Curve
DEX / AMM — Stablecoin and LST AMM infrastructure.
AI review
AI assessment
updated 5h ago·Claude (preview)·previewCurve is a DAO-governed stablecoin/LST AMM. Its pools are immutable — the DAO governs parameters and gauges, not pool logic. Its one major loss (July 2023) came from a Vyper compiler reentrancy bug, not Curve's own code, and was largely recovered.
- Pools are immutable; the DAO (veCRV) governs parameters and gauges only. governance
- 2023 losses traced to a Vyper compiler bug rather than Curve pool logic; ~70%+ recovered. incident
- 6 risk feeds in the registry report on Curve. coverage
Reported TVL down ~18% over 24h
- Who
- Aggregate on-chain liquidity (no single actor).
- When
- Trailing 24h
- Why
- Net outflows concentrated in two crvUSD-related pools, coinciding with a broad market drawdown.
- What
- Reported TVL moved from ~$1.88B to ~$1.54B.
- Risk
- A liquidity change of this size can affect swap depth and liquidation efficiency for protocols that route through Curve; no contract change or incident is associated with the move. Figures are illustrative.
- 1d ago — TVL move crossed the alert threshold; flagged for review.
Investigative summary of a detected change to Curve. Neutral and sourced — not a severity rating or risk score.
AI-generated summary of facts already in this registry — not a Rails assessment, not a risk score, and not a ranking. Per the project charter, the registry never produces its own composite risk judgement. Verify every point against the linked sources below. This is an illustrative preview of a proposed feature; the content is not live.
Feeds
How feeds see it
Seen through 3 of 4 methodology lenses (rating, monitoring, research). A neutral view of who is looking and how — not a risk judgement.
DAO/admin upgrade rights not protected by a ≥7-day exit window or sufficient Security Council.
Quantitative market-health scoring for crvUSD / LlamaLend markets.
Position-management tooling: live loan-health / safety-ratio tracking and automated liquidation protection for leveraged positions.
View sourceProtocol-risk component rated "Good" (tiers: Best/Good/Average/Watch out/Avoid). Pre-migration sample.
Process Quality Review published (PQR id 550); verbatim score pending confirmation.
View sourceQuantitative on-chain risk dashboards for lending markets: liquidations, collateral health, exposure.
Vault-level risk monitoring for Morpho curators: allocation risk and curator behavior.
Institutional-grade credit-risk ratings for DeFi protocols and borrowers. Credora by RedStone; GraphQL API + on-chain attestations (EAS).
Independent risk rating for DeFi vaults; 300+ subscores across 85+ mechanisms. Open-source.
Deterministic vault risk scoring across 700+ vaults: asset quality, code maturity, governance. Open methodology (public API, CLI, MCP server).
Vault analytics and risk-adjusted yield across 50+ protocols; exploits, concentration, risk-adjusted APY. Paid structured API.
Real-time risk scores for DeFi liquidity pools: risk metrics, TVL, APY, security grades.
DAO governance-capture risk: delegate/voting-power concentration, cost-to-attack vs. treasury value, and proposal/power-shift monitoring across major DAOs. Open-source.
Agent-based economic simulation: insolvency prevention, parameter optimization, and risk-scenario analysis for lending markets.
Edge risk oracles and economic-risk dashboards: real-time parameter automation and scenario stress for lending markets (active on Aave, GMX, Pendle).
Governance
Governance at a glance
- Governance
- DAO (veCRV)
- Core contracts
- Immutable
Structural facts, distilled from the sourced control records below — neutral capabilities, not a risk score.
Incidents
A faulty reentrancy lock in Vyper 0.2.15/0.2.16/0.3.0 — not Curve's pool logic — let attackers drain several pools (pETH/msETH/alETH/CRV-ETH) for ~$70M. Roughly 70%+ was recovered or returned by white-hats within days; Curve committed to reimbursing users.
Material risk events, presented verbatim from cited sources — not a Rails assessment.
Audits
| Auditor | Date | Scope | |
|---|---|---|---|
| ChainSecurity | 2023-06 | Curve Stablecoin (crvUSD) | Report |
| MixBytes | 2023-06 | Curve Stablecoin (crvUSD) | Report |
| MixBytes | 2023-10 | StableSwap-NG factory/pool/math | Report |
| ChainSecurity | 2023-06 | tricrypto-ng (CryptoSwap NG) | Report |
Representative public audits, attributed and linked to source — not a Rails assessment, and not a completeness or safety guarantee.