Deprecated contract paused but pause reversible by live admin

Curve Finance's assessment for RD-F-167 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Legacy Curve pools compiled with vulnerable Vyper 0.2.15/0.2.16/0.3.0 remain live (as of July 2023 exploit; some may have been killed/emptied post-exploit but others remain). Emergency DAO retains kill-switch (pause state) over these pools, and the pause state is reversible by 5-of-9 eDAO action. Deprecated surface with live admin scope.

Sources #

URL
Curve Pool Reentrancy Exploit Postmortem July 2023hackmd.io/@LlamaRisk/BJzSKHNjn — 2023 exploit affected legacy Vyper pools; eDAO killed gaugesretrieved 2026-04-28
Docs
Curve DAO: Protocol Ownershipcurve.readthedocs.io/dao-ownership.html — eDAO can kill/unkill poolsretrieved 2026-04-28

Methodology #

Determine whether a deprecated-and-paused contract's pause state is revertible by a currently-live admin role.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol curve-v2 factor RD-F-167 score yellow collected_at 2026-04-28 19:48:40