.

Curve Stablecoin (crvUSD)

Stableswap‑NG (next‑generation stable pool factory / implementation used across Ethereum and L2s).

crvUSD stablecoin and lending infrastructure, including PegKeeper V2 and Savings‑crvUSD (scrvUSD).

Quantstamp — Curve DAO / CRV Liquidity Mining Audit

Curve CRV Liquidity Mining & CurveDAO reward mechanism

Curve Finance Liquidity Pool (AMM contracts, diff assessment)

Curve’s docs list multiple DAO/DEX audits by Trail of Bits; reports cover Curve DAO, stablecoin pools and core AMM logic, primarily on Ethereum mainnet. Key ones relevant to the DEX:

• Curve DAO / core contracts – security assessments in Jan 2020 and Jun–Jul 2020, covering Curve DAO, governance, and associated Curve pools. Severity & findings (DEX/DAO-related):
• Reports describe several low–medium severity issues; public summaries emphasize that identified issues were fixed in follow‑up audits.
• No public mention of unresolved critical issues for the audited DAO/DEX code. Fix status / deployed code coverage:
• Follow‑up Trail of Bits audit explicitly states Curve "correctly fixed the reported issues" from the first audit, indicating fixes were merged in audited commits.
• Bytecode‑match vs. deployed contracts across Curve’s many chains is Not verifiable as of 2026‑08‑29 (no on‑chain tooling this run). Scope clearly focuses on DAO & DEX logic, but chain‑specific deployments (Arbitrum, Avalanche, Base, Fantom, Fraxtal, Gnosis, Kava, Monad, OP, Plasma, Polygon, Sonic) are not individually attested in the public reports – extrapolation from Ethereum audits only.

Curve DAO Contracts (follow‑up)

Curve Finance (Curve DEX) was founded and is still led by Michael Egorov, a publicly known, non‑anonymous founder with a long technical track record in crypto infrastructure. Founders & prior projects

• Michael Egorov – Russian‑born physicist, software developer, and entrepreneur; recognized broadly as the founder and CEO of Curve Finance.
• Prior projects:
• NuCypher – privacy‑preserving encryption/infrastructure project; Egorov was co‑founder and CTO, including through Y Combinator.
• Yield Basis – a later Bitcoin yield protocol launched by Egorov after Curve, focused on sustainable on‑chain returns. These are established, venture‑backed crypto infrastructure projects; no major protocol‑level hacks tied to Egorov’s prior work are reported in the retrieved material (Curve itself has experienced exploits, but that’s outside the scope of this founder‑focused question). Team, public vs. anonymous
• Egorov has public LinkedIn, media, and podcast presence and writes/appears as “Founder of Curve Finance.”
• He is active on X (Twitter) under @newmichwill, explicitly branded as Curve founder, with a sizable following.
• Broader team details (other executives, engineers) are not systematically disclosed in retrieved independent profiles; Curve historically presents itself as a protocol rather than a traditional corporate org chart. Not verifiable as of 2026‑09‑04. Jurisdiction, office, and corporate reality
• Multiple profiles describe Curve Finance as a Swiss‑based company, with Egorov as CEO of “Curve Finance” or “Curve Finance Labs.”
• A California Court of Appeal case references Swiss Stake GmbH, an entity founded by Egorov to “facilitate the advancement of Curve Finance,” indicating a formal corporate vehicle used in a Swiss/European context and involvement in US litigation with venture firms.
• Physical office address, exact Swiss canton, and detailed corporate filings are not visible in the retrieved data; therefore any specific office location, onshore/offshore tax status, or number of employees is Not verifiable as of 2026‑09‑04. Reality check: real business vs. web front
• Evidence of:
• Named founder with long‑running, cross‑checked public identity.
• Prior VC‑backed project (NuCypher) and further protocol launches (Yield Basis).
• Formal entities (e.g., Swiss Stake GmbH) engaged in multi‑year court proceedings.
• Ongoing public media, podcast, and education content under corporate branding (Curve Finance Labs). Taken together, Curve looks like a real, founder‑led business with corporate entities and extensive public footprint, not a purely anonymous web front. Detailed corporate structuring (group entities, ownership, regulatory status) remains Not verifiable as of 2026‑09‑04.

Curve Finance (Curve DEX) has a mixed but generally serious, systemically important reputation: widely used, no fraud/rug-pull history, but significant concerns around founder leverage, past exploits, and complex risk profile. Founders & key reputation issues

• The main founder is Michael Egorov, whose large, heavily collateralized CRV borrowing across multiple lending protocols (Aave, Fraxlend, Inverse, Cream, Silo, etc.) has repeatedly created systemic risk narratives for DeFi, with debts in the tens of millions of USD backed by hundreds of millions of CRV.
• In 2023, Egorov’s positions were close to liquidation and risk teams (e.g., Gauntlet on Aave) recommended freezing the Aave v2 CRV market to avoid protocol bad debt, underscoring concern about concentration and governance-token risk.
• He responded by selling over 100M CRV OTC to investors to repay loans and later fully cleared his Aave debt, but still had sizable exposure on other protocols.
• Media and research pieces frame this not as fraud, but as founder risk and misaligned incentives (large personal leverage using the protocol’s governance token), seen as a key reputational weakness. Exploits, security, and operational reputation
• Curve has suffered major pool exploits (e.g., 2023 issues in certain pools and lending pools affecting CRV price, with over $60–100M at risk or lost), which triggered sharp CRV dumps and aggravated Egorov liquidation risk.
• These incidents damaged short‑term sentiment but did not lead to protocol abandonment; Curve remained a core DeFi venue. Claims about full security posture and audits across all chains/contracts are Not verifiable as of 2026‑09‑04. Legal / regulatory / sanctions
• A long‑running civil dispute with venture capital firms over an investment arrangement ended with a court victory for Egorov, as a California appellate court upheld that California lacked jurisdiction due to Swiss law/jurisdiction clauses, rejecting the VCs’ appeal. This reflects litigation around fundraising, not fraud by Curve itself.
• There is no public record in the gathered data of regulatory enforcement actions, criminal charges, or sanctions against Curve or its founder; broader regulatory status is Not verifiable as of 2026‑09‑04. Sentiment & unresolved concerns
• Curve is viewed as a foundational DeFi protocol but with ongoing concerns:
• Concentrated governance and token holdings in the founder’s hands.
• History of large, complex debt positions posing contagion risk when CRV price falls.
• Past exploits and complexity across many chains/pools.
• No evidence of rug‑pull or intentional fraud was found, but founder leverage, governance concentration, and security track record are persistent, unresolved risk factors. On‑chain verification of TVL distribution, chain‑by‑chain exposures, and detailed auditor history is Not verifiable as of 2026‑09‑04.

Economic model — Curve DEX (reviewed September 6, 2026)

• Strategy/assets in: Permissionless AMMs: StableSwap pools for stable/pegged assets, CryptoSwap pools for more directional assets, and crvUSD/LLAMMA and LlamaLend markets. LPs deposit stablecoins, LSDs, wrapped assets or volatile tokens and receive LP tokens; gauges may add CRV incentives.
• Yield source: Trading fees are the primary organic source. Subsidized yield consists mainly of CRV/gauge emissions and potentially third-party incentives. Some lending products introduce interest income and external collateral/borrower risk. Fee parameters vary by pool; legacy documentation and audits commonly describe a 50% admin-fee share, but this is not a universal current parameter.
• Risk posture: Stable pools are relatively market-neutral only while assets remain pegged; CryptoSwap, LSD and crvUSD collateral pools are directional and carry depeg, oracle, impermanent-loss and liquidation risks. Curve itself does not impose protocol-wide leverage, looping or restaking, but LlamaLend/crvUSD supports overcollateralized borrowing and can create leverage externally.
• Lockups/withdrawal: Ordinary LP liquidity is generally withdrawable subject to pool liquidity, slippage, imbalance fees and transaction limits. veCRV governance locks are time-based; gauge deposits are separately withdrawable. crvUSD borrowers face collateral bands/soft liquidation rather than an ordinary LP lock.
• Fees/revenue: DeFiLlama reports approximately $64.1m annualized fees, $4.11m fees over 30 days, $1.2m revenue over 30 days and $729.7k incentives over 30 days. These are aggregator figures, not on-chain verified.
• TVL: DeFiLlama’s displayed TVL for the user-specified chains sums to approximately $1.330bn: Ethereum $1.276bn; Fraxtal $9.96m; Arbitrum $9.51m; Base $8.99m; Monad $8.70m; Polygon $5.67m; OP Mainnet $2.84m; Plasma $2.75m; Avalanche $2.52m; Gnosis $2.10m; Fantom $0.91m; Sonic $0.20m; Kava $0.08m. Product-level TVL, historical trend, APY history/volatility and Dune-vs-DeFiLlama reconciliation: Not verifiable as of September 6, 2026. Contradiction: The prior note says assets are not rehypothecated; this is too broad. Plain AMM liquidity is not lending collateral, but Curve’s documented lending pools/LlamaLend explicitly add lending and external-exposure pathways. Assessment: Organic yield is fee-dependent but incentive subsidies remain material; sustainability is therefore pool- and emissions-dependent, not protocol-wide. Structured fields: organic_yield_pct: null; leverage_ratio: null.

Assessment — as of September 6, 2026 Curve’s reserves are fragmented across at least three DAO-controlled buckets rather than one consolidated balance sheet:

• DAO Treasury (Ethereum): 0x6508eF65b0Bd57eaBD0f1D52685A70433B2d290B. It receives 10% of designated protocol revenue through the FeeAllocator and is controlled through Curve governance.
• Community Fund: 0xe3997288987E6297Ad550A69B31439504F513267, historically seeded with 151.5M CRV and now a finite, depleting reserve. A March 2026 governance budget described approximately 7.1M CRV remaining; a later April 2026 proposal cited approximately 845K CRV, indicating either subsequent distributions or inconsistent wallet/accounting scope.
• Grants multisig: 0xc420C9d507D0E038BD76383AaADCAd576ed0073c; an April 2026 governance source reported approximately 10.4M CRV and 15K scrvUSD. Composition and policy: Reserves are primarily CRV in the legacy Community Fund and crvUSD in the newer Treasury. In July 2026, governance approved moving certain Arbitrum/Base fee-collector crvUSD to the Ethereum Treasury. Governance also approved a Treasury Stable Diversification contract (0x70b3d2c2A508A87f9C18F46fe9ca42307CD021f7) to convert part of Treasury crvUSD into yield-bearing stable assets such as sDOLA and sfrxUSD. Custody/control: Treasury funds remain DAO-controlled; execution is performed through governance-approved contracts, vesting contracts, and multisigs. Emergency DAO access of up to 400,000 crvUSD was proposed for peg defense, creating an operational-control concentration point. > Contradiction / data-quality finding: Published figures conflict materially: approximately 7.1M CRV, approximately 845K CRV, and an older $16M CRV estimate describe different dates and/or reserve scopes. The figures are not a consolidated, independently attested balance sheet. On-chain balances via Dune: Not verifiable as of September 6, 2026. Dune MCP was unavailable; no current cross-chain balance or custody computation is asserted. Attestations: Not verifiable as of September 6, 2026. No independent reserve attestation was identified in the reviewed sources. Liabilities: No consolidated DAO-treasury liabilities statement was identified; crvUSD protocol debt and proposed remediation obligations are separate from treasury liabilities.

Curve DEX (Curve Finance) does have a native token: Curve DAO Token (CRV), used across all supported chains via bridges. Token identity & main contract

• Name / ticker: Curve DAO Token (CRV).
• Canonical contract (Ethereum): 0xD533a949740bb3306d119CC777fa900bA034cd52. All other chains use bridged/wrapped CRV; exact addresses per chain are not independently verifiable here. Supply, market cap, FDV (as-of ~2026-09-02, off-chain)
• Max / fixed total supply: 3,030,303,031 CRV; no minting beyond this cap.
• Current total supply: ~2.40–2.42B CRV.
• Circulating supply: ~1.55B CRV (~64% of total).
• Market cap: ≈$540M at price ~$0.35.
• FDV: ≈$845M. All figures are aggregator-based, not on-chain verified; treat as indicative only. Token utility & governance role
• Governance: CRV is the governance token of Curve DAO, controlling gauges, pool parameters, and proposals via vote-escrowed CRV (veCRV).
• veCRV lock model: Users lock CRV for 1 week–4 years to receive non-transferable veCRV, which decays as lock expiry approaches.
• Gauge voting: veCRV holders direct weekly CRV emissions to specific pools (liquidity gauges), determining where inflation goes.
• Boosts: Locked veCRV boosts LP rewards (up to ~2.5x).
• Revenue share: veCRV holders receive 50% of trading fees across Curve pools, paid in 3CRV and more recently crvUSD. Emissions, inflation, unlocks
• Schedule: Initial inflation ~274M CRV/year (2020) with annual reduction of ~15.9–16%. Emissions continue for ~200+ years.
• Daily emissions: Initially ~2M CRV/day, declining over time.
• Community emissions: 62% of total supply (~1.88B CRV) allocated to LPs via gauges.
• Team / investor vesting: 30% (~909M) to shareholders (team + investors), 2–4 year vesting; reported as fully unlocked since ~Aug 2024. On-chain confirmation of unlock completion: Not verifiable as of 2026-09-04.
• Employees: 3% with 2-year vesting.
• Community reserve: 5%. Allocations & concentration
• Aggregate allocation (protocol resources):
• Community LPs: 62%.
• Shareholders (founders/investors): 30%.
• Community reserve: 5%.
• Employees: 3%.
• Detailed top-holder concentration, insider wallet labels, and cross-chain holder mapping: Not verifiable as of 2026-09-04. Control functions (mint / blacklist / fee-switch)
• Emissions (minting up to the cap) are controlled via DAO-approved liquidity gauges; veCRV voters steer emissions, while contracts implement the schedule.
• Specific admin powers such as address blacklists, emergency pause, or unilateral fee-switch settings per chain: Not verifiable as of 2026-09-04. Liquidity & listings
• CRV is widely listed on major CEXs (e.g., Binance) and DeFi venues; Binance reports total and circulating supply and distribution metrics.
• Curve itself and other DEXs provide deep CRV liquidity, especially on Ethereum, Arbitrum, Polygon, Optimism, but exact per-chain TVL and depth are Not verifiable as of 2026-09-04 without direct on-chain data. Contradiction callout
• Some sources differ on category percentages (e.g., team/investor shares and early users vs. LPs). Where they conflict, treat the protocol’s resource page as the canonical design, but all such figures remain unverified marketing claims absent raw on-chain validation.

Not verifiable as of 2026-09-04. With Dune unavailable, I cannot quantify Curve DEX’s chain-by-chain TVL, exposure, or liquidation risk under a BTC < $10,000 shock across Arbitrum, Avalanche, Base, Ethereum, Fantom, Fraxtal, Gnosis, Kava, Monad, OP Mainnet, Plasma, Polygon, and Sonic. The web results only confirm that Curve has historically faced smart-contract and Vyper-related exploit risk, but they do not provide the on-chain balance sheet needed for a stress test, and several search hits are unrelated market commentary rather than protocol-specific risk data.

Curve’s own security page confirms a formal vulnerability-reporting channel, but that does not establish current exposure metrics or stress losses. The only defensible stress conclusion from the available evidence is qualitative: a BTC collapse to below $10,000 would likely increase broader DeFi deleveraging pressure, but the magnitude of Curve DEX impact cannot be verified from the supplied sources alone. Not verifiable as of 2026-09-04.

Curve DEX is a multi-chain AMM, so a 20% collateral depeg stress on the largest collateral is only partially assessable from the provided sources. The clearest verified consequence in the materials is for crvUSD, where Curve’s own governance post and an independent risk model both identify stablecoin/collateral depegs as a primary risk driver; the risk-model paper explicitly simulates a 20% USDC depeg and notes liquidation spikes under that scenario.

Curve DEX does not have a classic external counterparty whose insolvency is directly absorbed by the protocol; the main loss path is market/depeg risk inside the pool rather than credit risk. For standard Curve liquidity pools, the contracts are described as immutable and noncustodial, so LPs bear the economic loss from adverse price moves or a failed/depegged asset, not a rescue mechanism by the protocol. For a top counterparty insolvent stress, the expected loss path is:

• A token in the pool (or a borrowed asset in Curve Lending) becomes impaired or unredeemable.
• Arbitrage and rebalancing push the bad asset out of the pool at distressed prices, crystallizing LP losses.
• In Curve Lending, LLAMMA soft-liquidation can progressively convert collateral into crvUSD; if the market moves too far, positions can be hard-liquidated, and in extreme cases lenders can face bad debt / shortfall. Who absorbs it:
• LPs absorb losses first in DEX pools, because the pool pricing formula revalues the basket and there is no stated backstop in the docs.
• Borrowers absorb losses in lending via collateral seizure / liquidation dynamics.
• Lenders / vault-share holders can absorb residual bad debt if collateral is insufficient; one audit explicitly notes that when bad debt exists, vault shares can still redeem at full value while the lending market becomes insolvent toward the last shares redeemed. Compensation:
• No contractual compensation is documented for DEX LP insolvency/depeg loss; the docs instead frame this as a known risk of the design.
• In lending, liquidation mechanics are the built-in mitigation, but they do not fully insulate lenders from bad debt in extreme scenarios. Impact path through smart contracts:
• Pool math / AMM pricing absorbs the toxic asset first, then LP balances reprice downward.
• In LLAMMA, collateral migrates through soft-liquidation bands; if losses deepen, the position hard-liquidates and may still leave a shortfall.
• Governance / admin cannot be assumed to rescue users; Curve’s docs emphasize immutability and noncustodial operation for pools. Not verifiable as of 2026-09-04: chain-by-chain exposure split for Arbitrum, Avalanche, Base, Ethereum, Fantom, Fraxtal, Gnosis, Kava, Monad, OP Mainnet, Plasma, Polygon, and Sonic.

For the stress scenario of committed fraud by the DAO or owners, there is no verifiable evidence in the provided sources that Curve DAO or its owners committed fraud. The available material instead describes a smart-contract / compiler vulnerability exploit affecting Curve pools, not an insider-fraud event. The strongest documented incident is the July 2023 Curve exploit, where attackers drained multiple liquidity pools after a Vyper reentrancy issue; sources attribute the losses to the vulnerability and attacker activity, and state that the Curve DAO did not control user funds in a way that would make this an owner-committed fraud case.

A separate source notes a DAO vote over whether to return recovered funds, which is governance-related and not evidence of fraud by the DAO or owners. Assessment for this stress scenario:

• Fraud by DAO/owners: Not verifiable as of 2026-09-04
• Relevant historical loss event: exploit/vulnerability, not confirmed fraud
• Implication for risk analysis: treat this as technical compromise risk, not an established governance fraud risk, unless additional primary evidence emerges

Curve DEX’s primary yield source is not verifiable as of 2026-09-04 from the provided sources alone, so I cannot confirm a negative 30-day reading for a specific yield stream. The closest directly relevant evidence is that Curve’s yields can be composed of swap fees, CRV emissions, and external incentives, and that fee-only stablecoin yields are often modest while rewards can dominate APY. Curve’s own weekly yield page also shows that yields vary sharply by market, chain, and incentive setup, which means a single protocol-wide “primary yield source” is not a stable published figure.

For a stress scenario, the practical implication is that if the primary yield source turns negative over 30 days, Curve LPs would be relying on incentives or token emissions to offset poor fee performance, and if those rewards are weak or absent the net return can compress materially. In Curve-style liquidity provision, adverse price movement or thin trading can leave LPs with lower realized returns, while incentives may temporarily mask the weakness. Chain scope: the user listed Arbitrum, Avalanche, Base, Ethereum, Fantom, Fraxtal, Gnosis, Kava, Monad, OP Mainnet, Plasma, Polygon, and Sonic, but no source here provides a verified cross-chain 30-day yield breakdown for Curve on those networks. Therefore, the chain-specific exposure is Not verifiable as of 2026-09-04.

If you want, I can turn this into a tighter risk note framed as: “negative primary yield over 30d → incentive-dependent carry, lower LP retention, and higher unwind risk.”

As of September 13, 2026, Curve is primarily controlled by an Ethereum-based veCRV/Aragon DAO, not a disclosed operating company. veCRV holders govern ownership agents, pool parameters, gauges, treasury/community-fund spending, and upgrades; proposals generally require 2,500 veCRV, remain open for one week, and execute only after the voting period. Cross-chain deployments rely on Ethereum governance plus messaging/xGov infrastructure. This is real token-holder governance, but voting power is economically concentrated in large veCRV lockers and delegation/convex-style intermediaries.

Top holders, voting concentration, and per-chain exposure are Not verifiable as of September 13, 2026 because Dune MCP was unavailable. Control is not fully permissionless. The Emergency DAO is a 5-of-9 multisig with authority to freeze/kill gauges or pools and, under governance-approved authorizations, conduct bounded emergency actions.

A February 2026 proposal authorized it to deploy up to 400,000 crvUSD from the DAO treasury and adjust specified pool parameters during severe stress. This is an emergency bypass without the normal governance delay, so the DAO is substantive but not the sole immediate control layer. The standard governance path has a one-week execution delay (168 hours) between vote start and executable result; a separate universal smart-contract timelock delay is Not verifiable as of September 13, 2026.

Current multisig signer identities and independence are Not verifiable as of September 13, 2026; the documented structure is 5-of-9, with historical governance records naming nine members. No company-controlled entity, jurisdiction, registration number, directors, or applicable corporate ToS were established. Frontend and development operations appear delegated to DAO-approved contributors such as Swiss Stake, but their ability to alter core contracts is constrained by DAO-controlled agents. Contradiction / risk finding: prior records characterized admin_can_drain as false and emergency authority as limited; the 2026 treasury authorization shows the Emergency DAO can move a bounded amount of DAO funds without a fresh token-holder vote.

This does not establish the ability to drain depositor LP balances, but it is a material treasury-control exception.

Entity & jurisdiction

• On-chain governance: Curve is governed by the Curve DAO, a decentralized system controlled by veCRV holders; no separate foundation exists.
• Off-chain development company: Swiss Stake AG “created Curve and is still contracted to run development” and is based in Switzerland; it has no formal control over the DAO, treasury, or protocol parameters.
• Some court filings involving Curve’s founder reference Swiss jurisdiction for investment contracts, reinforcing Switzerland as the main off-chain nexus. Legal structure vs. actual risk
• Legal structure is a DAO plus a Swiss development contractor, with protocol ownership and admin functionality controlled by on-chain governance addresses (Community DAO, Parameter Admin, Emergency DAO).
• This distributes control but does not eliminate regulatory exposure for key individuals or entities seen as “operators” or “developers,” especially in jurisdictions that look through DAOs. Classification
• Curve is generally described as a decentralized automated market maker (AMM) / DEX governed by CRV/veCRV holders.
• No clear official classification by a major regulator (e.g., SEC, ESMA) is visible in recent public sources. Not verifiable as of 2026-09-04. KYC/AML
• Core Curve DEX smart contracts are permissionless; users interact via wallets without embedded KYC.
• Third‑party platforms referencing “Curve” and imposing KYC/AML (e.g., centralized interfaces or exchanges with Curve-branded products) are distinct entities and not native to the Curve DAO protocol itself. Any KYC/AML obligations stem from those platforms, not from on-chain Curve. Terms of service / restrictions
• Curve’s own docs emphasize DAO control and do not present a conventional ToS with user age, residency or asset‑trading restrictions comparable to centralized exchanges.
• Any ToS‑style restrictions found in Curve‑branded CeFi products (e.g., e‑money institutions) are for different entities and not for the Curve DEX. Warnings, enforcement, sanctions, court cases
• No direct regulatory enforcement action against Curve DAO or Swiss Stake AG is identified in recent public data. Not verifiable as of 2026-09-04.
• A civil dispute involving Curve’s founder and VC firms resulted in a jurisdictional ruling (California court finding Swiss jurisdiction) but was not a regulatory enforcement case against Curve itself.
• Searches of major sanctions lists (e.g., OFAC consolidated lists) show no listing of Curve DAO, Curve Finance, Swiss Stake AG, or CRV token as sanctioned entities/tokens. Not verifiable as of 2026-09-04. Data protection
• On-chain Curve DEX does not collect personal data; interactions are pseudonymous wallet addresses.
• Any data‑protection obligations relate to off-chain services (web front‑ends, CeFi products) and would follow their local laws (e.g., EU GDPR for EU‑based services), but concrete policies for the DAO itself are not clearly documented in public sources. Not verifiable as of 2026-09-04. Chain coverage
• Curve operates the same DAO‑governed AMM design across multiple chains (Ethereum L1 and L2s, alternative L1s), but legal and regulatory exposure is anchored in the Swiss development company and globally distributed DAO participants, not in any single chain jurisdiction.

No exact GLEIF LEI record for 'Curve DAO', 'Swiss Stake AG', 'Curve DEX'. OFAC SDN screening of 'Curve DAO', 'Swiss Stake AG', 'Curve DEX': no match. SEC litigation and administrative release feeds: no mention.

Curve issues its own stablecoin, crvUSD, so own_stablecoin = true. A depeg did happen: the last verifiable event found was on 2023-08-03, when crvUSD briefly fell by as much as 0.35% before regaining peg. The exact total number of depeg events and the worst historical depeg beyond that incident are Not verifiable as of 2026-09-06; therefore stable = null, depeg_count = 1 minimum, max_depeg_pct = 0.35 minimum, and last_depeg_date = 2023-08-03.

CrvUSD is the only stablecoin identifier clearly evidenced here, so stablecoin_ids = ["crvUSD"].

Curve’s main risks are concentrated in smart-contract/toolchain security, permissionless pool and token integration, oracle and stablecoin feedback loops, cross-chain messaging, and governance concentration. Historical exploitation and current cross-chain expansion make these risks material, although audits, timelocks, bridge limits, and ongoing risk-provider onboarding reduce—but do not eliminate—exposure. On-chain TVL, exposure by chain, and current concentration metrics: Not verifiable as of September 5, 2026.

Curve DEX’s top strengths are: 1) Very low slippage for stablecoin and other pegged-asset swaps, driven by its StableSwap design; 2) Low fees relative to general-purpose DEXs; 3) Capital efficiency / deep liquidity, meaning large trades can clear with less price impact; 4) Passive liquidity provision, since LPs do not need to manage price ranges or rebalance manually; and 5) Multi-chain deployment and broad liquidity footprint, which helps users find liquidity across several ecosystems. These strengths are repeatedly emphasized in Curve’s own docs and in independent reviews focused on its stablecoin-specialized AMM design.