★ Post-audit code changes without re-audit
crvUSD (Curve Stablecoin)'s assessment for RD-F-139 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Core contracts audited by MixBytes (June 2023) and ChainSecurity (Jan 2024). PegKeeperV2 received separate ChainSecurity audit (Dec 2023). scrvUSD/RewardsHandler audited by ChainSecurity (Dec 2024). However: new collateral market additions (sBTC2, USDM PegKeeper additions) via governance votes do not have per-market re-audit evidence. Yield Basis 1B credit line extension (2025) is a parameter change without re-audit. Incremental accumulation of unaudited market additions is the residual gap.
Sources #
- AuditMixBytes crvUSD Security Audit ReportMixBytes crvUSD audit June 2023; all critical/high fixed pre-deployretrieved 2026-05-16
- CrvUSD Adds USDM PegKeeperUSDM PegKeeper addition governance (Oct 2023) — no per-market audit evidence foundretrieved 2026-05-16
Methodology #
Count deployed changes to audited bytecode where no subsequent audit or spot-review covers the changed code.
See the full factor methodology and distribution across all protocols →