[Crypto projects](https://revain.org/projects/) › Curve Finance

# Curve Finance (CRV): how it works, supply and reviews

## In short

- **Type**: Non-custodial AMM exchange made of smart contracts on Ethereum and EVM-compatible chains
- **Maximum supply**: About 3.03 billion CRV, launched August 2020 on Ethereum
- **Risks and caveats**: Smart contracts may contain bugs, and immutable pools cannot be patched after deployment
- **Checked**: 31 October 2026

## Key facts

- **Ticker**: CRV
- **Official site**: [curve.finance](https://www.curve.finance/)

Key facts checked on 31 October 2026 against official sources.

## What is Curve Finance

Curve Finance is a decentralised exchange of automated market makers on Ethereum and other EVM chains, designed first for low-slippage trading between stablecoins and later for volatile assets. Curve also issues the crvUSD stablecoin and runs Llamalend lending markets. It is governed by the Curve DAO, where voting power comes from locking CRV as veCRV.

## Network and consensus

| Parameter | Details |
|---|---|
| Type | Non-custodial AMM exchange made of smart contracts on Ethereum and EVM-compatible chains |
| Pool types | Stableswap pools for pegged assets (fees mostly 0.005% to 0.02%) and Cryptoswap pools for volatile assets (about 0.05% to 0.4%) |
| Upgradeability | Core pool contracts are immutable and cannot be upgraded |
| Programming language | Contracts are written almost entirely in Vyper |
| Stablecoin and lending | crvUSD is a crypto-backed CDP stablecoin; Llamalend is a permissionless lending protocol; both use LLAMMA soft liquidation |

## Supply and issuance

| Parameter | Details |
|---|---|
| Maximum supply | About 3.03 billion CRV, launched August 2020 on Ethereum |
| Allocation | Community emissions 57%, core team 26.4%, early users 5%, community reserve 5%, investors 3.6%, employees 3% |
| Issuance | Emissions to liquidity providers fall by 16% each August; most remaining CRV is emitted over about 200 years |
| Vesting | All team, investor and insider allocations unlocked; the last (team) vesting ended in August 2024 |

## What CRV is used for

- CRV rewards liquidity providers in pools and lending markets
- Locking CRV as veCRV (1 week to 4 years) gives DAO voting power, a share of protocol revenue and boosted LP rewards
- veCRV holders vote weekly on which pools receive CRV emissions (gauge weights)

## Who develops and governs Curve Finance

- **Governance**: Curve DAO governed by veCRV holders; on-chain proposals run 7 days; 2,500 veCRV needed to create a vote
- **veCRV**: Non-transferable; balance decays linearly until the lock expires
- **Emergency DAO**: 5-of-9 community multisig with limited powers (pausing, lowering debt ceilings, risk parameters); cannot move user funds
- **Cross-chain**: Changes on other chains are decided by an Ethereum vote and broadcast to that chain
- **Open source**: Contracts are published in the curvefi GitHub organisation; audit reports are public

## History

| Date | Event |
|---|---|
| 10 November 2019 | StableSwap whitepaper published |
| August 2020 | CRV token and the Curve DAO with vote-escrowed veCRV launched on Ethereum |
| 9 June 2021 | Cryptoswap whitepaper for volatile-asset pools published |
| 9 October 2022 | crvUSD stablecoin whitepaper published |
| August 2024 | Final team vesting of CRV completed |

## Security and audits

- Published audits include Trail of Bits (DAO contracts, 10 July 2020), MixBytes (July 2020), Quantstamp (DAO contracts, 5 August 2020) and ChainSecurity (FeeSplitter 25 September 2024; cross-chain governance 17 September 2025)
- Self-run bug bounty with payouts up to $250,000
- Core pool contracts are immutable, so fixes cannot be pushed to deployed pools

## Security incidents

| Date | What happened | Source |
|---|---|---|
| 30 July 2023 | Exploit: Several Curve liquidity pools were exploited through a re-entrancy guard bug in Vyper compiler versions 0.2.15, 0.2.16 and 0.3.0 (per the Vyper team's post-mortem; the post-mortem gives no loss amount). Funds returned: not stated | [hackmd.io](https://hackmd.io/@vyperlang/HJUgNMhs2) |
| 12 May 2025 | Domain hijack: At about 20:55 UTC on 12 May 2025 attackers who had access to registrar iwantmyname changed the DNS delegation of curve.fi and redirected users to a decoy site that prompted for wallet signatures; Curve said no contracts or data were compromised and moved its interface to curve.finance. | [news.curve.finance](https://news.curve.finance/curve-domain-incident/) |

Further incidents are reported by third parties (press, incident databases) but are not confirmed in the company’s own channels, so they are not listed here.

## Official CRV contracts

| Network | Contract address |
|---|---|
| Ethereum | [0xD533a949740bb3306d119CC777fa900bA034cd52](https://etherscan.io/address/0xD533a949740bb3306d119CC777fa900bA034cd52) |
| Ethereum | [0x5f3b5dfeb7b28cdbd7faba78963ee202a494e2a2](https://etherscan.io/address/0x5f3b5dfeb7b28cdbd7faba78963ee202a494e2a2) |
| Ethereum | [0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E](https://etherscan.io/address/0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E) |

CRV, veCRV and crvUSD on Ethereum, as listed in the Curve contract deployments page.

## Risks and caveats

- Smart contracts may contain bugs, and immutable pools cannot be patched after deployment
- crvUSD and Llamalend loans use gradual soft liquidation, which still causes losses and can end in full liquidation
- CRV supply keeps growing through emissions to liquidity providers

## Official links

- Website: [www.curve.finance](https://www.curve.finance/)
- Docs: [docs.curve.finance](https://docs.curve.finance/)
- Source code: [github.com/curvefi](https://github.com/curvefi)
- Governance forum: [gov.curve.finance](https://gov.curve.finance)
- Blog: [news.curve.finance](https://news.curve.finance/)

## Questions and answers

**What is Curve Finance?**

A decentralised AMM exchange on Ethereum and EVM chains for stablecoins and volatile assets, which also issues the crvUSD stablecoin and runs Llamalend lending.

**What is the maximum supply of CRV?**

About 3.03 billion CRV. Emissions to liquidity providers fall 16% each August, and all team and investor tokens unlocked by August 2024.

**What is veCRV?**

CRV locked for 1 week to 4 years. It is non-transferable and gives voting power, a share of protocol revenue and boosted rewards.

**Who controls Curve?**

The Curve DAO, governed by veCRV holders through 7-day on-chain votes; a 5-of-9 Emergency DAO has limited emergency powers and cannot move user funds.

**Is Curve audited?**

Audit reports from Trail of Bits, MixBytes, Quantstamp, ChainSecurity and others are published in the Curve docs; a bug bounty pays up to $250,000.

## Sources

- [Curve docs - What is Curve?](https://docs.curve.finance/user/introduction)
- [Curve docs - CRV](https://docs.curve.finance/user/curve-tokens/crv)
- [Curve docs - What is veCRV?](https://docs.curve.finance/user/vecrv/what-is-vecrv)
- [Curve docs - DAO overview](https://docs.curve.finance/user/dao/overview)
- [Curve docs - Emergency DAO](https://docs.curve.finance/user/dao/emergency-dao)
- [Curve docs - DEX overview](https://docs.curve.finance/user/dex/overview)
- [Curve docs - Security audits](https://docs.curve.finance/user/security/audits)
- [Curve docs - Security practices](https://docs.curve.finance/user/security/practices)
- [Curve docs - Bug bounty](https://docs.curve.finance/user/security/bug-bounty)
- [Curve docs - Liquidity pools risk disclaimer](https://docs.curve.finance/user/security/risks/pools)
- [Curve docs - Whitepapers](https://docs.curve.finance/user/reference/whitepapers)
- [Curve docs - Contract deployments](https://docs.curve.finance/user/deployments)

## More in this section

- [Synthetix (SNX)](https://revain.org/projects/synthetix/)
- [Berachain (BERA)](https://revain.org/projects/berachain/)
- [Sushi (SUSHI)](https://revain.org/projects/sushiswap/)
- [Osmosis (OSMO)](https://revain.org/projects/osmosis/)
- [MultiversX (EGLD)](https://revain.org/projects/multiversx/)
- [Sonic (S)](https://revain.org/projects/sonic/)
- [All Crypto projects →](https://revain.org/projects/)

## How voting works

Votes are anonymous and carry no text. Each device has one vote per item; press the same button again to remove it. Cloudflare Turnstile checks that a person is voting. We keep a random device ID in a cookie and a salted hash of the IP address to limit abuse — no names, no accounts. Votes are visitors’ opinions, not investment advice.

Page updated: 2026-10-31

---
Source: https://revain.org/projects/curve-dao/