GitHub malicious-dependency incident touching protocol deps
Curve Finance's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Curve contracts are written in Vyper (not npm/cargo/PyPI dependency chain subject to malicious supply-chain releases). Primary compiler dependency is Vyper 0.3.10 for NG contracts (confirmed in profile §1). No current GitHub security advisory against Vyper 0.3.10 identified. The Vyper 0.2.15/0.2.16/0.3.0 reentrancy bug that caused the July 2023 exploit is a documented historical vulnerability — NG contracts migrated to Vyper 0.3.10 which does not contain that bug. No GitHub advisory against any Curve dependency identified at assessment date.
Sources #
- InternalCurve Finance Protocol Profile §1 — Codebase Language00-profile.md §1 — Vyper codebase; NG contracts use Vyper 0.3.10; older pools used 0.2.15/0.2.16/0.3.0 (exploited 2023)retrieved 2026-04-28
- CurveTricryptoOptimizedWETH.vy — Vyper 0.3.10 pragmacurvefi/tricrypto-ng — Vyper 0.3.10 pragma confirmed; no current CVE on this versionretrieved 2026-04-28
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →