Curve DEX

Curve is a decentralized exchange built around stableswap pools that make trades between like-priced assets cheap. It held about $1.4B across thirteen chains at the 2026-08-14 survey. Its StableSwap formula concentrates liquidity near parity, but an LP still sells the asset holding its peg and accumulates the one breaking it. The July 2023 Vyper reentrancy exploit also shows that audited, mature infrastructure can suffer losses in specific pools, though that incident is not the reason for this verdict. The AMM class rule decides this case, not an individual review and rejection. Unavoidable inventory rebalancing and exposure to impermanent loss rule it out for the advised sleeve.

Review triggers: events that reopen the verdict
• Ships a product line without impermanent-loss exposure that merits its own review

Watched nightly: a warning on its venues or files, or a cited document that changes, reopens the memo. The first confirmation is due 2026-11-15.

The research file

The mechanism

Curve’s StableSwap formula blends constant-sum behavior near a target price with constant-product behavior farther away. This produces low slippage for correlated assets, but LP tokens remain pro-rata claims on pool inventory. As relative prices move, arbitrageurs trade against the pool and leave LPs with more of the depreciating asset. Metapools and yield-bearing underlying tokens can add dependencies beyond the base pool.

Control and operating record

Curve includes both core deployments and permissionless factory pools. The code, assets, oracles and admin controls therefore differ by pool. veCRV governance can change parameters and direct gauges, but it cannot restore an external asset’s peg. On 30 July 2023, attackers used reentrancy against pools compiled with vulnerable Vyper versions. Curve governance later approved 71.77 million CRV of vesting compensation for affected LPs. That response is useful evidence about operations, not proof that all pool code or assets have the same risk profile.

The exit

LPs can remove liquidity in the supported coin mix, subject to pool balances, fees and transaction execution. During a depeg, the quoted LP-token value can hide a harmful inventory mix. An exit in one coin can realize large slippage, while a balanced exit returns the impaired asset itself. Calling the loss impermanent does not make par recovery available on demand.

Why the class rule decides

The amm-lp rule excludes recommendations whose core return requires continuous two-sided market making. Curve’s efficient math, long operating history and response to losses do not change that payoff for the client. This is not an individual finding that Curve is unsafe. A Curve product with no AMM inventory exposure would require a separate memo and could reopen review.

Class rule

The amm lp class is outside the approved structures, so every protocol in it is not approved until the rule changes. The rule is about the structure, not an adverse finding about this protocol, and it is not a client instruction. The events that would reopen it are listed with the memo.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Curve Finance — StableSwap white paper · primary · accessed 2026-08-14
  Supports: StableSwap invariant concentrates liquidity for pegged assets, LP return depends on automated market making
• Curve Metaregistry — pool and factory architecture · primary · accessed 2026-08-14
  Supports: pool, factory architecture
• Curve Governance — 2023 exploit LP compensation proposal · primary · accessed 2026-08-14
  Supports: 2023 exploit LP compensation proposal
• Curve contracts — audits and deployment process · primary · accessed 2026-08-14
  Supports: audits, deployment process

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The layer with the most administrative power sets the position’s effective control; that describes control, not quality or suitability.