Curve DAO Names yRisk as New Risk Provider Despite Developers’ Link

Curve DAO has approved yRisk as a new risk-management provider for crvUSD and Llamalend, awarding the firm funding despite the involvement of two of its contributors in the development of Resupply, a protocol that suffered an approximately $9.6 million exploit in June 2025.

According to information published by @WuBlockchain, Curve governance approved the funding on September 2 after LlamaRisk ended its engagement early. The proposal selected yRisk to take over risk-management responsibilities for Curve’s lending and stablecoin-related products.

The governance vote passed with approximately 536.9 million veCRV votes in favor and none against.

Curve Governance Approves yRisk Funding

Under the approved arrangement, yRisk will receive 125,000 frxUSD and 568,181 CRV through revocable one-year vesting streams.

The appointment follows the conclusion of LlamaRisk’s engagement and places yRisk in a role responsible for monitoring and assessing risks associated with crvUSD and Llamalend. Such providers can play an important role in decentralized-finance governance, where protocol teams and token holders rely on external assessments when markets evaluating lending parameters and broader market risks.

However, the appointment has drawn scrutiny because both yRisk contributors are described as primary developers of Resupply.

Resupply suffered an approximately $9.6 million loss in a donation attack in June 2025. The connection was not disclosed in Curve’s proposal or in the comparative review used during the governance process, according to the information cited by @WuBlockchain.

Disclosure Becomes Central to Curve Risk Review

The issue raises questions financial about disclosure standards in decentralized governance, particularly when protocols appoint external parties to oversee financial risk.

The absence of the Resupply incident from the proposal and comparative review does not by itself establish that yRisk is unsuitable for the role. It does, however, leave governance participants without information about a material historical event involving developers associated with the selected provider.

For Curve, the decision now places greater emphasis on how yRisk performs its mandate and whether additional disclosures or governance procedures emerge following the appointment.

The immediate question is whether Curve governance will revisit markets the undisclosed Resupply connection or introduce additional disclosure requirements for future risk-provider selections.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.