Curve update addressing Chainsecurity audit opens door to more loan automations

The Curve community has passed a resolution to extend its ongoing work with LlamaRisk on its risk and growth services for the DAO and protocol. 

According to a governance vote on Tuesday, Curve DAO will vest two million CRV tokens (worth about $750,000) with LlamaRisk, a risk management service provider that was spun out of the Curve ecosystem. 

The community — including Convex DEX, Stake DAO and Yearn lending protocol, some of the protocol’s largest stakeholders — strongly supports the proposal, with a significant majority of voting weight in favor. The protocol retains the right to pause or reclaim tokens, which will pay for a contract that ends April 2026.

“The role LlamaRisk plays in Curve is constantly evolving as new products are launched and mature and as our own team expands with experts in a variety of fields relevant to our work,” LlamaRisk wrote in its proposal. “The breadth of our services to Curve has grown significantly over this past year, especially considering our humble beginnings in 2021 as a grass-roots movement within the Curve community.”

Llama helps manage Curve’s vault strategies, including introducing the Caffeine “simulation framework” used to experiment and iterate agent smart contract interactions on protocols like crvUSD, LlamaLend and Curve AMM. It also developed a methodology to optimize LlamaLend’s monetary policy and plans to build out a “risk portal … custom-tailored to Curve’s needs.”

Llama also handles a lot of B2B and grant funding work on behalf of Swiss Stake, the primary core developer of Curve’s tech stack. For instance, in 2024, LlamaRisk was “instrumental” in securing about $1.5 million in grants on behalf of Curve DAO. 

Curve is one of the most active DAOs in the crypto ecosystem. In just the last month, there have been 10 votes, including over the minutiae of how certain lending pools are maintained. 

Addressing audit

This particular vote comes after another governance decision on Monday to update Curve’s controller and set the automated money market implementations for newly proposed crvUSD mint markets. The vote, which passed with about 80% support, was meant to address some issues raised in a February audit by Chainsecurity. 

The controller is the heart of the Curve protocol. It manages loans and keeps stablecoin markets stable by determining the size of a user's loan based on the quality and quantity of their collateral and a vault’s safety limits.

According to its report, Chainsecurity found certain error modes around the controller that needed to be addressed. This includes at least one critical bug where the crvUSD “FlashLender” could have been drained, essentially by tricking it into thinking that a loan had been repaid. (It's worth clarifying that this particular bug was "code corrected" during the audit process.)

"There are still many low severity issues not fixed, and given a stable codebase and more time, likely many more could be found, due to the complexity of the codebase. However, assuming the more severe issues are addressed, they should be mostly benign," Chainsecurity wrote. "It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don't replace other vital measures to secure a project."

“Changes needed for all of that were not overly too huge, but they needed to be audited, and few small bugfixes were made on the way,” Curve founder Michael Egorov told The Block.

In addition to addressing concerns raised in the audit, Egorov noted that Monday's vote also laid the groundwork for a number of long-proposed features on Curve. These include the “possibility to use exchange aggregators for mint markets (finally)” and “opening a door for using liquidity tokens as collateral.”

Exchange aggregators are tools that combine trading options from multiple platforms, while Curve’s mint markets are systems for creating or borrowing crvUSD using collateral. This means users could soon be able to find the best crvUSD minting rates using a single tool that pulls data from different DEXes. 

Users can now automate certain aspects of their loans more easily by granting a smart contract access to manage their positions. This is “useful for all sorts of migration zaps, automatically preventing ‘scary’ liquidations by managing the position more gracefully in advance etc.,” Egorov said. 

“On Curve, loans can survive being ‘underwater’ without getting your loan liquidated,” he said, noting that users can specify the “health” of their loans, or the ultimate price at which they give up and just get liquidated.