> For the complete documentation index, see [llms.txt](https://docs.infraredtrading.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.infraredtrading.com/learn/protocols/curve/security.md).

# Security

Curve's trust model has a distinctive shape: deployed pool bytecode is immutable, but the **preview surface is governance-mutable**, per-pool parameters are DAO-settable, and — uniquely among major protocols — Curve has suffered a live exploit rooted in its **compiler**, not its contracts.

## Audits

The [official audit catalog](https://docs.curve.finance/user/security/audits) lists reports from **Trail of Bits, MixBytes, Quantstamp, ChainSecurity, and StateMind** across the DAO, the DEX (metapools, Tricrypto/-NG, Twocrypto, Stableswap-NG), crvUSD/scrvUSD/PegKeeper V2, and infrastructure. **Stableswap-NG specifically was audited by MixBytes, dated 1 November 2023** ([report PDF](https://docs.curve.finance/pdf/audits/Curve%20Finance%20StableSwapNG%20Security%20Audit%20Report.pdf)) — shortly after the NG factory's October 2023 deployment. The catalog is the authoritative list of coverage per component. A bug bounty program is documented at [docs.curve.finance/user/security/bug-bounty](https://docs.curve.finance/user/security/bug-bounty).

## Incident history

### July 30, 2023 — Vyper compiler reentrancy (contracts; legacy pools only)

Vyper **0.2.15 / 0.2.16 / 0.3.0** shipped a broken `@nonreentrant` lock (silently fixed in 0.3.1 before the bug was public). Four **legacy native-ETH pools** were drained ([LlamaRisk postmortem](https://hackmd.io/@LlamaRisk/BJzSKHNjn)): pETH/ETH \~$11M, msETH/ETH \~$3.4M, alETH/ETH \~$22.6M, CRV/ETH \~$24.7M — **\~$61.7M total**. Pools using WETH (no raw native-ETH transfer) were explicitly not affected. A whitehat returned \~$5.4M immediately; news reporting puts eventual recovery around 70–73% with a \~$49M compensation disbursement ([The Block](https://www.theblock.co/post/244438/curve-finance-has-recovered-70-of-hacked-funds-with-distribution-planned), [Cointelegraph](https://cointelegraph.com/news/curve-finance-disburse-49-million-compensation-hack-victims)).

**Relevance class for NG:** StableSwap-NG is compiled with Vyper **0.3.10** (source pragma) and does not support native ETH at all — the exploited class (broken-lock compiler + raw ETH callback) does not apply. The durable lesson is that Curve inherits **compiler-level** risk unusual for Solidity-first protocols.

### Frontend/DNS incidents (protocol contracts unaffected)

* **Aug 9, 2022** — DNS cache poisoning of curve.fi sent users to a drainer clone; \~$570K lost, the majority later recovered (per news reporting).
* **May 12, 2025** — curve.fi's DNS was hijacked at the registrar (iwantmyname); a drainer site was live for hours; Curve pointed users to curve.finance ([official postmortem](https://news.curve.finance/curve-domain-incident/)). Curve subsequently announced the move to **curve.finance** as permanent and curve.fi as frozen at the registrar (Curve statements relayed by [news reporting](https://crypto.news/curve-finance-confirms-migration-to-new-domain-after-dns-hijack/)). On-chain contracts and funds were unaffected. **Treat any curve.fi URL as deprecated.**

### October 10, 2025 — CRV-long Llamalend v1 market bad debt (market risk; not an exploit)

During the record market-wide deleveraging of October 10, 2025 (>$19B in leveraged crypto liquidations after the US tariff announcement), the **CRV-long Llamalend v1 market on Ethereum accrued \~$700K of bad debt** — vault assets left underbacked with a collateral shortfall of \~70%. This was a market-risk event (soft liquidation could not keep pace with the crash); **no smart-contract vulnerability was involved**, and DEX pools were unaffected.

**Recovery mechanism (April 2026):** rather than a DAO bailout, founder Michael Egorov proposed a market-based recovery — affected lender positions tokenized into a claim vault (**cvcrvUSD**) traded in a dedicated crvUSD/cvcrvUSD Curve pool ("an investment tool, not a donation"), letting lenders exit at market price or hold; a gauge addition can direct CRV emissions to deepen the pool. Full recovery is modeled at CRV \~= $1.242 and partial recovery begins \~= $0.957 — recovery is market-dependent, not guaranteed. Context: LlamaRisk's v1 deprecation plan covers 11 bad-debt v1 markets with \~$1.22M aggregate bad debt (see [Ecosystem](/learn/protocols/curve/ecosystem.md)). Sources: [governance recovery thread](https://gov.curve.finance/t/crv-long-llamalend-market-recovery/11062) + [CoinDesk](https://www.coindesk.com/markets/2026/04/27/curve-founder-pitches-market-based-fix-for-usd700k-bad-debt-in-contrast-to-aave-bailout) (accessed 2026-08-21).

### March 2, 2026 — LlamaLend sDOLA oracle manipulation (lending market; DEX pools unaffected)

Official post-mortem: [gov.curve.finance/t/llamalend-sdola-long2-post-mortem](https://gov.curve.finance/t/llamalend-sdola-long2-post-mortem/11020) (block 24,566,937, \~04:00 UTC). A two-pronged flash-loan attack on the sDOLA/crvUSD LlamaLend market ("sDOLA-long2"): (1) exchange 13.25M crvUSD into the LLAMMA, buying 9.83M sDOLA — 87.9% of all sDOLA supply sat in that AMM — forcing every position into soft liquidation; (2) redeem the sDOLA and call `DolaSavings.stake(190K DOLA, sDOLA_address)`, a permissionless donation that inflated the sDOLA share price +13.79% (vault rate 1.189 to 1.353), making the soft-liquidated positions instantly unhealthy. All **27 borrowers were hard-liquidated** (\~10.9M crvUSD debt against 11.73M crvUSD collateral). Borrower losses \~= 822,475 crvUSD; attacker profit \~$240K. The post-mortem's impact accounting lists no lender losses (hard liquidations repaid debt), and StableSwap-NG DEX pools were not involved. ([Technical analysis](https://darknavy.org/web3/exploits/sdola-llamalend-oracle-manipulation/).)

**Root cause:** the market's collateral oracle used spot ERC-4626 `convertToAssets()` with **no smoothing** — LLAMMA's EMA applies to the pool `price_oracle()` but passed the vault price-per-share through unsmoothed — and the donation path is permissionless. The sDOLA-long2 market predates LlamaLend oracle proxies, so its oracle cannot be updated; the market is deprecated and removed from the UI. Stated remediation direction: standardized smoothed oracles for all LlamaLend v2 markets. This is a live confirmation of trust boundary #4 below and a canonical [ERC-4626](/learn/concepts/erc4626-vaults.md) donation-attack case study.

### April 19, 2026 — precautionary LayerZero bridge halt (no Curve exploit)

Following the April 18, 2026 Kelp DAO rsETH bridge exploit (\~$292M; compromised LayerZero 1-of-1 DVN verification), Curve **paused its LayerZero-powered CRV cross-chain bridging as a precaution** (BNB Chain, Sonic, Avalanche, Fantom, Etherlink, Kava; chains on native bridges unaffected). Reporting conflicted on whether the crvUSD [FastBridge](https://docs.curve.finance/developer/fast-bridge/overview) (which uses a stricter 2/2 DVN setup) was included. Curve itself was not exploited.

**On-chain status (2026-08-21):** every Curve LayerZero bridge (a Blockscout-verified `LayerZeroBridge-CurveDAOToken` Vyper contract) exposes an `is_killed()` gate, read directly:

* **The Ethereum-side BNB/BSC CRV bridge `0xC91113B4Dd89dd20FDEECDAC82477Bc99A840355` reads `is_killed() = true` — Ethereum-to-BNB CRV bridging remained halted** (the BSC-side contract at the same address reads `false`).
* The Avalanche CRV, Fantom CRV, and Sonic/Etherlink CRV bridges, and all crvUSD/scrvUSD bridges listed on the [docs bridging page](https://docs.curve.finance/user/cross-chain/bridging-tokens), read `is_killed() = false`, with successful post-pause `retry`/`bridge` transactions observed in May–June 2026.
* No official Curve statement announcing either the pause or a restoration has been published; `is_killed` reflects only the Curve-side pause switch — it says nothing about the LayerZero DVN security posture. Treat Ethereum-to-BNB CRV as halted; other listed paths are contract-level open.

**July 15, 2026 false alarm:** PeckShield/Specter reported LayerZero Executor wallets "drained" of \~$2.4M across 8 chains; **LayerZero officially denied it the same day** — the transfers were internal inventory rebalancing, with no user funds at risk. Reports published before the denial are superseded. No Curve impact.

## Trust boundaries (ranked for LP and routing integrations)

1. **Preview functions are governance-mutable.** Pool `calc_token_amount`/`get_dy`/`get_dx`/ `dynamic_fee` delegate live to `factory.views_implementation()` — a DAO-swappable contract. Pool **execution** bytecode is immutable, but preview semantics can change under an integration without any pool-level event. (All five Ethereum implementation slots have already been upgraded once; see [Deployments](/learn/protocols/curve/deployments.md).) Mitigation: previews recomputed from pool-internal math (e.g. the proportional-withdrawal expression `balances[i] * burn / totalSupply`) do not inherit this; `calc_token_amount`-based previews do — pin behavior with parity tests against `add_liquidity` on a fork, and re-run them when the views implementation changes.
2. **Per-pool admin powers.** `factory.admin()` (the DAO agent) can `set_new_fee` (deploy-time cap 1%, but a post-deploy cap of `MAX_FEE = 50%` with the offpeg product bound) and `ramp_A` (≥ 1 day, ≤ 10× per ramp). Fee/A changes move LP math between quote and execution only across blocks — within a block, preview and execution agree ([Liquidity Math §2](/learn/protocols/curve/liquidity-math.md#2-calc_token_amountamounts-is_deposit--fee-inclusive-on-ng-and-how-exact)).
3. **External rate oracles (asset type 1).** The pool static-calls a configured oracle whose rate is trusted at face value; the NG source itself warns "Oracles may be controlled externally by an EOA." A manipulated or broken rate mis-prices deposits, withdrawals, and `get_virtual_price`. Per-pool oracle quality is not uniform — score pools individually.
4. **ERC-4626 / rebasing coins (asset types 3, 2).** The source warns some [ERC-4626](/learn/concepts/erc4626-vaults.md) implementations are susceptible to donation/inflation attacks, and that `get_virtual_price` "may be vulnerable to donation-style attacks if implementation contains rebasing tokens." Rebasing pools also break wei-exact previews (actual-received accounting). **Confirmed live instance (March 2, 2026):** the sDOLA LlamaLend incident above — a spot ERC-4626 `convertToAssets()` oracle atomically inflated +13.79% by a permissionless donation, hard-liquidating 27 borrowers.
5. **Permissionless pool set.** Anyone can deploy an NG pool with arbitrary coins and oracles; factory enumeration surfaces junk and empty pools (empty pools revert `calc_token_amount`). Registry membership is not an endorsement — TVL and liveness gating remain necessary.
6. **Metapool base-pool coupling.** A metapool's LP math imports the base pool's `get_virtual_price` and, for underlying flows, its full liquidity surface — including **legacy** base pools (3pool) with fee-blind previews and older code. The MetaZapNG's base-pool calls use the NG DynArray ABI; verify selector compatibility before routing underlying deposits through it for legacy-based metapools ([Liquidity Math §4](/learn/protocols/curve/liquidity-math.md#4-metapools--the-base-pools-lp-token-as-a-coin)).
7. **Compiler supply chain.** The Vyper-specific risk class was proven live in 2023; NG's 0.3.10 is post-fix, but future compiler advisories should be triaged against pinned pool versions (`version() == "v7.0.0"` observed on live pools).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.infraredtrading.com/learn/protocols/curve/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.