Curve DAO appoints yRisk for risk management despite its developers' involvement in Resupply, which suffered a $9.6M exploit in June 2025—potential conflict of interest undisclosed in governance proposal.
Regulation & Gov ·
Curve DAO voted to appoint yRisk as its new risk manager for crvUSD and Llamalend on September 2, according to reporting, replacing LlamaRisk following an early departure. The role comes with compensation structured as revocable one-year vesting: 125,000 frxUSD and 568,181 CRV. The governance vote passed with approximately 536.9 million veCRV in favor and no votes against.
A potential conflict of interest surfaced after the vote: both yRisk contributors are identified as primary developers of Resupply, a protocol that experienced a donation attack resulting in approximately $9.6 million in losses in June 2025. This connection was not mentioned in the governance proposal or in Curve's comparative review of candidates.
The disclosure gap leaves unanswered whether Curve's governance process included explicit evaluation of the developers' involvement with a recently-compromised project, or what risk-management safeguards may apply given the appointment's revocable terms.