Divide-before-multiply pattern

Curve Finance's assessment for RD-F-016 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Slither divide-before-multiply detector does not run on Vyper. No published Vyper-native equivalent analysis found for Curve contracts. Manual audit reviews (ChainSecurity, MixBytes) found no arithmetic ordering issues of severity >= medium in NG contracts. Cannot be programmatically assessed.

Sources #

Curator note
Curve stableswap-ng repository — Vyper codebaseSlither Vyper incompatibility — process-learnings.md universal sectionretrieved 2026-04-28

Methodology #

Determine whether Slither's `divide-before-multiply` detector fires on the deployed verified source.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol curve-v2 factor RD-F-016 score gray collected_at 2026-04-28 19:48:40