Curve DAO appoints Resupply developers to risk roles

Curve DAO approves yRisk as a new risk management service provider for crvUSD and Llamalend

On September 2, Curve DAO officially approved yRisk as its new risk management provider, responsible for monitoring the risk profile of crvUSD and Llamalend. The task was entrusted to two contributors, who were also the main developers of the Resupply protocol.

yRisk Obtained 12-month management authorization and fund allocation

yRisk will receive 12-month risk management authorization to comprehensively assess the risks of the crvUSD foundry market and the Llamalend quarantined lending market. Its scope of responsibility includes reviewing key areas such as collateral, liquidity, oracle design, concentration, and governance risk. In addition, the team will also recommend debt ceilings, market parameters, PegKeeper limits and other risk control measures. However, the Curve DAO and its emergency DAOs still retain the final decision-making and execution rights.

Under the agreement, yRisk will receive 125,000 frxUSD and 568,181 CRV respectively through two revocable one-year linear release channels. This funding package represents the approximately $250,000 annual budget requested by the team.

Voting Results and Implementation Details

yRisk's binding on-chain vote passed overwhelmingly. The final results showed that approximately 621.2 million veCRVs supported the proposal and only 5.33 veCRVs opposed it. About 87 minutes after the vote closed, the proposal was implemented.

In previous non-binding preference voting, yRisk received approximately 536.97 million votes for veCRV, with zero votes against it. A total of 47 participants voted, accounting for approximately 68.78% of the voting supply at the time of snapshot blocks.

Focus of controversy: Resupply vulnerability incident is not publicly disclosed

It is worth noting that the two main contributors to yRisk were identified in the proposal as core developers of Year and Resupply, and are the main developers of Resupply. However, reviewing the attack on Resupply in June 2025, it was not explicitly mentioned in Curve's relevant materials.

Previously, Resupply suffered losses of approximately US$9.6 million due to a donation attack. QuillAudits's analysis pointed out that the accident originated from exchange rate manipulation that affected the lending market. Attackers donated assets to almost empty vaults, causing exchange rate calculations to be rounded to zero, thereby borrowing money using artificially high collateral.

yRisk's Curve proposal disclosed the contributors 'Resupply background, but did not mention the vulnerability incident. Curve's comparative review also discussed their Resupply experience, but did not address the incident. Curve's solicitation of proposals requires relevant experience, methodology, capabilities and pricing, but the published terms do not explicitly require disclosure of every event in a contributor's past project. Therefore, such omissions do not constitute a violation of disclosure requirements.

Concerns and Suggestions of Auditing Organizations

Swiss pledge agency Swiss Stake reviewed nine competing applications before Curve conducted a preference vote. Its assessment report recognizes yRisk has practical knowledge of Curve, Llamalend, Yearn and Resupply, but also points to major concerns about capabilities.

Swiss Stake questioned whether the two contributors had enough time and energy to monitor the expanding market volume and provide adequate emergency response. "It's unclear whether they can withstand this workload and provide sufficient emergency coverage as the market increases," Swiss Stake said. The statement emphasized uncertainty rather than concluding that yRisk lacked the necessary resources. To this end, Swiss Stake recommends setting an initial limited deadline for any provider selected by Curve and setting up public review checkpoints."

yRisk replaces LlamaRisk

yRisk's appointment occurred after LlamaRisk terminated the partnership prematurely. LlamaRisk was renewed in April 2026 and is scheduled to work until April 2027. However, the agency announced its departure on May 29 and ceased active work on June 30, returning approximately 270,247 unattributed crvUSD to Curve's treasury. LlamaRisk described his departure as a structural decision to allocate resources rather than a criticism of Curve. Curve then launched an alternative selection process on July 7.

Future Outlook and Transparency Commitment

As Curve expands Llamalend (previously reported that Llamalend v2 has introduced segregated lending markets on Optimism and plans to deploy to Ethereum), risk management has always been a core concern for the ecosystem. In March, attackers withdrew about $240,000 from the Llamalend market due to improper configuration of the oracle.

yRisk now needs to review LlamaRisk's existing reports, models, dashboards, and codebases and decide which resources should be retained, rebuilt, or obsolete. The proposal promises to provide monthly progress reports, ongoing monitoring and emergency support. The revocable funding structure gives Curve DAO the power to suspend remaining release channels before the end of its 12-month term. Future public reviews will allow governance actors to assess whether yRisk is fulfilling its monitoring, reporting and response commitments. As of now, Curve has not announced a specific review date.