Curve Finance (diff)

Quantstamp5 Oct 2020Files named in the report

Quantstamp reviewed Curve.fi (Curve Finance (diff)) on 5 Oct 2020: 4 findings, 0 critical; 1 marked fixed, 3 acknowledged.

No open critical findings

Open the report Open Curve.fi’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	1
Low	3	0

MediumHard-coded Array Index Allows for Only One Metapool TokenFixed

In `DepositTemplateMeta.vy` L158, the index for the base pool's LP token is hard-coded in function `remove_liquidity()`as `self.coins[1]`. This can be a problem if the metapool has multiple tokens + base pool LP token.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

meta/SwapTemplateMeta.vy
meta/DepositTemplateMeta.vy

Part of Curve.fi’s security record

Curve.fi

Audits7 audits by 2 firmsLast audit Feb 2025, by ChainSecurity.

Critical findingsNo open critical findingsAcross 7 reports.

Open Curve.fi’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us