Shared-library version with known-vuln status

Evidence summary #

Curve does not use OpenZeppelin, Solady, or Solidity shared libraries. Vyper 0.3.10 has no known CVE or security advisory as of 2026-04-28. The critical compiler bugs affecting Vyper were in 0.2.15/0.2.16/0.3.0 (July 2023 exploit); fix confirmed in 0.3.1; 0.3.10 post-dates the fix by multiple releases.

Sources #

Methodology #

Identify the version of key shared libraries (OZ, Solady, Solmate) used and check against CVE/GHSA databases for any active advisory.

See the full factor methodology and distribution across all protocols →