Deprecated contracts still holding value
Curve Finance's assessment for RD-F-166 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Legacy Curve pools compiled with Vyper 0.2.15/0.2.16/0.3.0 (the exploited compiler versions) were never formally deprecated with a user-facing migration notice. The four exploited pools (alETH/ETH, pETH/ETH, msETH/ETH, CRV/ETH) were drained and are effectively defunct. Residual non-exploited legacy pools compiled with the same compiler versions may still hold TVL; no formal deprecation announcement was made. Curve's strategy is NG-series migration without formal legacy deprecation. Yellow: migration-without-announcement posture; no confirmed >$100K stuck in formally-announced-deprecated contracts, but legacy pool surface persists without official sunset.
Sources #
- URLState of Vyper Security — September 2024Vyper security blog Sept 2024 — confirmed NG migration strategyretrieved 2026-04-28
- Curve Vyper exploit — pool statushacksdatabase/hacks/curve-vyper.md — exploited pools drained; non-exploited legacy pools not formally deprecatedretrieved 2026-04-28
Methodology #
Determine whether contracts marked deprecated by a protocol announcement still hold >$100K in assets.
See the full factor methodology and distribution across all protocols →