Curve.fi security record
As of 4 Nov 2026, Curve.fi has 7 audit reports by 2 security firms on Trustblock; the latest is by ChainSecurity, dated 21 Feb 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Audits7
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| crvUSD | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Curve scrvUSD | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Curve Fee Splitter | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| PegKeeperV2 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Curve Finance – Tricrypto Security Audit | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Curve ETH / sETH | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Curve Finance (diff) | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Findings59
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 1 | 0 | 10 |
| Low | 0 | 10 | 35 |
HighChecks-effects-interactions Pattern and Reentrancy LockscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportHighIncorrect Verification of Health LimitcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportHighOracle Price Updates Can Be SandwichedcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect Max BandcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportMediumInterest Rate Does Not CompoundcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportMediumManipulation of Active BandcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportMediumNon-Tradable FundscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportMediumPegKeeper Can Be Drained if Redeemable Stablecoin Permanently DepegscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportMediumPotential Denial of Service (DoS) Attack on Peg KeepercrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportMediumVariable OverrideCurve scrvUSD · ChainSecurity · 3 Dec 2024Fixed
The report gives no description here.
Open the reportShow 10 more
MediumCertain Token Combination Cause Numerical ErrorsCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Fixed
The report gives no description here.
Open the reportMediumReentranciesCurve ETH / sETH · ChainSecurity · 27 Sep 2021Fixed
The report gives no description here.
Open the reportMediumHard-coded Array Index Allows for Only One Metapool TokenCurve Finance (diff) · Quantstamp · 5 Oct 2020Fixed
In `DepositTemplateMeta.vy` L158, the index for the base pool's LP token is hard-coded in function `remove_liquidity()`as `self.coins[1]`. This can be a problem if the metapool has multiple tokens + base pool LP token.
Open the reportLowA User's Liquidation Discount Can Be Updated by Anyone at Any TimecrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowApplyNewAdmin Event Emitted With Wrong Argument in PegKeepercrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowDraining FundscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowInaccurate _p_oracle_up(n) for High/Low Values of ncrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Array LengthcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Calculations in health_calculatorcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowIncorrect CommentscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowMeaningful Revert ReasonscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowMissing Sanity CheckscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowMultiple Calls to the AMMcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowNo EventscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowNon-Indexed EventscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowPotential Optimization With Immutable PriceOraclecrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowPotentially Incorrect Admin FeescrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowSimpler Calculations PossiblecrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowSuperfluous CheckcrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowSuperfluous Interface DefinitionscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowSuperfluous Variable Assignment for Number of BandscrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowUnnecessary SubtractioncrvUSD · ChainSecurity · 21 Feb 2025Fixed
The report gives no description here.
Open the reportLowContradiction in ConditionCurve Fee Splitter · ChainSecurity · 25 Sep 2024Fixed
The report gives no description here.
Open the reportLowIncorrect InterfaceCurve Fee Splitter · ChainSecurity · 25 Sep 2024Fixed
The report gives no description here.
Open the reportLowMAX_CONTROLLERS Mismatch Between ControllerFactory and FeeSplitterCurve Fee Splitter · ChainSecurity · 25 Sep 2024Fixed
The report gives no description here.
Open the reportLowNon-Indexed EventsCurve Fee Splitter · ChainSecurity · 25 Sep 2024Fixed
The report gives no description here.
Open the reportLowReceiver Can DoS the DistributionCurve Fee Splitter · ChainSecurity · 25 Sep 2024Fixed
The report gives no description here.
Open the reportLowMissing EventsPegKeeperV2 · ChainSecurity · 12 Dec 2023Fixed
The report gives no description here.
Open the reportLowMissing Sanity ChecksPegKeeperV2 · ChainSecurity · 12 Dec 2023Fixed
The report gives no description here.
Open the reportLowAdmin Fees Can Be Claimed RetroactivelyCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Fixed
The report gives no description here.
Open the reportShow 8 more
LowEvent Information MissingCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Fixed
The report gives no description here.
Open the reportLowMismatched BoundsCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Fixed
The report gives no description here.
Open the reportLowPacked Getters Can Be More RestrictiveCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Fixed
The report gives no description here.
Open the reportLowParameter Check MissingCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Fixed
The report gives no description here.
Open the reportLowSlight Code SimplificationCurve Finance – Tricrypto Security Audit · ChainSecurity · 29 Sep 2021Fixed
The report gives no description here.
Open the reportLow_xp and _xp_mem Redundant Array AccessCurve ETH / sETH · ChainSecurity · 27 Sep 2021Fixed
The report gives no description here.
Open the reportLowget_D Should Handle the Case of Non-convergenceCurve ETH / sETH · ChainSecurity · 27 Sep 2021Fixed
The report gives no description here.
Open the reportLowRedundant Use of RATES and PRECISIONCurve ETH / sETH · ChainSecurity · 27 Sep 2021Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="curve-finance"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us