Curve security and the risks that matter
Curve is mature, heavily audited infrastructure — and still not risk-free. This article lists the failure modes that have actually caused losses in DeFi and how to reduce your exposure to each.
Smart contract and dependency risk
In July 2023 a reentrancy-lock bug in specific older versions of the Vyper compiler — not in Curve's own logic — allowed several pools to be drained. It is the clearest reminder that an audited contract can still fail through its toolchain.
Mitigation is boring but effective: prefer long-lived pools with large TVL and history, avoid brand-new factory pools with unfamiliar code, and never concentrate everything in one contract.
Depeg and collateral risk
If one asset in a pool loses its peg, arbitrageurs swap the failing asset into the pool and take the good one out. Liquidity providers are left holding the loser. This is the single most common way stablecoin LPs lose money.
Judge each asset independently, watch the pool balance as an early-warning indicator, and accept that exiting during a depeg is expensive because everyone else is trying to do the same thing.
Oracle, liquidation and market risk
Borrowing against volatile collateral adds oracle dependence and liquidation risk. LLAMMA softens the blow but charges you during sideways volatility. Keep a conservative loan-to-value ratio and monitor positions rather than assuming soft liquidation is a safety net.
Human-layer risk
Most retail losses come from phishing rather than protocol failure: fake front-ends, poisoned search ads, malicious token approvals and clipboard hijacking. Bookmark the official domain, verify contract addresses against the docs, use a hardware wallet, revoke stale approvals regularly and keep a separate wallet for experiments.
Frequently asked questions
Were users compensated after the 2023 exploit?
A large share of the affected funds was eventually returned by white-hat actors and negotiations with attackers, but recovery of that kind should never be assumed.
What is the single best safety habit?
Verify the URL and the contract address before every signature, and never approve unlimited spending to a contract you have not checked.
Latest updates
FAQ blocks built around real search queries
Fourteen questions per language now answer the things people actually search for: how StableSwap works, what vote-escrow gives you, how LLAMMA soft-liquidation behaves, and whether Curve is safe to use.
crvUSD and lending guide expanded
The crvUSD section now explains the LLAMMA band mechanism, soft liquidation, the borrow rate policy and how peg keepers defend the price, with worked examples of a loan going underwater.
Popular searches answered on this page
Is Curve Finance safe to use?
Curve's core contracts are long-lived, heavily audited and hold billions in liquidity, but no DeFi protocol is risk-free — the 2023 Vyper reentrancy incident showed that compiler-level bugs can hit even mature code. Use official links, prefer battle-tested pools and size positions accordingly.
Security and risks →What are depeg and impermanent loss risks on Curve?
If one asset in a pool loses its peg, the pool absorbs it and LPs end up holding mostly the weaker asset. That path-dependent loss, plus smart-contract and oracle risk, is the main downside of stablecoin liquidity providing.
Risk checklist →Related reading
Articles
How the Curve AMM actually works
A step-by-step explanation of the Curve stableswap invariant, the amplification parameter A, price impact and how cryptoswap extends it to volatile assets.
Read more →
Articles
How to evaluate a stablecoin liquidity pool
A practical checklist for judging a Curve stablecoin pool: asset quality, pool balance, amplification, volume-to-TVL ratio and reward sustainability.
Read more →
Articles
Yield farming on Curve, step by step
How CRV rewards are earned and claimed: gauge staking, boost calculation, aggregators like Convex, compounding, gas costs and calculating a realistic net yield.
Read more →
Articles
veCRV and how Curve is governed
How the Curve DAO works: veCRV voting weight, proposal thresholds, weekly gauge weight votes, the vote incentive market and its criticisms.
Read more →Guides
What is Curve Finance?
A clear introduction to Curve Finance: the stableswap AMM, who uses it, what problem it solves and how it differs from Uniswap.
Read more →Guides
Curve pools and swaps
How Curve liquidity pools work: pool types, swap fees, slippage, LP tokens, depositing and withdrawing, and how to read pool balance.
Read more →