I keep coming back to the same odd feeling whenever a large DeFi protocol picks a new risk team. The vote looks clean. The budget looks modest. Then you sit with the details and realize the real story is not the paycheck. It is who gets trusted to watch the pipes after someone else walked away.
Why This Curve Vote Matters More Than The Headline
On September 2, Curve DAO approved yRisk as the new risk-management provider for crvUSD and Llamalend. The binding onchain vote was not close. Roughly 621.2 million veCRV supported the proposal. Opposition came in at about 5.33 veCRV. The execution followed about 87 minutes after voting closed. That is the official version. The more interesting version is why Curve needed a replacement at all, what the new team is being paid to do, and why a prior incident around Resupply keeps hovering in the background even when the proposal text barely looks at it.
I have watched a lot of these mandates come and go. Some read like consulting contracts with extra dashboards. Others quietly decide which collateral is allowed to sit next to a stablecoin that people treat as boring until it is not. This one sits in the second group. Curve is not hiring a newsletter writer. It is handing two contributors a twelve-month brief over mint markets and isolated lending markets while governance still keeps the last word.
The Mandate In Plain Language
yRisk will review collateral quality, liquidity conditions, oracle design, concentration risk, and governance risk. It will also recommend debt ceilings, market parameters, PegKeeper limits, and other controls. None of that is glamorous. All of it is the kind of work that only becomes famous after something breaks.
The team says it will build public monitoring systems, dashboards, alerts, and automated code-analysis tools. Work paid by the mandate is generally meant to be released under an open-source license. That last point matters more than the press-friendly language around “transparency.” If the dashboards are public, outsiders can argue with the assumptions. If they stay inside a private repo, the community is left trusting a slide deck.
- Watch crvUSD mint markets and Llamalend isolated lending markets
- Flag weak collateral, thin liquidity, and shaky oracles
- Propose ceilings, parameters, and PegKeeper limits
- Support incidents while Curve governance and the emergency DAO keep final authority
That last bullet is the quiet power clause. yRisk can recommend. It cannot, by itself, flip the switch. I like that structure in theory. In practice it only works if recommendations arrive early enough that governance is not rubber-stamping a mess that already happened.
What The Team Is Being Paid
The package is 125,000 frxUSD and 568,181 CRV through two revocable one-year vesting streams. The team framed this as an annual budget near $250,000. Revocable is the word I would circle with a pen. Curve can stop the remaining streams before the year is out. That is not a golden handshake. It is a leash with a polite label.
Is $250,000 a lot for this job? Depends what you compare it with. For two people covering a growing set of markets, plus incident coverage, plus public reporting, it is not luxury money in crypto terms. For a protocol that already learned how expensive a sloppy oracle can be, it is cheap insurance if the work is real. Cheap insurance that does not get used is still better than an unpaid volunteer who disappears on a Friday night.
| Item | Detail |
| Provider | yRisk |
| Scope | crvUSD mint markets and Llamalend isolated markets |
| Term | Twelve months, revocable vesting |
| Cash-like stream | 125,000 frxUSD |
| Token stream | 568,181 CRV |
| Binding support | About 621.2 million veCRV for, 5.33 against |
Who yRisk Actually Is
The proposal names two contributors, known as Wavey and Dudesahn. They are described as core developers at Yearn and Resupply, and as Resupply’s primary developers. That combination is the heart of the argument for hiring them. They already live in the same design language as Curve, Yearn, and the lending stack that grew around those systems. They are not tourists reading a white paper on a Sunday.
I have a soft spot for practitioners over pure theorists in this corner of the market. Models are useful. Muscle memory around how a Curve market actually behaves under stress is more useful. The catch is obvious. People who ship products also inherit the scars of those products. Experience cuts both ways, and pretending otherwise is marketing.
Practical knowledge of Curve, Llamalend, Yearn and Resupply is a genuine advantage. Capacity is the open question that does not go away because a vote was lopsided.
The Resupply Episode That Did Not Make The Brochure
Resupply suffered a donation attack in June 2025 that led to roughly $9.6 million in losses. Public analysis of that incident pointed to exchange-rate manipulation in a lending market. The attacker donated assets into a nearly empty vault. The exchange-rate math rounded toward zero. That distortion let the attacker borrow against collateral that looked healthier than it was.
yRisk’s Curve proposal disclosed the contributors’ Resupply roles. It did not mention the exploit. Curve’s comparative write-up also discussed Resupply experience without naming the incident. I will be blunt. That silence is not proof of a cover-up. The published call for proposals asked for relevant experience, methodology, capacity, and pricing. It did not, at least in the materials reviewed around this vote, demand a full incident log from every prior project a contributor touched.
Still. Readers are not children. If you sell “we know this stack from the inside,” the public is going to ask what the inside looked like when it failed. Omitting a nine-figure-adjacent loss from the narrative does not automatically break a disclosure rule. It does leave a taste. In my experience, communities forgive teams that stare at their own wreckage. They get twitchy when the wreckage is treated like a footnote that never made layout.
How A Donation Attack Actually Works In Everyday Terms
Skip the folklore. Think of a nearly empty jar that is supposed to represent the value of a share in a vault. Drop a large gift into that jar and the accounting can behave in ugly ways if the code assumes the jar was never that empty. Round a number toward zero at the wrong moment and the system can treat junk as treasure. Then a borrower walks in with that inflated reading and leaves with assets that were never meant to leave.
That is the shape of the 2025 episode, not a courtroom verdict against the two people now hired by Curve. Protocols get attacked. Builders keep building. The fair question is whether the same people can now hunt similar bugs in crvUSD and Llamalend with more paranoia than they had the first time. Maybe they can. That is the bet Curve just placed.
LlamaRisk Left First, And That Changed The Clock
Curve did not wake up one morning and decide it wanted a new brand on the risk reports. LlamaRisk ended the engagement early. It had renewed in April 2026 with an eye on April 2027. Then it announced its departure on May 29 and stopped active work on June 30. Unvested funding of about 270,247 crvUSD went back to Curve’s treasury.
LlamaRisk framed the exit as a structural choice about how it allocates people, not as a public scolding of Curve. Fine. Resource allocation is a grown-up reason. The market still has to live with the gap. Curve opened the replacement process on July 7. By early September a successor was funded. That is fast by DAO standards and slow if you are the person watching an isolated market with a weird oracle.
There is also recent scar tissue inside Curve’s own lending world. In March, a poorly configured oracle helped an attacker pull about $240,000 from a Llamalend market tied to the sDOLA-crvUSD pool. That number is smaller than the Resupply figure. It is not small if you were the user on the wrong side of the configuration. Risk management is not a vibe. It is the difference between a parameter that looks neat in a forum post and a parameter that survives a Sunday dump.
The Preference Vote Already Told You The Outcome
Before the binding vote, a nonbinding preference poll had yRisk at about 536.97 million veCRV in favor and none against, from 47 voters. That was roughly 68.78% of the voting supply at the snapshot. Once a preference vote looks like that, the binding round is often theater with better finality. I do not say that to sneer at governance. I say it because whale-weighted systems can look unanimous while still hiding a staffing debate that never got a real audience.
Swiss Stake reviewed nine competing applications. Its note credited yRisk with hands-on knowledge of Curve, Llamalend, Yearn, and Resupply. Then it pointed at the obvious weak spot. Two contributors with other jobs may struggle to watch a rising number of markets and still show up when an incident starts at 2 a.m. The review did not claim they were unqualified. It said the workload question was not settled.
It is not yet clear whether they can sustain that workload and provide sufficient incident coverage as the number of markets expands.
– Independent review summarized during the selection process
The same review floated an initial limited mandate and a public checkpoint for whoever won. That advice survived in spirit even if the political momentum favored a full year. Revocable streams are the compromise. Curve can cut the remaining pay if the monthly reports look thin.
Llamalend Is Growing, Which Makes The Job Harder
The timing is not accidental. Llamalend has been expanding. Isolated lending markets appeared on Optimism with a later Ethereum deployment in the plan. Isolated markets sound safer because one rotten collateral type is not supposed to infect every other market. That is the brochure. The operating reality is more markets, more oracles, more debt ceilings, more edge cases, more nights when someone has to decide whether a feed is lying.
Perhaps the most interesting aspect is how quickly “isolated” becomes a staffing problem. Ten markets can be watched by two sharp people. Forty markets start to look like a newsroom that never hired a night editor. I have found that protocols love the architecture of isolation and underestimate the human roster it demands. Code does not get tired. Reviewers do.
- Map every live mint market and isolated market LlamaRisk left behind
- Decide which dashboards and models are worth keeping
- Rebuild the rest in public where possible
- Set a reporting rhythm that governance can actually read
- Prove incident coverage before the next ugly Sunday
What “Risk Provider” Should Mean In 2026
The title sounds official. The work is closer to a mix of auditor, weather forecaster, and hall monitor. You look at collateral that everyone loves this month. You ask what happens if the liquidity on the other side of that love affair dries up. You look at an oracle path and ask who can shove it. You look at a debt ceiling and ask whether governance will raise it because a partner asked nicely.
Good risk work is slightly annoying. It tells growth teams to wait. It tells token holders that a shiny market is not ready. It tells founders that their favorite listing is concentrated in three wallets. If a provider only publishes charts that make the protocol look careful, you do not have a risk team. You have a branding desk with extra SQL.
I would rather read a short memo that says “do not raise this ceiling” than a twenty-page report that congratulates everyone for existing. Tone is not the product. Timing is the product. A correct warning three days late is a museum piece.
Governance Still Owns The Finger On The Button
Curve governance and the emergency DAO keep authority over final decisions. That is healthy. It is also an alibi if people later say “the risk team should have stopped this.” Stopped this how, exactly, if the team can only recommend? The honest answer is shared blame. A provider that stays quiet is negligent. A DAO that ignores a loud provider is reckless. Both can be true in the same week.
veCRV voting power made this appointment look inevitable. That does not make the next parameter vote inevitable. Watch whether yRisk’s first public notes are specific. Names of markets. Numbers on ceilings. Oracle paths that look fragile. If the first month is only process language, the leash should tighten.
Open Source Is A Promise, Not A Personality Trait
The proposal says funded work will generally be open source. Good. Publish the monitors. Publish the alert logic. Publish the assumptions behind a debt-ceiling recommendation. Do not hide the interesting bits in a private Notion page and then wave at “methodology” on a forum.
Open source also creates a second audience. Rival researchers will poke holes. That is the point. A risk stack that cannot survive outside criticism is not a risk stack. It is a private diary with a budget.
What I want to see in month one: inherit useful LlamaRisk artifacts kill the ones that rot ship one public dashboard people actually open write one parameter note that names a number show who is on call when a feed goes weird
Capacity Is The Unromantic Risk
Everyone likes to argue about past exploits because they make vivid paragraphs. The duller threat is calendar math. Two people. Other jobs at Yearn and Resupply. A market list that is supposed to grow. Incident coverage that cannot be a best-effort Slack reply.
Could they hire help later? Possibly. The mandate as funded does not magically create a bench. If Curve wanted a firm with a night rotation, it could have picked one. It picked domain fluency instead. That trade can work. It can also fail in the most boring way possible: too many markets, too few hours, one missed alert.
I do not need a twenty-person consultancy to believe a two-person shop. I need evidence that the shop knows when it is drowning. Asking for help early is a skill. Pretending you can watch everything is how protocols collect post-mortems.
How To Read The First Quarterly Stretch
Ignore the victory posts. Read the monthly progress notes. Look for three things. Did they finish the inheritance review of old reports, models, dashboards, and repos? Did they pick a public checkpoint date even if governance never carved one in stone? Did any recommended control actually land onchain?
A future public review would let holders judge monitoring, reporting, and response. Curve has not pinned a date. Dates have a way of slipping unless someone with voting power keeps the item on the agenda. If you care about this appointment, the useful move is not another slogan. It is asking for the checkpoint in the same venues that passed the budget.
What This Says About DeFi Risk Culture
DeFi still treats risk teams like optional furniture. Then a market gets drained and everyone discovers furniture. Curve at least pays for the function and puts a clock on it. That is more mature than the old habit of hoping a researcher will argue for free until they burn out.
The culture gap is disclosure. Experience is advertised. Failures attached to that experience are softened, postponed, or left for journalists to drag into the room. I am not asking for a ritual apology every time a former protocol gets hit. I am asking for adult context. “We built X. X got exploited this way. Here is what we changed in our review process.” That paragraph would have cost nothing and bought a lot of trust.
Is that harsh? A little. Harsh is cheaper than another quiet omission the next time a DAO hires the same kind of team.
A Realistic Scorecard For The Year
Success should not be “no exploits ever.” That standard is a fantasy in open systems. Success looks like fewer preventable parameter mistakes, faster public explanation when something looks off, and a paper trail that another team could pick up if yRisk’s streams get revoked.
- Clear monthly notes instead of vague “monitoring continues” lines
- Published tools other researchers can fork
- Debt-ceiling and oracle comments that arrive before listings get political
- Honest staffing updates if the market count explodes
- No gap between an alert and a human who can escalate
Failure would look quieter. Reports that recycle last month’s adjectives. Dashboards that exist but do not update. A forum that only hears from the team after a loss. Revocable pay exists for that version of the story.
The User-Level Stakes People Forget
If you mint crvUSD or lend on Llamalend, this hire is not a governance hobby. It sits between your collateral and the moment an oracle or a thin pool turns a normal day into a bad one. You will not meet Wavey or Dudesahn. You will meet their work only if it is visible enough to argue with.
That is why I keep circling public artifacts. A user cannot audit a private conversation. A user can read a parameter note and decide the market is too loose. Self-custody does not mean you have to reinvent risk analysis in a spreadsheet at midnight. It does mean you should demand that the people paid to do it show their homework.
My Own Read, Without The Victory Lap
Would I have voted for domain specialists over a larger unknown shop? Probably, with conditions. The conditions are the ones Swiss Stake already sketched: limited trust at first, public review, and no romance about two people scaling forever. Curve funded the specialists and kept the leash. That is a workable design if anyone pulls the leash.
The missing exploit language still bothers me. Not because it proves bad faith. Because it was an easy paragraph and it was not written. Easy paragraphs that go unwritten tend to become later arguments. Get ahead of those arguments or live with them.
So here is the unfancy conclusion. Curve needed a risk provider after LlamaRisk left. yRisk won a near-unanimous vote, a year of revocable pay, and a brief that will get harder as Llamalend adds rooms to the house. The team knows the stack. The stack has bitten people before. The next twelve months are the only review that counts.
Questions Worth Asking In The Forum, Not In A Group Chat
Who is actually on call during an incident window? Which LlamaRisk models survive the first month? When is the first public checkpoint, even if it is informal? How will a conflict get handled if a Resupply-related design pattern shows up inside a Curve market recommendation? Those are not gotcha questions. They are operating questions. A serious provider will answer them without theater.
If the answers stay foggy, the 621 million veCRV that waved this through can wave something else through later. That is the whole point of revocable streams. Use them as a tool, not as decoration on a budget post.
And if the answers come back sharp, specific, and a little uncomfortable for growth-at-all-costs voices, then Curve will have bought something rarer than a new logo on a risk page. It will have bought friction in the right place. Friction is not fun. It is how a stablecoin market stays dull, which is the nicest thing you can say about one.
