A 2021 ChainSecurity report found and marked fixed a medium-severity reentrancy issue in a specific Curve ETH/sETH pool contract. The reported paths involved administrator privileges, not an ordinary public caller. The review covered identified source versions; it does not establish the security status of Curve DEX as a whole or verify that the assessed fixes are present in any current deployment.
What did the Curve ETH/sETH audit cover?
ChainSecurity’s Code Assessment of the Curve ETH/sETH Smart Contracts is dated September 27, 2021. Its overview identifies the reviewed system as a StableSwapETH.vy contract in the Curve ETH/sETH repository and lists two assessed source versions:
As an Amazon Associate I earn from qualifying purchases.
- Initial version dated November 2, 2020, commit
8ad854eb6c1e95ffb4fc375d4359d4e140569d5a. - Updated version dated December 15, 2020, commit
2428dd6c809a3e5bcf31285e3deb5c68eda4e55e.
Those source-version dates are not the report date. The finding and its status should be read as conclusions about the assessed code, not as a current protocol-wide audit result. Curve’s Knowledge Hub describes the broader protocol as supporting swaps and liquidity provision, but that general description does not identify which contracts or deployments a present-day security review should include.
What reentrancy issue did ChainSecurity report?
The report’s medium finding, titled “Reentrancies,” described two administrator-privilege paths involving ETH transfers and calls to donate_admin_fees. The report said both cases required owner privileges.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Liquidity removal and fee donation
In one path, a callback during liquidity removal could reach the admin-fee donation function. The report explains that internal ERC-20 balances could then be updated while the tokens being removed were still held by the contract. That ordering could leave the contract’s accounting invariant broken after the transaction.
Admin-fee withdrawal
In the other path, reentry during an admin-fee withdrawal could result in fees for some coins being donated while fees for other coins were withdrawn. ChainSecurity also noted that certain admin functions lacked reentrancy protection and that callbacks could produce incorrectly ordered events.
The report records additional reentrancy guards as the correction, including coverage for donate_admin_fees and apply_new_fee. That is the report’s disposition for its assessed code; it does not prove that every pool or later code version has the same guards.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
What did the report say about access control?
For the assessed contract, ChainSecurity calls the owner the administrator. The report lists these exclusive administrator actions:
- Start or stop amplification-parameter changes.
- Commit, apply, or revert fee changes.
- Transfer ownership through a commit-and-apply process.
- Withdraw or donate admin fees.
- Freeze or unfreeze the contract.
This authority list describes the reviewed pool contract’s model. It does not establish who controls current Curve deployments or how DAO-level authority is secured.
What were the finding counts and dispositions?
ChainSecurity’s severity overview reports zero critical, zero high, one medium, and five low findings for its assessment. Its summary says the medium issue and three low findings were corrected, while two low findings were risk accepted. The two open low findings named in the report are unchecked constructor inputs and a design concern that ramping down might incentivize delayed liquidity.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
These figures are counts for that assessment and its reported version history, not a rate or score for Curve DEX overall. A different Curve DAO assessment by Trail of Bits reported 21 findings ranging from high to informational; that count belongs to the separate DAO review, not the ETH/sETH pool review.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do the other Curve audit reports differ?
| Report | Subsystem and identified source | What the available report summary establishes |
|---|---|---|
| ChainSecurity, dated September 27, 2021 | Curve ETH/sETH StableSwapETH.vy; source versions and commits listed above |
One medium reentrancy finding tied to owner privileges, reported corrected; severity totals and two risk-accepted low findings as described above. |
| Trail of Bits, engagement June 22–July 10, 2020 | Curve DAO contracts; a specified curve-dao-contracts repository commit |
The Curve-hosted search-result summary reports 21 findings from high to informational. It highlights incorrect LiquidityGauge bonus updating that could allow unfair interest, documentation and readability concerns, possible out-of-gas risks, external risk from Aragon contracts, and recommendations related to deployment, early-user interactions, alternative voting contracts, and economic incentives. |
| Curve DAO Voting security audit | Voting.sol, audited commit a988e7c9a0543b58f0f0adb93a7b06acd5b36c0c |
The report excerpt lists no critical, major, or warning findings under its classification, while including comments and recommendations and noting fixes at identified commits. |
| Curve DAO Voting Forwarder security audit | BalanceTimeForwarder.sol, audited commit db6a2694bdc34d68bf39435ae956dea0791291d6 |
It identifies a possible reentrant call because lastVoteTimes was updated after runScript, recommends moving the state update before the call, and records that change as fixed at commit 031d29f. It also notes an input-validation concern in initialize. |
The DAO and voting-forwarder findings concern different contracts and trust boundaries from the ETH/sETH pool. In particular, the Voting Forwarder issue concerns external-call ordering around a state update; it should not be merged with the pool’s admin-fee findings into one protocol-wide vulnerability.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What did the ETH/sETH review leave out?
ChainSecurity treated sETH and the LP token as regular ERC-20 tokens, assumed proper access control for the LP token, and excluded the security of the DAO that can perform pool admin operations. It also says the underlying mathematical formulas had been checked separately. These boundaries matter: the report’s pool-level analysis does not independently establish DAO security, LP-token controls, or the security of every dependency.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
ChainSecurity cautions that an assessment cannot uncover every existing vulnerability and that even an assessment with no findings is not a guarantee of security. Its report also notes that code or environmental changes over time can alter behavior.
How should a reader interpret the findings today?
To assess a current deployment, first identify the exact pool or governance contract and deployed address in scope. Then map that address to verified source code and its commit, inspect the current administrator and DAO roles, and check whether the relevant historical changes appear in that version. The reports summarized here do not establish that deployment mapping, so they cannot confirm whether a particular live contract contains the reported corrections.
The practical takeaway is narrow but useful: the ETH/sETH report documented a privileged reentrancy risk arising from callback-capable operations and recorded guards as the fix. Its findings are evidence about particular historical code, not a guarantee of safety or a current security verdict for Curve as a whole.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
