Curve's latest AMM sailed through audits, but Firepan's AI spotted a critical vulnerability before any treasure was lost.
𝕏/@FirepanHQ •
Revision history
5 recorded changes
Want your article here?
Promote with Leviathan News$193,660 was the bounded donation_shares ceiling across four twocrypto-ng pools, not Curve TVL at risk, and Firepan’s own V2 report says baseline subtraction did not demonstrate asymmetric extraction. The bug still matters because the shape is nasty: split add_liquidity into sub-~1.67% supply chunks, floor every protection extension to zero, and rely on composition rather than a single bad line. With 49,902 donation events and $7.49M of seven-month donation flow on that surface, Curve shipping a remainder accumulator before broader rollout is the kind of continuous hardening DeFi needed after the Vyper-era lesson.
Top comment by @Benthic
More coverage
- Curve Finance Pools Exploited Due to Code Vulnerabilities (chainalysis.com)
- Curve Finance Analysis and Post-mortem | by ChainLight (blog.chainlight.io)
- audits_public/Curve Finance/StableSwapNG/README.md at master (github.com)
- Security & Audits - Curve Resources (resources.curve.finance)
- Smart Contract Security | RareSkills (rareskills.io)
Explore the topic
More on Audit
ChainSecurity completes a new security audit for Aave V4, reviewing the Liquidity Hub, Spoke and Position Manager contracts ahead of the protocol's next evolution
𝕏/@aave ·
AI agent design is shifting from single feedback loops to graph-based architectures, using interconnected evaluation, audit and control systems to improve reliability
𝕏/@IntuitMachine ·
Aero delays launch to September, adds $400K Sherlock contest after audits find no critical or high bugs
aero.xyz ·
Ligero adds auditable private stablecoin payments to Celo for payroll, treasury, and B2B flows
blog.celo.org ·
Kraken parent asks Delaware court to enforce $22M Mazars award after 2022 audit exit
𝕏/@DavidLRipley ·
Consensys Diligence brings Chonky to MetaMask, using 100K+ findings to scale human-led audits
metamask.io ·
ChainSecurity completes a new security audit for Aave V4, reviewing the Liquidity Hub, Spoke and Position Manager contracts ahead of the protocol's next evolution
𝕏/@aave ·
AI agent design is shifting from single feedback loops to graph-based architectures, using interconnected evaluation, audit and control systems to improve reliability
𝕏/@IntuitMachine ·
Aero delays launch to September, adds $400K Sherlock contest after audits find no critical or high bugs
aero.xyz ·
Ligero adds auditable private stablecoin payments to Celo for payroll, treasury, and B2B flows
blog.celo.org ·
Kraken parent asks Delaware court to enforce $22M Mazars award after 2022 audit exit
𝕏/@DavidLRipley ·
Consensys Diligence brings Chonky to MetaMask, using 100K+ findings to scale human-led audits
metamask.io ·