First-depositor / share-inflation guard
crvUSD (Curve Stablecoin)'s assessment for RD-F-075 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
crvUSD Controllers do not use share-token accounting. Per-user position tracking (each loan is an independent debt/collateral record indexed by user address) eliminates the first-depositor share inflation attack vector by construction. The LLAMMA AMM has internal band-based LP accounting (not an external LP token) and no first-depositor vulnerability. F075 (first-depositor guard) is N/A for this non-vault CDP architecture.
Sources #
- URLLiquidation and Bands — Curve ResourcesLLAMMA mechanism description — per-band AMM with no external LP token issued to borrowersretrieved 2026-05-16
- crvUSD Controller WETH — Etherscan Read ContractcrvUSD Controller WETH 0xa920de414ea4ab66b97da1bfe9e6eca7d4219635 — per-user position tracking confirmed (loan_exists, n_loans functions; no share token)retrieved 2026-05-16
Methodology #
Determine whether the vault has a first-depositor guard (seed deposit on deploy, virtual-share offset, or floor-check).
See the full factor methodology and distribution across all protocols →