curve.fi
Summary
Curve Finance is a six-year-old DEX and stablecoin stack holding roughly $1.5B across 30+ chains, anchored by legacy pools like 3pool and newer crvUSD/LlamaLend products. On paper it has mature veCRV governance, 17+ audits, and a strong 2023 exploit response—but on-chain reality exposes a single EOA controlling the canonical AddressProvider registry on every chain, nine unverified core contracts including GaugeController and scrvUSD, FastBridge pre-minting crvUSD on LayerZero messages before bridge finality, and permissionless LlamaLend markets that already produced a March 2026 oracle attack. Three verified incidents ($61.7M Vyper compiler exploit, $575K DNS hijack, $240K sDOLA donation attack) show failures in supply chain, Web2 infrastructure, and market configuration—not just bad luck. Overall risk is elevated at 6.7/10.
Trust Assumptions
Users must trust that the AddressProvider admin EOA (0x2d12…03ee) will not repoint registry IDs that integrators rely on across all chains; that LayerZero messaging and FastBridge peer configuration will not mint unbacked L1 crvUSD; that the Emergency DAO 5-of-9 multisig will use gauge-kill and bridge-kill powers only in genuine emergencies without timelock delay; that veCRV governance routed through unverified Ownership Agent and GaugeController bytecode reflects actual voter intent despite Convex controlling ~53% of veCRV voting power; that legacy Vyper pools compiled on unaffected compiler versions remain safe while 1,200+ deployments sit outside audit scope; and that permissionless LlamaLend markets with AMM-band oracles—not Chainlink—will not repeat the sDOLA donation pattern.
What Could Go Wrong
A compromised AddressProvider admin key could instantly redirect factories, routers, and admin contracts ecosystem-wide before any DAO vote. FastBridge could credit unbacked crvUSD if LayerZero infrastructure fails, peers are misconfigured, or the unverified Arbitrum FastBridgeL2 behaves differently than audited code. Another Vyper compiler defect or unverified contract bug in GaugeController, scrvUSD, or the LLAMMA Controller Factory could drain funds that prior audits never covered at the bytecode level. Permissionless LlamaLend markets with thin collateral and manipulable internal oracles remain live attack surface—the March 2026 sDOLA incident liquidated 27 borrowers for ~$822K in equity with no compensation announced. External stablecoin depegs in 3pool (~$1.35B Ethereum TVL) propagate directly into LP losses and crvUSD peg defense. Convex-dominated gauge voting can block funding and redirect emissions regardless of broader community preference.
Recommendation
Curve is acceptable for experienced DeFi users who stick to well-audited, verified legacy pools (3pool, major NG factories) and avoid obscure LlamaLend markets, unverified scrvUSD deposits, and FastBridge fast-withdraw paths until registry admin is DAO-controlled and remaining contracts are verified on-chain. Treat audit reports as necessary but insufficient—the 2023 Vyper incident proved compiled bytecode can diverge from reviewed source across 1,200+ deployments. Monitor AddressProvider admin activity, Emergency DAO signer changes, new permissionless market deployments, and crvUSD PegKeeper reserve releases that can suddenly expand circulating supply. Reduce exposure if using curve.fi directly (DNS risk persists), holding CRV for governance value (Convex concentration and ~7.6% annual inflation), borrowing against exotic LlamaLend collateral, or relying on cross-chain crvUSD via unverified L2 bridge contracts. Conservative allocators and institutional treasuries should demand verified source for all core contracts and per-market oracle review before meaningful capital deployment.
Key Findings (30)
Analysis Sections
Curve has a mature veCRV → Aragon DAO path for ownership and parameter changes, backed by a verified 5-of-9 Emergency DAO multisig. However, the canonical AddressProvider registry on every deployed chain is controlled by a single EOA (0x2d12…03ee) that can rewrite registry IDs immediately without a DAO vote or timelock. FastBridge and xGov extend mainnet admin agents to L2s, but bridge mint/kill roles and the registry admin remain concentrated trust points.
Findings (8)
The CurveAddressProvider registry (0x5ffe7FB82894076ECB99A30D6A32e969e6e35E98) on Ethereum, Arbitrum, Optimism, Base, and Polygon is controlled by admin 0x2d12d0907a388811e3aa855a550f959501d303ee, verified as an EOA via eth_getCode. This admin can add, update, or remove registry IDs instantly (admin-only functions with no vote or delay). Registry entries include Ownership Admin (ID 21), Parameter Admin (ID 22), and Emergency Admin (ID 23), so a compromised key could redirect the canonical registry that integrators rely on.
The identical AddressProvider admin EOA governs the registry on Ethereum, Arbitrum, Optimism, Base, and Polygon. Unlike core protocol changes routed through veCRV votes and Aragon agents, registry updates on any chain require only this single key. This is a cross-chain governance weak link: one compromised admin can repoint factory, router, and admin IDs across deployments.
Emergency Admin (AddressProvider ID 23) resolves to Gnosis Safe 0x467947EE34aF926cF1DCac093870f613C96B1E0c, verified on-chain as 5-of-9 with nine owner addresses. A second Safe at 0x6d447e544D01a59cb0774763bf15526574CffFeD has the same threshold and owner set (deployments registry). Emergency admin holds FastBridgeVault KILLER_ROLE and can halt bridge minting; community docs describe gauge-kill and peg-pause powers. Actions require five signatures but no enforced delay.
Ownership changes flow through veCRV-weighted Aragon voting to the Ownership Agent proxy (0x40907540d8a6C65c637785e8f8B742ae6b0b9968), verified as an Aragon Agent (kernel 0xad06868167bc5ac5cfcbef2cafa82bc76961d72d). Parameter Admin is a separate agent at 0x4eeb3ba4f221ca16ed4a0cc7254e2e32df948c5f. VotingEscrow admin is the Ownership Agent. Gauge weight allocation uses GaugeController (0x2F50D538D60856CF27039851d725A46949860Fc8), driven by veCRV votes, though GaugeController bytecode is unverified on Etherscan.
xGov L1 Broadcaster (0x7BA33456EC00812C6B6BB6C1C3dfF579c34CC2cc) accepts broadcasts only from registry-configured ownership, parameter, and emergency admins. On Arbitrum, relayer 0xb7b0FF38E0A01D798B5cd395BbA6Ddb56A323830 deploys separate OWNERSHIP/PARAMETER/EMERGENCY agents (e.g. ownership agent 0x452030a5D962d37D97A9D65487663cD5fd9C2B32). FastBridgeL2.owner() on Arbitrum, Optimism, and Fraxtal points to these chain-local agent contracts (all verified as contracts, not EOAs). This design avoids naked EOA L2 admins but adds reliance on correct xGov relay and message integrity.
FastBridgeVault (0xadB10d2d5A95e58Ddb1A0744a0d2D7B55Db7843D) assigns DEFAULT_ADMIN_ROLE to the Ownership Agent, MINTER_ROLE to VaultMessengerLZ (0x15945526b5c32d963391343e9bc080838fe3e6d9), and KILLER_ROLE to the Emergency DAO Safe. The messenger can mint crvUSD against LayerZero messages, creating bridge-governance and oracle-trust dependencies beyond standard DAO votes.
AddressProvider implements commit_transfer_ownership / apply_transfer_ownership with a three-day delay before admin rotation (documented in contract NatSpec). However, routine registry mutations (add_new_id, update_address, remove_id) execute immediately once the current admin signs, with no community review window.
GaugeController, Ownership Agent proxy bytecode, FastBridgeL2 on several chains, and scrvUSD are marked unverified in the local contract cache, limiting source-level assurance of admin modifiers even where on-chain role checks succeed.
Governance Checklist
Key Governance Entities
Emergency DAO Multisig (5-of-9) — Verified Owners
| # | Owner Address |
|---|---|
| 1 | 0xe9a65fe8190fa5a4b5e277b84f0aace686fdc174 |
| 2 | 0x7a1057e6e9093da9c1d4c1d049609b6889fc4c67 |
| 3 | 0x2b47c57a4c9fc1649b43500f4c0cda6cf29be278 |
| 4 | 0xdaa094a0ed166fedf8a0a4310f3f74a1e96f9195 |
| 5 | 0x99bc02c239025e431d5741cc1dba8ce77fc51ce3 |
| 6 | 0xaf17517acd484429fc0da2312fd1f42039592cd0 |
| 7 | 0xc6f3aac21d8282f166938a8b30a9ec62de30accc |
| 8 | 0xaac0aa431c237c2c0b5f041c8e59b3f1a43ac78f |
| 9 | 0x8a7dbc2824acac4d272289a33b255c3f1f3cdf32 |