Curve DAO appoints Resupply developers to risk role

Curve DAO approved yRisk as its new risk-management provider for crvUSD and Llamalend on Sept. 2, assigning the mandate to two contributors who are also primary developers of Resupply. Summary Curve DAO approved yRisk to monitor crvUSD and Llamalend through a twelve-month risk management mandate. yRisk will receive 125,000 frxUSD and 568,181 CRV through two revocable one-year vesting streams separately. Its two contributors disclosed being primary Resupply developers, whose protocol suffered a 2025 donation attack. The proposal and Curve comparison did not mention Resupply’s approximately $9.6 million exploit explicitly anywhere. yRisk’s binding funding vote passed with 621.2 million veCRV supporting and virtually none opposing it. The binding onchain vote closed with approximately 621.2 million veCRV supporting the proposal and 5.33 veCRV opposing it. The proposal was executed about 87 minutes after voting ended. yRisk will receive 125,000 frxUSD and 568,181 CRV through separate revocable vesting streams lasting one year. The package represents the team’s requested annual budget of approximately $250,000. You might also like: Can Curve DAO price erase August losses with its Robinhood listing? Curve DAO gives yRisk a twelve-month mandate yRisk will provide risk assessment and monitoring across crvUSD mint markets and Llamalend isolated lending markets. Its responsibilities include reviewing collateral, liquidity, oracle design, concentration and governance risks. Curve DAO appoints two Resupply developers as risk provider despite prior $9.6M exploit Curve DAO approved funding yRisk on September 2 to oversee risk management for crvUSD and Llamalend, replacing LlamaRisk, which ended its engagement early. yRisk will receive 125,000 frxUSD… pic.twitter.com/cA1hMxWFcH — Wu Blockchain (@WuBlockchain) September 4, 2026 The team will also recommend debt ceilings, market parameters, PegKeeper limits and other risk controls. Curve governance and its emergency DAO retain authority over final decisions and execution. According to its original proposal, yRisk plans to build public monitoring systems, dashboards, alerts and automated code-analysis tools. Work funded by the mandate will generally be released under an open-source license. The team consists of contributors known as Wavey and Dudesahn. The proposal identifies both as core developers at Yearn and Resupply and describes them as Resupply’s primary developers. Resupply exploit was absent from reviewed materials Resupply suffered a donation attack in June 2025 that caused approximately $9.6 million in losses. A QuillAudits analysis attributed the incident to exchange-rate manipulation affecting a lending market. The attacker donated assets to a nearly empty vault, causing an exchange-rate calculation to round toward zero. That manipulation allowed the attacker to borrow against artificially inflated collateral. yRisk’s Curve proposal disclosed its contributors’ Resupply roles but did not mention the exploit. Curve’s comparative assessment also discussed their Resupply experience without referring to the incident. The omission does not establish that yRisk violated a disclosure requirement.