Curve DAO has approved yRisk as its new risk-management provider for crvUSD and Llamalend, giving the team a 12-month mandate despite a review highlighting concerns about its capacity and the omission of a major incident involving one of its previous projects.
The decision was approved on 2 September after a binding on-chain vote in which about 621.2 million veCRV supported the proposal. Only 5.33 veCRV voted against it, and the proposal was executed approximately 87 minutes after voting closed.
Under the agreement, yRisk will receive 125,000 frxUSD and 568,181 CRV through two separate, revocable vesting streams lasting one year. The package matches the team’s requested annual budget of about $250,000.
What yRisk will oversee
yRisk will assess and monitor risk across crvUSD minting markets and Llamalend’s isolated lending markets.
Its work will cover collateral, liquidity, oracle design, market concentration and governance risks. The team will also make recommendations on debt ceilings, market parameters, PegKeeper limits and other controls intended to manage risk.
Curve governance and the emergency DAO will retain the final authority over decisions and their implementation.
In its original proposal, yRisk said it planned to build publicly available monitoring systems, dashboards, alerts and automated code-analysis tools. Work funded through the mandate is generally expected to be released under an open-source licence.
The team is made up of contributors known as Wavey and Dudesahn. Curve’s proposal identifies both as core developers at Yearn and Resupply, and describes them as Resupply’s primary developers.
However, neither yRisk’s proposal nor Curve’s comparative assessment explicitly referred to the approximately $9.6m exploit suffered by Resupply in June 2025.
The incident was described in a QuillAudits analysis as a donation attack involving exchange-rate manipulation in a lending market. The attacker donated assets to an almost empty vault, causing an exchange-rate calculation to round towards zero and allowing borrowing against collateral whose value had been artificially inflated.
The omission does not, by itself, show that yRisk breached any disclosure requirement. Curve’s request for proposals asked applicants to provide relevant experience, methodology, capacity and pricing, but did not expressly require them to list every incident connected to a contributor’s previous projects.
Capacity concerns were raised
Swiss Stake reviewed nine applications before Curve held its preference votes. Its assessment credited yRisk with practical knowledge of Curve, Llamalend, Yearn and Resupply.
The main concern identified by the review was capacity. Swiss Stake questioned whether two contributors with other responsibilities would be able to monitor an expanding number of markets while also providing sufficient support during incidents.
The assessment expressed uncertainty rather than concluding that yRisk lacked the resources required for the role. Swiss Stake recommended that the selected provider begin with a limited mandate and be subject to a public review checkpoint.
During a non-binding preference vote, yRisk received about 536.97 million veCRV votes in favour and none against from 47 voters. That was equivalent to approximately 68.78% of the voting supply at the relevant snapshot block.
yRisk replaces LlamaRisk
Curve began looking for a new provider after LlamaRisk ended its engagement ahead of schedule. LlamaRisk had renewed its mandate in April 2026 and had been expected to continue until April 2027.
The provider announced its departure on 29 May and ended active work on 30 June. It returned about 270,247 crvUSD in unvested funding to Curve’s treasury.
LlamaRisk said the decision was structural and related to the way it allocated resources, rather than being criticism of Curve. Curve started the replacement process on 7 July.
The appointment comes as Curve expands Llamalend. Crypto.news previously reported that Llamalend v2 introduced isolated lending markets on Optimism ahead of a planned deployment on Ethereum.
Risk management has remained a significant issue for the ecosystem. In March, an incorrectly configured oracle allowed an attacker to extract about $240,000 from a Llamalend market in the exploit involving the sDOLA-crvUSD pool.
Public reporting will be scrutinised
As part of the transition, yRisk must review LlamaRisk’s existing reports, models, dashboards and repositories. It will decide which resources should be retained, rebuilt or withdrawn.
The proposal commits the team to monthly progress reports, continuous monitoring and incident support. Because the funding is revocable, Curve DAO can stop the remaining vesting streams before the 12-month mandate expires.
A future public review would give governance participants an opportunity to judge whether yRisk has delivered on its monitoring, reporting and incident-response commitments. Curve has not yet announced a date for that assessment.
