Curve DAO Entrusts Risk Management to yRisk
In a decisive governance move, Curve DAO has formally designated yRisk as the new risk management provider for its key ecosystem offerings, crvUSD and Llamalend. The decision marks the conclusion of a selection procedure that commenced in July following the unexpected departure of the protocol’s previous risk service provider. The mandate grants yRisk the responsibility of overseeing security parameters, collateral assessments, and risk modeling across Curve’s flagship lending and stablecoin architectures.
Despite passing with a massive governance majority, the approval has drawn attention due to background details regarding yRisk’s core team. The entity is driven by two key contributors who serve as the lead developers for Resupply, a project that suffered a major security breach earlier this year. Crucially, details regarding this incident were not highlighted within the initial proposal presented to Curve DAO token holders.
Voting Outcomes and Allocation of Funds
The governance vote concluded with unanimous backing from participating stakeholders. A total of 536.9 million veCRV (vote-escrowed CRV) votes were cast in favor of the proposal, with zero votes cast in opposition. The overwhelming alignment from voters highlights the community’s urgent desire to fill the risk management void left earlier in the summer.
Following the successful vote, the treasury transaction was executed on September 2. The funding package transferred to yRisk includes:
- 125,000 frxUSD: Providing immediate liquid capital for operational expenses.
- 568,181 CRV: Serving as native token incentives aligned with long-term protocol performance.
This capital allocation is intended to support yRisk’s ongoing monitoring efforts, automated risk parameter adjustments, and regular research reports tailored to crvUSD collateral assets and Llamalend market conditions.
The Departure of LlamaRisk and Contextual Landscape
The necessity for a new risk manager arose when LlamaRisk, the long-standing risk framework provider for Curve Finance, stepped down from its role. LlamaRisk departed ten months into a renewed one-year contract, forcing Curve DAO to solicit proposals from alternative teams capable of managing complex decentralized lending risk dynamics.
Risk providers within decentralized finance (DeFi) play a vital role in maintaining protocol health. Their responsibilities typically involve:
- Evaluating borrowing capacity and liquidation thresholds for collateral types.
- Monitoring liquidity depth across decentralized and centralized exchanges.
- Recommending real-time parameter changes to defend against oracle manipulation and economic exploits.
- Publishing transparent risk assessment reports for community review.
Given the scale of crvUSD—which relies on an innovative Soft Liquidation mechanism (LLAMMA) to prevent abrupt collateral sell-offs—continuous oversight from experienced risk analysts is considered essential to preventing systemic insolvency.
Omitted Past Exploits and Security Questions
As details of the new assignment emerged, governance researchers highlighted that yRisk’s two primary contributors also function as the lead developers behind Resupply, an external protocol. In June 2025, Resupply fell victim to a severe security exploit resulting in the loss of approximately $9.6 million.
What has raised eyebrows across the broader DeFi landscape is not solely the past incident, but the absence of any disclosure regarding the Resupply exploit within the yRisk proposal submitted to Curve DAO. Governance participants voting on the proposal were not explicitly informed of the team’s historical association with the compromised protocol during the voting window.
This disclosure gap has triggered conversations regarding the depth of due diligence conducted prior to submitting major governance proposals. While developers often contribute to multiple initiatives across Web3, historical security incidents are typically evaluated thoroughly by token holders before granting critical treasury funds and protocol permissions.
Broader Implications for Decentralized Governance
The yRisk approval underscores ongoing challenges within Decentralized Autonomous Organizations (DAOs) regarding voter awareness and proposal vetting. Because DAO voting processes rely on token-weighted participation, voters frequently depend on the transparency of proposal authors to provide full context regarding their track records.
In fast-moving environments, proposal summaries often focus on future deliverables rather than comprehensive team resumes. This dynamic can lead to information asymmetries where significant historical events—such as protocol exploits—remain unmentioned unless raised by independent community auditors prior to voting deadlines.
Industry analysts point out that while the developers’ technical capability is evidenced by their active building in the ecosystem, the incident highlights the need for standardized disclosure templates in DAO funding requests. Establishing formal disclosure requirements could help ensure that all historical context, potential conflicts of interest, and security records are made explicit to token holders before capital is deployed.
Conclusion
With funding distributed and the vote finalized, yRisk officially assumes its duties as the primary risk guardian for crvUSD and Llamalend. The coming months will test the team’s ability to maintain economic stability across Curve’s lending products while navigating heightened scrutiny from the community. As Curve Finance continues to scale its stablecoin infrastructure, the performance and transparency of its risk providers will remain central to maintaining user confidence and protocol integrity.
