★ Flash-loanable voting weight

crvUSD (Curve Stablecoin)'s assessment for RD-F-036 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Curve governance uses veCRV (vote-escrowed CRV). veCRV is non-transferable and requires CRV to be locked for 1 week to 4 years. Flash loans cannot acquire veCRV within a single transaction — the time-lock makes this attack vector structurally impossible. Green by construction for any vote-escrow governance system.

Sources #

URL
Curve DAO Aragon governance articleAragon article: veCRV non-transferrable, time-lock prevents flash loan governance attacksretrieved 2026-05-16
Docs
Curve DAO: Vote-Escrowed CRVveCRV is non-transferrable; requires locking CRV for 1 week to 4 years; 1 veCRV = 1 CRV locked 4 yearsretrieved 2026-05-16

Methodology #

Determine whether governance voting power is a function of current token balance of a transferable token with no lock or checkpoint, making it flash-loan susceptible.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol crvusd factor RD-F-036 score green collected_at 2026-05-16 19:09:40