Curve Finance

Curve is a collection of smart contracts for exchanging, borrowing and saving, governed by holders of locked CRV. Its exchange pools were designed for assets meant to hold the same value, such as two dollar stablecoins or ETH and a staked version of ETH, where traders want large swaps at close to a one-to-one rate. Around that core it has added pools for volatile assets, its own stablecoin crvUSD, a savings vault for crvUSD and Llamalend lending markets.

Michael Egorov founded Curve. The docs credit him with inventing the Stableswap algorithm in November 2019 and the later Cryptoswap design. The website at www.curve.finance is provided under terms with Swiss Stake AG, a company with its registered office in Zug, Switzerland; its disclaimers add that Swiss Stake AG does not operate the Curve functionalities themselves, which run as contracts controlled by the DAO.

CRV launched in August 2020 with a maximum supply of about 3.03 billion. Most of the remaining supply goes to liquidity providers over roughly 200 years, at a rate that falls by 16% every August. Locking CRV gives veCRV, which carries voting power, a share of protocol revenue and boosted rewards.

Curve has two kinds of exchange pool. Stableswap pools concentrate liquidity around a fixed peg, so a large swap between, say, USDC and crvUSD moves the price very little while the pool stays near balance; the docs give the example of a $1 million swap in a healthy $20 million pool costing under 0.01% in slippage. Cryptoswap pools trade assets with floating prices, such as ETH and USDT, and rebalance their concentration around the current price only when fees earned cover the cost.

Liquidity is passive in both: providers deposit and earn fees without managing a price range. Anyone can create a pool through Curve's factories, so the platform also hosts pools for small or new tokens.

crvUSD is minted against crypto collateral through a liquidation design called LLAMMA, which converts collateral gradually as its price falls rather than liquidating it all at once. Savers can deposit crvUSD in scrvUSD to earn a share of borrowing interest. Llamalend uses the same design for isolated lending markets; the docs say v1 markets are being phased out.

Each pool sets its own swap fee, and the quote shows it before you sign; Curve does not publish one rate for the whole exchange. Newer Stableswap-NG pools use dynamic fees that rise when a pool's balances drift away from the peg, which makes it more expensive to drain the scarcer asset. Gas on Ethereum, where most liquidity sits, is paid on top.

Part of each swap fee, called the admin fee, goes to the DAO, which distributes it every week to veCRV holders. On the crvUSD side, all borrow-rate fees count as admin fees, and borrowers pay a variable interest rate set by each market's monetary policy. veCRV holders can claim the previous week's revenue within 24 hours after Thursday 00:00 UTC.

DefiLlama counts about $3.87 million in fees across Curve's exchange and lending products in the 30 days to 29 October 2026, against $2.52 billion of exchange volume. The two figures cover different products, so dividing one by the other does not give a trading cost.

Curve pools are where many pegged assets keep a deep, low-slippage market, which makes them part of how those assets hold their peg: when a stablecoin trades below a dollar in a Curve pool, arbitrageurs buy it there and redeem or sell it elsewhere. That is why projects compete for CRV emissions to their pools through weekly gauge votes by veCRV holders. Our piece on how stablecoins are becoming plumbing puts this in context.

The design has a trade-off. Stableswap pools need a lot of liquidity relative to the volume they handle; as of October 2026 Curve's $2.5 billion of monthly volume runs against about $1.26 billion of locked value, well below the turnover of general-purpose exchanges. The depth is the product.

Curve is non-custodial: deposits sit in pool contracts, not with a company. Its contracts have a long audit list in the docs, from Trail of Bits, Quantstamp and MixBytes on the 2020 DAO contracts, through ChainSecurity on Tricrypto and Tricrypto-NG, MixBytes on Stableswap-NG in 2023 and on crvUSD, to ChainSecurity on cross-chain governance in September 2025. The bug bounty pays up to $250,000. An audit does not guarantee a contract is safe, and Curve's worst loss came from a layer audits did not cover.

On 30 July 2023, attackers drained four pools through a bug in the Vyper compiler, the language Curve contracts are written in. Versions 0.2.15, 0.2.16 and 0.3.0 produced bytecode whose reentrancy lock did not work across functions, even though the source code was correct. The LlamaRisk post-mortem lists losses from the pETH/ETH, msETH/ETH, alETH/ETH and CRV/ETH pools that add up to about $62 million. Part came back from a white-hat bot, and exploiters later returned funds to Alchemix and JPEG'd in exchange for a 10% bounty. The Block, citing PeckShield, put recoveries at about $53 million, which it called 73% of the stolen funds. Published loss totals range from about $62 million to $73.5 million because sources count pools and prices differently.

The other incidents hit the front end. In August 2022 a DNS attack on curve.fi drained about $570,000 from users who approved a fake contract, and in May 2025 the domain was hijacked again at its registrar. Curve now uses curve.finance.

• Admin keys. Pools and crvUSD are controlled by DAO votes that last 7 days. A 5-of-9 Emergency DAO multisig, with named members from Yearn, Convex, StakeDAO and others, can pause the peg-stability reserve, lower debt ceilings and adjust some lending parameters, but cannot move user funds.
• Depegs. A Stableswap pool holds whichever asset traders dump on it. If one coin loses its peg, liquidity providers end up holding mostly that coin.
• Lending. crvUSD and Llamalend loans can lose collateral through gradual conversion in a falling market, and lenders can face bad debt.
• Approvals and phishing. Check the domain and what you approve; see our explainer on token approvals.

Curve's contracts are permissionless. The website's terms require users not to be under UN, US, EU or Swiss sanctions and not to access it from countries embargoed or restricted by Switzerland's State Secretariat for Economic Affairs, including Belarus, Iran, North Korea, Russia, Syria, Ukraine, Venezuela and Yemen among others. The terms reserve the right to block access by location. There is no KYC; users bring their own wallet.

To swap, open www.curve.finance from a bookmark, choose the network, connect a wallet and pick the tokens; the interface routes through Curve pools. To provide liquidity, pick a pool, deposit one or more of its assets and, to earn CRV, stake the LP tokens in the pool's gauge.

Leaving a pool takes two steps if you staked: unstake from the gauge, then withdraw, in balanced proportions or as a single asset. A single-asset withdrawal from an unbalanced pool can return less than a balanced one. Locked CRV cannot be withdrawn until the lock, between one week and four years, has ended, and veCRV cannot be transferred. crvUSD loans close by repaying the debt.

Curve has no ticketed help desk. Help comes through the docs, the Discord server, Telegram groups in English, Chinese and Russian, the news site at news.curve.finance and the governance forum. Security reports go to [email protected]. The website banner tells users to check that the address is www.curve.finance, and anyone offering support by direct message is not from Curve.

Curve's history follows its own products and a handful of security events.

• November 2019: Michael Egorov publishes the Stableswap design.
• January 2020: the curvefi GitHub organization is created.
• August 2020: CRV and the Curve DAO launch after audits by Trail of Bits, Quantstamp and MixBytes.
• August 2022: DNS attack on curve.fi.
• 2023: MixBytes audits the crvUSD contracts in June; the Vyper compiler exploit hits four pools in July.
• June 2024: a new fee collection and distribution system is deployed.
• May 2025: curve.fi is hijacked at the registrar; Curve moves to curve.finance.
• By October 2026: Llamalend v1 markets are being phased out and no new ones are created.

For comparisons, see how Curve compares with other decentralized exchanges and among DeFi protocols.