Curve DAO awards risk management mandate to yRisk despite Resupply exploit history

Curve DAO has approved a proposal to award its risk management mandate to yRisk, a team of two developers, to monitor crvUSD and Llamalend. The decision comes despite yRisk's contributors being primary developers of Resupply, a protocol exploited for $9.6 million in June 2025—a detail omitted from the proposal. yRisk replaces LlamaRisk, which departed ten months early. Swiss Stake has raised concerns regarding yRisk's capacity to handle the workload.

yRisk mandate award

• ▪Curve DAO approved a proposal on September 2, 2026, to fund yRisk as the risk provider for crvUSD and Llamalend.
• ▪As of September 2, 2026, the circulating supply of crvUSD stood at $285.5 million, while Llamalend v1 held $76 million in deposits.
• ▪Curve founder Michael Egorov, writing under the forum handle michwill, authored the call for risk provider proposals and the subsequent results post.
• ▪The risk provider yRisk consists of two contributors who are core developers at Yearn and Resupply.

Resupply exploit omission

• ▪The June 2025 exploit of Resupply was omitted from yRisk's proposal to Curve DAO and from Curve's comparative review.
• ▪The stablecoin and lending protocol Resupply, built on crvUSD and CurveLend, was exploited for $9.6 million in June 2025 through a donation attack.

Curve DAO voting results

• ▪In the non-binding preference votes, CrossWorlds finished second with 401.4 million veCRV in favor, while Blockworks Advisory, Xerberus, and Pharos Watch each received fewer than 300 votes in favor.
• ▪In a non-binding preference vote held from August 10 to August 17, 2026, yRisk received 536.9 million veCRV votes in favor and zero votes against.
• ▪The binding Curve DAO Proposal 1492 closed on September 2, 2026, with 621.16 million veCRV votes in favor and 5.33 votes against.

Funding structure details

• ▪The approved Curve DAO mandate pays yRisk through two revocable one-year vesting streams consisting of 125,000 frxUSD and 568,181 CRV.
• ▪The 568,181 CRV portion of yRisk's funding was valued at approximately $209,000 as of September 3, 2026.

Capacity concerns raised

• ▪In an assessment dated August 3, 2026, Swiss Stake raised concerns about whether the two contributors of yRisk could sustain the workload of monitoring Curve's expanding markets.
• ▪Swiss Stake recommended that Curve DAO implement an initial limited mandate with a public review checkpoint for the selected risk provider.

LlamaRisk early departure

• ▪LlamaRisk announced its exit from its Curve engagement on May 29, 2026, ending active work on June 30, 2026, ten months before its renewal term was set to expire.
• ▪Following its early departure, LlamaRisk returned approximately 270,247 crvUSD of unvested funding to the Curve treasury.

1 source