Curve DAO taps yRisk for oversight despite developer's past exploit

The governance proposal, which secured 621.2 million veCRV in support, tasks yRisk with monitoring collateral, liquidity, and oracle design. Contributors Wavey and Dudesahn—who serve as core developers for both Yearn and Resupply—will lead the effort. While the team disclosed their history with Resupply, neither the proposal nor the comparative assessment conducted by Swiss Stake explicitly referenced the 2025 donation attack that drained $9.6 million from the Resupply protocol.

Swiss Stake, which reviewed nine competing applications, ultimately raised concerns regarding the team's bandwidth. With only two primary contributors managing multiple protocols, observers questioned whether yRisk could provide sufficient incident coverage as the number of isolated lending markets continues to grow. To mitigate this risk, the DAO implemented a revocable funding structure, providing the team with 125,000 frxUSD and 568,181 CRV over one year, with the ability to halt payments if performance falters.

yRisk replaces LlamaRisk, the previous provider that departed the ecosystem early this year. The transition arrives as Curve pushes forward with the expansion of Llamalend v2. Moving forward, the team is expected to build public dashboards and automated code-analysis tools, with their output subject to a future governance review to determine if the current staffing levels are sufficient to maintain the security of the DAO's expanding market footprint.