Curve.fi security record
As of 4 Nov 2026, Curve.fi has 7 audit reports by 2 security firms on Trustblock; the latest is by ChainSecurity, dated 21 Feb 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits7
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| crvUSD | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Curve scrvUSD | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Curve Fee Splitter | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| PegKeeperV2 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Curve Finance – Tricrypto Security Audit | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Curve ETH / sETH | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Curve Finance (diff) | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings59
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 1 | 0 | 10 |
| Low | 0 | 10 | 35 |
LowIncorrect EventCurve scrvUSD · ChainSecurity · 3 Dec 2024Acknowledged
The report gives no description here.
Open the reportLowpreviewDeposit() Does Not Adhere to EIP-4626Curve scrvUSD · ChainSecurity · 3 Dec 2024Acknowledged
The report gives no description here.
Open the reportLowAsymmetrical Norm in Price Update ThresholdCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Acknowledged
The report gives no description here.
Open the reportLowMissing Boundary or Sanity Checks When InitializingCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Acknowledged
The report gives no description here.
Open the reportLowPotential Gas Savings in tweak_priceCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Acknowledged
The report gives no description here.
Open the reportLowCertain Inputs Unchecked in ConstructorCurve ETH / sETH · ChainSecurity · 27 Sep 2021Acknowledged
The report gives no description here.
Open the reportLowRamping Down Might Incentivize Delayed LiquidityCurve ETH / sETH · ChainSecurity · 27 Sep 2021Acknowledged
The report gives no description here.
Open the reportLowBlock Timestamp ManipulationCurve Finance (diff) · Quantstamp · 5 Oct 2020Acknowledged
Projects may rely on block timestamps for various purposes. However, it's important to realize that miners individually set the timestamp of a block, and attackers may be able to manipulate timestamps for their own purposes. If a smart contract relies on a timestamp, it must take this into account. In `_A()` of `SwapTemplateMeta.vy`, the returned value is dependent on `block.timestamp`. This implementation entails some risk that `Amplification coefficient` is manipulated by a malicious agent. For example, miners who happen to want to swap some tokens could interfere the development of `Amplification coefficient` as a means to get a trading advantage.
Open the reportLowImplicit Assumption that Only One Base Pool Is Allowed per MetapoolCurve Finance (diff) · Quantstamp · 5 Oct 2020Acknowledged
The code implicitly allows only one base pool per metapool due to the implementation of `__init__()` and `MAX_COINS = N_COINS - 1`. It would not be possible to set up a metapool with two base pools with non-overlapping assets [GUSD, [3Pool], [sBTC]].
Open the reportLowInsufficient Input ValidationCurve Finance (diff) · Quantstamp · 5 Oct 2020Acknowledged
1. `_A` , `_fee` and `_admin_fee` in __init__() of `SwapTemplateMeta.vy` are not validated. Values bigger than `MAX_A `, `MAX_ADMIN_FEE` or `MAX_FEE` can be set here. 2. `_owner`, ` _pool_token`, `_base_pool` in `__init__()` of `SwapTemplateMeta.vy` are not validated. Providing incorrect values may result in a later discovery that the smart contract is not working as intended. 3. `_token` in `__init__()` of `DepositTemplateMeta.vy` is not validated. Providing incorrect values may result in a later discovery that the smart contract is not working as intended.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="curve-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us