Curve: defi protocols rating breakdown
Stable-asset AMM · 31 chains
Infrastructure that other infrastructure depends on: Curve’s pools are where stablecoins and pegged assets actually trade, and its depth is what several of the tokens elsewhere on this site rely on to hold their peg. Pool contracts are not upgradeable by an admin, and parameter changes go through a DAO with delays.
Infrastructure that other infrastructure depends on: Curve’s pools are where stablecoins and pegged assets actually trade, and its depth is what several of the tokens elsewhere on this site rely on to hold their peg. Pool contracts are not upgradeable by an admin, and parameter changes go through a DAO with delays.
How the score is built
Each criterion is scored 0–10 and weighted. The median column is the middle score across every entry in this ranking, so a row reads as a position rather than a number.
| Criterion | What we measured | Weight | Score | Category median | Rank | Weighted gap |
|---|---|---|---|---|---|---|
| Who can change the contract holding your money | — | 32% | 7 | 6.5 | 3 of 8 | +0.16 |
| Track record, and who paid when it broke | — | 25% | 5 | 7.5 | 8 of 8 | -0.63 |
| Value secured | $1.56bn total value locked · sourced · 2026-08-27 · source | 20% | 6 | 8.5 | 7 of 8 | -0.50 |
| Can an outsider verify it? | — | 13% | 8 | 8 | 4 of 8 | 0.00 |
| Chains and integration | 31 chains · sourced · 2026-08-27 · source | 10% | 9 | 8 | 3 of 8 | +0.10 |
Measured 27 August 2026 · weights and method · decided by track record, and who paid when it broke, worth -0.63 points against the median
Who can change the contract holding your money: 7/10
Sourced to each protocol’s own documentation: are the contracts immutable, upgradeable behind a timelock, or upgradeable by a multisig that can act immediately. If there is an emergency power — a pause, a freeze, a guardian — we record who holds it and how fast they can use it. Uniswap’s pool contracts cannot be upgraded at all. Most of this page can be changed by a vote, and some of it by a handful of signers.
Scored 7 of 10 against a category median of 6.5, which places it 3rd of 8 among defi protocols on this criterion. At a 32% weight that is 0.16 points above the median contribution of the weighted total. The best score in the category is 10, the worst 4.
Track record, and who paid when it broke: 5/10
Years of continuous operation holding real money, every incident with its date and amount, and whether users were made whole. Age alone is not evidence — plenty of protocols were old on the day they failed — but age combined with an unbroken record of not losing user funds is the strongest signal this category offers.
Scored 5 of 10 against a category median of 7.5, which places it 8th of 8 among defi protocols on this criterion. At a 25% weight that is 0.63 points below the median contribution of the weighted total. The best score in the category is 10, the worst 5.
Value secured: 6/10
Total value locked at a stated timestamp, and thirty days of protocol fees as evidence that the value is being used rather than parked. Scale matters here in a specific way: a protocol securing tens of billions has been a standing target for years and has not been taken.
Scored 6 of 10 against a category median of 8.5, which places it 7th of 8 among defi protocols on this criterion. At a 20% weight that is 0.50 points below the median contribution of the weighted total. The best score in the category is 10, the worst 5.
Can an outsider verify it?: 8/10
Open-source contracts, published audits, public parameter and risk documentation, and whether the numbers a front end shows can be independently recomputed from public data. A protocol that publishes the formula behind its yield is making a checkable claim; one that publishes only the number is not.
Scored 8 of 10 against a category median of 8, which places it 4th of 8 among defi protocols on this criterion. At a 13% weight that is exactly level with the median of the weighted total. The best score in the category is 9, the worst 6.
Chains and integration: 9/10
Chains with real deployments, and how deeply the protocol is used as infrastructure by others, from public data at a stated timestamp.
Scored 9 of 10 against a category median of 8, which places it 3rd of 8 among defi protocols on this criterion. At a 10% weight that is 0.10 points above the median contribution of the weighted total. The best score in the category is 10, the worst 4.
Its nearest neighbours in this ranking
| # | Entry | Track record, and who paid when it broke | How it differs |
|---|---|---|---|
| 5 | Sky (Maker) | 8 | Ahead by 3 on track record, and who paid when it broke. |
| 6 | Compound | 7 | Ahead by 2 on track record, and who paid when it broke. |
| 8 | EigenLayer | 6 | Ahead by 1 on track record, and who paid when it broke. |
Incidents priced into this score
- 2023-07-30 — A reentrancy bug in Vyper compiler versions 0.2.15–0.3.0 drained four Curve pools of roughly $73.5m. About 73% was returned by 7 August 2023 after negotiation and a 10% bounty offer. The flaw was in the compiler rather than in Curve’s pool logic. [users made whole: partial] [source]
Questions about this score
Was the Curve hack Curve's fault?
+
The bug was in the Vyper compiler — versions 0.2.15 to 0.3.0 — rather than in Curve's pool logic, which matters for what you can conclude from it. No audit of Curve's source code would have caught a fault in the tool that compiled it, and that generalises: the security of a protocol depends on the whole toolchain beneath it, not only on the code a reviewer reads.
Why do other protocols depend on Curve?
+
Because its invariant is tuned for assets that should trade near parity, so it holds pegged assets at tighter spreads than a general-purpose AMM can. Liquid staking tokens, wrapped assets and stablecoins rely on those pools for the depth that keeps them near their reference price — which makes Curve's health a systemic question rather than a private one.