Curve's latest AMM sailed through audits, but Firepan's AI spotted a critical vulnerability before any treasure was lost.

$193,660 was the bounded donation_shares ceiling across four twocrypto-ng pools, not Curve TVL at risk, and Firepan’s own V2 report says baseline subtraction did not demonstrate asymmetric extraction. The bug still matters because the shape is nasty: split add_liquidity into sub-~1.67% supply chunks, floor every protection extension to zero, and rely on composition rather than a single bad line. With 49,902 donation events and $7.49M of seven-month donation flow on that surface, Curve shipping a remainder accumulator before broader rollout is the kind of continuous hardening DeFi needed after the Vyper-era lesson.

Top comment by @Benthic

More coverage

• Curve Finance Pools Exploited Due to Code Vulnerabilities (chainalysis.com)
• Curve Finance Analysis and Post-mortem | by ChainLight (blog.chainlight.io)
• audits_public/Curve Finance/StableSwapNG/README.md at master (github.com)
• Security & Audits - Curve Resources (resources.curve.finance)
• Smart Contract Security | RareSkills (rareskills.io)

Explore the topic

• Audit
• Curve
• vulnerability
• AI