Skip to content
PROTOCOL RESEARCH

Curvance risk

Genuinely strong audit coverage and non-upgradeable core contracts, undercut by three verified problems: an Emergency Council that can skip the 5-day timelock and can replace the timelock outright, a dual-feed oracle circuit breaker that is switched off across roughly $93M of the $97M book, and a record that is not clean, because about $868k of real WBTC was already borrowed out of Curvance against fraudulently minted collateral in May 2026.
CautionResearched Aug 5, 2026

Scorecard

strong: Audits & contractsSix audit PDFs from four firms (Trail of Bits x2, Cantina, Sherlock, TrustSec x2) verified present in Curvance's own repo via the GitHub API; no proxy, initializer or delegatecall pattern in CentralRegistry, OracleManager, MarketManagerIsolated, LiquidityManagerIsolated, BaseCToken or ProtocolManager.
weak: Admin controlEmergency Council resolved on-chain to a 4-of-5 Safe that holds elevated permissions on the live registry, bypassing the verified 5-day timelock on 39 setters including setOracleManager; it alone can replace the timelock and itself, and market listing plus collateral factors carry no delay at all.
weak: OracleVerified by live eth_call: all six largest collateral assets, about $93M of the book, return exactly one pricing adaptor, the same shared Chainlink adaptor, so the dual-feed divergence circuit breaker the design is credited for is inert across nearly the whole protocol.
watch: Liquidity & exitDeFiLlama reports $97.21M TVL against $52.64M borrowed, the yields feed independently shows $93.72M supplied against $51.85M borrowed, and about 86% of deposits sit in three young Monad-native collateral types.
watch: Yield (real vs emission)Borrow-side base rates of 1.63% to 7.24% are real borrower-paid interest, but the three largest collateral pools, roughly 86% of the pools feed, pay zero or near-zero base and only reward APY.
watch: Holder concentrationCVE does not trade: CoinGecko returns zero tickers, no price and zero circulating supply, so there is no float to measure and no live token governance checking the admin powers above.
weak: Track recordNot clean. On 2026-05-18 an attacker deposited fraudulently minted eBTC into Curvance and borrowed roughly 11.3 WBTC, about $868k of real assets, which was never recovered; isolated markets contained it and Curvance paused the market.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$99.4M
30d↑5%
Audits2
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

Curvance is a lending market that lives on Monad and nowhere else. Audit coverage is better than most protocols this size: six reports from Trail of Bits, Cantina, Sherlock and TrustSec sit in the team's own repository, dated between March 2024 and November 2025. The core market, oracle and registry contracts carry no proxy or initializer pattern, so there is no in-place upgrade hatch on the code itself.

Three things pull against that, and all three were verified against the live chain rather than inferred from documentation.

The permission model has a bypass. A CentralRegistry holds it, and its own comments describe a 5-day delay on the sensitive setters. That delay is real and running: the deployed timelock returns exactly 432,000 seconds. It is also optional. An Emergency Council holds elevated permissions directly on the live registry, so it can call all 39 of those setters immediately, including the one that swaps the oracle manager. The council is a 4-of-5 Safe, which is a real bar, but it can also replace the timelock contract outright and replace itself, and neither of those actions is available to anyone else.

The oracle safety mechanism is off. Curvance built a dual-adaptor design where two price feeds are compared and a circuit breaker fires when they diverge. Every one of the six largest collateral assets, about $93M of the $97M book, is configured with exactly one adaptor, and it is the same adaptor for all six. With one feed there is nothing to compare against, and the contract skips the divergence logic entirely.

And the record is not clean. In May 2026 an attacker minted unbacked eBTC on Echo Protocol, deposited it into Curvance, and walked out with roughly 11.3 WBTC of real assets.

Checklist

Audits and contracts. Four independent firms, six reports, verified by listing the audit directory through the GitHub API rather than taking a marketing page at its word: Trail of Bits Invariant Development (2024-03-13), Cantina (2025-04-16), Trail of Bits (2025-05-23), Sherlock (2025-09-29), TrustSec (2025-10-17 and 2025-11-22). The repository was created 2022-01-07 and was last pushed 2026-07-28, so this is not a protocol that shipped in a weekend. I confirmed the reports exist and who wrote them. I did not read their findings or check remediation status, because docs.curvance.com returns 403 to every fetcher I have, as does app.curvance.com. On upgradeability I checked CentralRegistry, OracleManager, MarketManagerIsolated, LiquidityManagerIsolated, BaseCToken, BaseCTokenWithYield, ProtocolManager and ProtocolManagerMassPause for UUPSUpgradeable, Initializable, ERC1967, proxy patterns, delegatecall and selfdestruct. None of them appear anywhere. The functional upgrade path is registry repointing, not proxy replacement, which is why the next section matters as much as it does.

Admin control. This sets the verdict, and unlike the rest of this report it is fully resolved rather than flagged. Reading source and then querying the live contracts on Monad:

The registry at 0x1310f352f1389969Ece6741671c4B919523912fF exposes three roles. The DAO is a 3-of-4 Safe at 0x0acb7ef4d8733c719d60e0992b489b629bc55c02. The timelock is at 0x2677738657f27e1a3591e00ad7e5a78807688c08 and its getMinDelay returns 432,000 seconds, exactly five days, matching the hard-coded MINIMUM_DELAY constant. The Emergency Council is a Safe v1.4.1 4-of-5 multisig at 0x379d4a8fbc23a8fd8c2b3738dbf1febe9a64399c with a nonce of 49, so it is actively used.

Querying hasElevatedPermissions on the live registry: the timelock returns true, the council returns true, and the DAO returns false. That is the whole finding in one line. The DAO cannot touch the sensitive setters except through the five day queue. The council can touch them now. There are 39 such functions, and they include setOracleManager, addMarketManager, setCVE, setVeCVE, setFeeManager, setRewardManager and the four protocol fee setters. Each carries the docstring "Only callable on a 5-day delay or by the Emergency Council," and the guard behind it is a single mapping lookup.

Two functions are worse, because they are council-only and the timelock cannot reach them at all. transferTimelockPermissions lets the council swap the timelock for any contract that answers the ITimelock interface, and the check is interface support, not delay length. transferEmergencyCouncil lets the council hand itself to a new address. So the five day delay is not a floor the council has to work around; it is a component the council can remove.

The multisig is a genuine mitigation and I want to give it its weight. Four signatures out of five is not one hot key. But three of the four DAO signers also sit on the five member council, so the two bodies are not independent. And the signer addresses are just addresses. No published policy, no named signers, no disclosed key custody.

Separately, and answering the question of who lists a market: listTokens and updateTokenConfig on MarketManagerIsolated are guarded by market permissions, a lower tier than elevated, which means no timelock whatsoever. updateTokenConfig is where the collateral ratio, close factors, collateral caps, debt caps and liquidation incentives are set. The council holds market permissions from the constructor. Hard-coded ceilings in the contract cap the collateral requirement and liquidation incentive, so the parameter space is bounded, but the listing and re-parameterisation of a live market is a same-block action for whoever holds that role.

Oracle. The design deserves the credit it usually gets, and then the deployment takes it back. OracleManager supports up to two adaptors per asset, takes the lower of two prices for user collateral and the higher for user debt, and runs circuit breakers that emit CAUTION or BAD_SOURCE codes when the feeds diverge past configured bounds, with a hard MAX_DEVIATION_BOUND of 350 basis points. A CAUTION blocks new borrowing, repayment and redemption; a BAD_SOURCE also blocks liquidation. Adaptors are implemented for Chainlink, RedStone, Pyth, API3, DIA, Chainsight, Pendle, Uniswap V3 and Velodrome, and I confirmed each of those files exists.

Then I called getPricingAdaptors on the live OracleManager at 0x65adf8ae8420a58278de066593e6ff1713a137c5 for the six largest collateral assets: VUSD, PT-AUSD-8OCT2026, savUSD, earnAUSD, AUSD and aguaUSDCgc. Every one returned a single adaptor, and every one returned the same adaptor, 0x42b318abfde82a43b3685eb65a5863b9367b22e1, which answers DEFAULT_HEARTBEAT with 86,520 seconds and is therefore the Chainlink adaptor. Those six assets are about $93M of the roughly $99M in the pools feed.

The relevant line of OracleManager is the guard that reads, in effect, if there are not two adaptor dependencies we can skip this logic. With one feed there is no divergence to detect, so CAUTION and BAD_SOURCE cannot fire on price disagreement for any of the large markets. The protection exists in the codebase and is not switched on in production.

In fairness, single-feed pricing is what Aave, Compound and Morpho do too, so this is ordinary rather than substandard. What makes it a red here is the combination: the safety feature is widely credited to this protocol and is not actually running, the function that replaces the entire oracle manager is callable by the council with no delay, and the one incident this protocol has actually suffered was an oracle pricing bad collateral at face value.

Liquidity and exit. DeFiLlama reports $97.21M TVL with $52.64M borrowed, an all-time high reached on the pull date, up from $69.41M thirty days earlier and $56.81M ninety days earlier, from a first datapoint of $8.04M on 2025-11-28. Be careful with the ratio. DeFiLlama's Curvance adapter computes TVL as the assets remaining inside the market contracts and reports borrowings separately from marketOutstandingDebt, while the yields feed independently reports $93.72M supplied against $51.85M borrowed across the markets it indexes. Those two do not reconcile exactly, so I will give the ratio a range rather than a false decimal: borrowings run somewhere between a third and a half of deposits depending on which feed you believe, and free liquidity is somewhere between $42M and $97M.

Concentration is the clearer signal. VUSD holds $36.13M, a Pendle PT maturing 8 October 2026 holds $22.47M, and two savUSD pools hold $26.48M between them. That is $85.09M, about 86% of the pools feed, in three collateral types, all young Monad-native or wrapped instruments whose own exit depth I have not measured. Max LTVs across the markets run from 0.84 to 0.95, with the highest, 0.95, on the Pendle PT market that also carries the largest borrow balance. Withdrawal of unborrowed liquidity should work normally. Withdrawal during a stampede depends on borrowers repaying and on Monad DEX depth holding up, neither of which has been tested at this size.

Yield: real versus emission. Mixed, and the split matters. Borrow-side pools pay real money out of borrower interest: AUSD at 5.47%, 6.62% and 7.24% base, USDC at 6.70% and 4.54%, WMON at 1.63%, with a further 1.35 to 3.43 percentage points of rewards layered on. The large collateral pools are the opposite. VUSD shows 0.77% and it is entirely reward, the Pendle PT shows 0.20% and it is entirely reward, and both savUSD pools show zero. Protocol fees run $9,600 over 24 hours, $72,449 over 7 days, $241,588 over 30 days and $1.62M all time. The revenue split fields return null. Against $97M of deposits that is thin. The honest reading is that a large share of this TVL is parked for a CVE distribution that has not happened yet, and it can leave when it does.

Holder concentration. CVE does not trade. CoinGecko carries a Curvance page with zero tickers, no price, no market cap and a circulating supply of zero. So there is no float to concentrate. Two consequences. Token-holder governance is not a live check on the admin powers above, which makes the Emergency Council finding heavier rather than lighter. And InitialDistribution.sol and LBP.sol sit in the repo, so a launch and its unlock schedule are ahead, not behind. Per-wallet deposit concentration is a separate question I could not answer without Monad indexing.

Track record. The draft of this report called the record clean. It is not, and this is the correction that matters most.

On 2026-05-18 an attacker compromised an administrative key at Echo Protocol and minted 1,000 unbacked eBTC on Monad, a notional $76.7M. The attacker then deposited 45 of those eBTC into Curvance, where the oracle priced them at roughly $3.45M of perfectly valid collateral, and borrowed against them. Roughly 11.3 WBTC left Curvance, worth about $868k at the time. It was bridged to Ethereum, swapped to about 384 ETH, and passed through Tornado Cash. It has not been recovered.

Curvance did not have a smart contract bug and I am not claiming one. The root cause was Echo's key management. Three things are still Curvance's to own. Curvance listed eBTC as collateral, an asset whose entire supply integrity depended on a single unprotected admin key at a third party, and market listing on Curvance carries no timelock. Echo is an investor in Curvance's November 2025 strategic round, which is a conflict worth naming out loud when the listing decision goes this way. And per Curvance's own documentation, when liquidation realises bad debt the debt cToken reduces total assets and the loss passes to lenders through the exchange rate, so the loss landed on suppliers in that market.

What worked, and worked well: the isolated market architecture confined the damage to one market instead of letting it reach the other twenty-something, and Curvance paused the affected market the same evening. That containment is the single best piece of evidence in this report that the engineering is sound. It is also the reason this is a red on track record and not an avoid overall.

DeFiLlama does not attribute this to Curvance. Its hacks list holds 612 entries, Curvance appears in none of them, and the one Monad-chain entry is filed as Echo Bridge, $821k, infrastructure. Reading that absence as a clean record is exactly the mistake to avoid. The protocol's own hacks field is empty because the root cause was somebody else's; the money still came out of Curvance.

Eight months live. Monad mainnet launched 2025-11-24 and Curvance's first datapoint is four days later, so the two records are effectively the same length. Monad now carries about $863M TVL and ranks tenth of 461 chains, which is real adoption. It introduced a new consensus protocol, Cadence, in July 2026, roughly seven months after mainnet, and exchanges suspended deposits around the upgrade. I found no evidence of a mainnet halt or reorg, and I want to be plain that I found no evidence rather than that I confirmed none happened.

Worst case

The Emergency Council turns hostile or four of its five keys are compromised together. It calls setOracleManager in one transaction with no delay and points pricing at a contract it controls. There is no second feed on any large market to contradict the new prices, because none is configured, so nothing in the system objects. Collateral is marked at whatever the attacker wants and borrowing against it drains the borrowable assets. The five day timelock is not in the path, and if anyone tried to route around the council the council can call transferTimelockPermissions and remove the timelock as well. There is no window in which depositors see a proposal and leave. I found no documented insurance fund or backstop, so position sizing is the mitigation.

The cheaper and far more likely bad day is the one that already happened, repeated. Curvance lists a young wrapped or synthetic asset as collateral, with no timelock on that decision, and the issuer of that asset gets compromised or depegs. The oracle prices the asset exactly as instructed, because that is what oracles do, and someone borrows real assets against paper. Last time that cost about $868k and stayed inside one market. The isolated design means the blast radius scales with the market, not the protocol, which is genuinely reassuring. It also means suppliers to any single market are the ones who eat it.

The third case involves no malice at all. Monad degrades during a volatile hour on an eight month old chain, liquidations do not clear, and markets carrying max LTVs up to 0.95 take bad debt that lenders absorb through the exchange rate. The liquidation design is thoughtful, with soft and hard tiers, an incentive curve between configurable minimum and maximum, a close factor curve and an auction. Whether liquidators actually show up on Monad at 3am is a thing I could not verify.

Bottom line

Caution, and a harder caution than the audit list alone would suggest.

The engineering is better than the size implies. Six audits from four firms, two of them Trail of Bits. No proxy upgradeability anywhere in the core. A real 5-day timelock that is genuinely deployed and genuinely returning five days. Isolated markets that did their job the one time they were tested. Real borrower-paid revenue on the borrow side.

Against that: the timelock is bypassable and removable by a five-member council whose signers are unnamed, the oracle cross-check that this protocol gets credit for is not switched on across 95% of its book, market listing has no delay at all, and roughly $868k has already left this protocol through a collateral asset it chose to list. Three reds, and none of them are red because I could not see something. They are red because I could see them.

That is a sized bet with active monitoring, not a parking spot, and not a position to hold through a Monad incident or an unexplained governance transaction. Two things would move this report materially: second oracle adaptors actually configured on the large markets, which would switch on a circuit breaker that currently does nothing, and a published council signer set with a policy on when the bypass is used. Removing the council's ability to replace the timelock would move it further. If instead the council is observed using its no-delay powers for routine parameter changes rather than emergencies, this becomes an avoid.

Data appendix

  • TVL: $97,210,771, all on Monad, with $52,637,637 borrowed (DeFiLlama /protocol/curvance). All-time high is the pull-date figure. 30d prior $69.41M, 90d prior $56.81M, first datapoint 2025-11-28 at $8.04M. No parent protocol.
  • Market counts: the live registry returns 25 market managers from marketManagers(). DeFiLlama's lendBorrow feed indexed 20 markets at the orchestrator's pull and 21 at re-check hours later, against 35 rows in the pools feed. The counts differ because DeFiLlama blacklists at least one market in its adapter and only surfaces markets it can price.
  • TVL semantics caveat: DeFiLlama's Curvance adapter computes TVL as sumTokens2 over assets held by the market contracts and computes borrowings separately from marketOutstandingDebt. The yields feed reports $93,717,474 supplied against $51,849,666 borrowed over 21 markets, and 35 pool rows summing $99,337,715. These do not reconcile exactly; no single utilisation figure is asserted here.
  • Fees: $9,600 (24h), $72,449 (7d), $241,588 (30d), $1,617,138 all time (DeFiLlama /summary/fees/curvance). Revenue split fields returned null.
  • Audits: six PDFs in curvance/curvance-contracts under contracts/audits on the develop branch, confirmed via the GitHub API: Trail of Bits Invariant Development 1 (2024.3.13), Cantina 1 (2025.4.16), Trail of Bits 1 (2025.5.23), Sherlock (2025.9.29), TrustSec 1 (2025.10.17), TrustSec 2 (2025.11.22). Existence and authorship verified; contents not read. Repo created 2022-01-07, last push 2026-07-28. Bug bounty program details: refresh.
  • Admin, verified on-chain: CentralRegistry 0x1310f352f1389969Ece6741671c4B919523912fF. emergencyCouncil() returns 0x379d4a8fbc23a8fd8c2b3738dbf1febe9a64399c, a Safe v1.4.1 with getThreshold() 4 and 5 owners, nonce 49. daoAddress() returns 0x0acb7ef4d8733c719d60e0992b489b629bc55c02, a Safe v1.4.1 with getThreshold() 3 and 4 owners, nonce 3; three of those four owners also sit on the council. timelock() returns 0x2677738657f27e1a3591e00ad7e5a78807688c08, whose getMinDelay() and MINIMUM_DELAY() both return 432,000 seconds (5.0 days). hasElevatedPermissions returns true for the council, true for the timelock, false for the DAO.
  • Admin, from source: 39 functions in CentralRegistry.sol call _checkElevatedPermissions(), which is a single mapping lookup at line 1389; the constructor grants the council market and elevated permissions at lines 336 to 338. transferTimelockPermissions (line 801) and transferEmergencyCouncil (line 855) are guarded by _checkEmergencyCouncilPermissions() and are therefore council-only. listTokens and updateTokenConfig in MarketManagerIsolated.sol are guarded by market permissions, with no timelock; updateTokenConfig sets collateral ratio, close factors, collateral caps, debt caps and liquidation incentives, bounded by hard-coded ceilings including MAX_COLLATERAL_REQUIREMENT 23400 and MAX_LIQUIDATION_INCENTIVE 3000.
  • Upgradeability: no UUPSUpgradeable, Initializable, ERC1967, proxy, delegatecall or selfdestruct found in CentralRegistry.sol, OracleManager.sol, MarketManagerIsolated.sol, LiquidityManagerIsolated.sol, contracts/market/token/BaseCToken.sol, BaseCTokenWithYield.sol, ProtocolManager.sol or ProtocolManagerMassPause.sol. Note that contracts/market/isolated/BaseCToken.sol does not exist; the file is at contracts/market/token/BaseCToken.sol.
  • Oracle, verified on-chain: OracleManager 0x65adf8ae8420a58278de066593e6ff1713a137c5. getPricingAdaptors() returns exactly one adaptor for each of VUSD, PT-AUSD-8OCT2026, savUSD, earnAUSD, AUSD and aguaUSDCgc, and the same adaptor for all six: 0x42b318abfde82a43b3685eb65a5863b9367b22e1, which returns DEFAULT_HEARTBEAT of 86,520 seconds, identifying it as the Chainlink adaptor. Those six assets total about $93.9M of the $99.3M pools feed. OracleManager skips divergence logic when config.adaptors.length < 2, so the circuit breaker cannot fire on price disagreement for any of them.
  • Oracle, from source: max two adaptors per asset; lower price used for collateral, higher for debt; CAUTION blocks borrow, repay and redeem, BAD_SOURCE also blocks liquidation; MAX_DEVIATION_BOUND 350 bps. Adaptor implementations present for Chainlink, RedStone (Classic and Core), Pyth, API3, DIA, Chainsight, Pendle (LP and PT), Uniswap V3 and Velodrome. DeFiLlama's oraclesBreakdown records RedStone as primary to 2026-06-30 and Chainlink as primary from 2026-06-30, consistent with what is deployed. Per-asset heartbeat and deviation overrides: refresh.
  • Deposit mix: VUSD $36.13M, PT-AUSD-8OCT2026 $22.47M, savUSD $18.28M + $8.20M, earnAUSD $2.86M, aguaUSDCgc $1.55M, syzUSD $1.09M. Top three collateral types $85.09M, about 86% of the pools feed. Max LTVs 0.84 to 0.95, highest on the Pendle PT market.
  • Yields: borrow-side base APY includes AUSD 5.47%, 6.62%, 7.24%; USDC 6.70%, 4.54%; WMON 1.63%; with reward APY of 1.35 to 3.43 points. Collateral-side: VUSD 0.77% all reward, PT-AUSD 0.20% all reward, both savUSD pools 0.00%.
  • Liquidations: soft and hard tiers with a liquidation incentive curve (liqIncMin to liqIncMax), close factor curve and auction, per LiquidityManagerIsolated.sol and MarketManagerIsolated.sol. Live liquidator activity and current bad-debt balance: refresh.
  • Incident, 2026-05-18: attacker compromised an Echo Protocol admin key and minted 1,000 unbacked eBTC (notional $76.7M) on Monad, deposited 45 eBTC into Curvance which priced them at about $3.45M of collateral, and borrowed roughly 11.3 WBTC worth about $868k. Funds were bridged to Ethereum, swapped to about 384 ETH and moved through Tornado Cash; about $821k to $822k is the figure most sources cite for what reached Tornado. Not recovered. Echo burned the remaining 955 eBTC after regaining key control. Curvance paused the affected market the same evening and reported no compromise of its own contracts; other markets stayed open because they are isolated. Per Curvance documentation, realised bad debt reduces the debt cToken's total assets and passes to lenders via the exchange rate. No eBTC market appears among the markets live today. DeFiLlama files this under Echo Bridge, $821k, infrastructure, and Curvance's own hacks field is empty.
  • Holder concentration: CVE not trading. CoinGecko /coins/curvance returns 0 tickers, null price, null market cap and circulating supply 0. TGE date, supply and unlock schedule: refresh.
  • Funding: seed $3.6M (2023-12-05; Offchain Labs, Wormhole, Frax DAO, Sandeep Nailwal and 20+ others); strategic $4M (2025-11-11, led by F Prime and Primal Capital, with Auros Global, GSR, Flowdesk, Echo, V3V Ventures, Q42). Source: DeFiLlama raises. Echo, whose eBTC caused the May 2026 loss, is an investor.
  • Team: The Block names two co-founders, Chris Carapola and Michael Butcher. 0xMai is an active pseudonymous team member but is not confirmed as a founder. Legal entity and jurisdiction: refresh.
  • Chain: Monad mainnet launched 2025-11-24. Chain TVL $863.1M, rank 10 of 461 (DeFiLlama /v2/chains). Cadence consensus upgrade shipped July 2026. Mainnet halt and reorg record: no incident found, not positively confirmed, refresh.

Data as of 2026-08-05. Methodology: DeFi Research Instruction v2.

← all protocols