Audit log

Every state-changing event for Curve LlamaLend: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-29 02:41:16Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,849,416

   sig

   5tCTweaGLAyK…ht95RgX2copyexplorer ↗

   hash

   E7pSdf8VkxhL…HkRvh2w8copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (10135 B) ▸

   {"actor":"system:backfill","investigation_id":"b20a5ebe-152f-4198-9df6-0987e1950faf","kind":"publish","page_slug":"curve-llamalend","published_at":"2026-05-29T02:41:16.120Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Curve LlamaLend","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://resources.curve.finance/lending/overview/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/curve-llamalend","type":"other","url":""},{"credibility":3,"name":"https://docs.curve.finance/lending/overview/","type":"other","url":""},{"credibility":3,"name":"https://mixbytes.io/blog/modern-defi-lending-protocols-how-its-made-curve-llamalend","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2024/06/13/crv-slides-30-as-loans-tied-to-curves-founder-face-liquidation-risk","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/curve-ceo-clarifies-uwu-hack-misinformation","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/curve-finance-founder-michael-egorov-suffers-massive-liquidations","type":"other","url":""},{"credibility":3,"name":"https://protos.com/curve-finance-founder-michael-egorov-hit-amid-22m-crv-liquidation-cascade/","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/232464/curve-finance-ceo-michael-egorov-wife-mansions-australia","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/04/27/fact-check-did-michael-egorov-pull-100m-from-crv-to-buy-mansions-and-leave-bad-debt/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://bitcoinethereumnews.com/finance/curve-finance-investigates-sdola-llamalend-attack-as-oracle-design-and-collateral-mechanics-come-under-scrutiny/","type":"other","url":""},{"credibility":3,"name":"https://nulltx.com/curve-finance-investigates-sdola-llamalend-attack-as-oracle-design-and-collateral-mechanics-come-under-scrutiny/","type":"other","url":""},{"credibility":3,"name":"https://x.com/CurveFinance/status/2028427216401342496","type":"other","url":""},{"credibility":3,"name":"https://phemex.com/news/article/curve-investigates-attack-on-sdola-llamalend-market-63826","type":"other","url":""},{"credibility":3,"name":"https://www.mexc.com/news/840010","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/crv-price-llamalend-exploit-sentiment-support-2026/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2026/04/27/curve-founder-pitches-market-based-fix-for-usd700k-bad-debt-in-contrast-to-aave-bailout","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/curves-new-bad-debt-pools-turn-losses-into-tradable-claims/","type":"other","url":""},{"credibility":3,"name":"https://blockonomi.com/curve-finance-launches-recovery-path-for-affected-crv-long-llamalend-market-lenders/","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/398958/better-than-bailouts-curve-founder-proposes-market-based-bad-debt-recovery-model-for-defi-lending-amid-kelpdao-fallout","type":"other","url":""},{"credibility":3,"name":"https://www.panewslab.com/en/articles/019dcc94-42ea-752e-9aab-1c988b2be01f","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cryptotimes.io/2026/05/28/stake-dao-assures-users-after-vsdcrv-exploit-and-bridge-shutdown/","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/402719/security-researchers-flag-ongoing-stakedao-exploit-vsdcrv","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/stake-dao-exploit-vsdcrv-arbitrum/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/stake-dao-exploit-update-key-products-unaffected-bridge-closed/","type":"other","url":""},{"credibility":3,"name":"https://invezz.com/news/2026/05/27/arbitrum-based-stakedao-contract-hit-by-5-4t-vsdcrv-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.chainalysis.com/blog/curve-finance-liquidity-pool-hack/","type":"other","url":""},{"credibility":3,"name":"https://techcrunch.com/2023/08/01/curve-finances-62m-exploit-exposes-larger-issues-for-defi-ecosystem/","type":"other","url":""},{"credibility":3,"name":"https://blockworks.com/news/curve-suffers-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-vyper-bug-hack-july-2023","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/academy/curve-finance-hack","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://resources.curve.finance/risks-security/risks/lending/","type":"other","url":""},{"credibility":3,"name":"https://www.llamarisk.com/research/curve-lending","type":"other","url":""},{"credibility":3,"name":"https://llamarisk.com/research/defi-money-risk-parameterization","type":"other","url":""},{"credibility":3,"name":"https://www.ccn.com/analysis/crypto/curve-llamallend-founder-innovation/","type":"other","url":""},{"credibility":3,"name":"https://resources.curve.finance/crvusd/loan-concepts/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.chaincatcher.com/en/article/2120482","type":"other","url":""},{"credibility":3,"name":"https://docs.curve.finance/assets/pdf/audits/ChainSecurity_Curve_Curve_Stablecoin_audit_250221.pdf","type":"other","url":""},{"credibility":3,"name":"https://www.chainsecurity.com/security-audit/curve-stablecoin","type":"other","url":""},{"credibility":3,"name":"https://resources.curve.finance/risks-security/risks/lending/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2024/06/13/crv-slides-30-as-loans-tied-to-curves-founder-face-liquidation-risk","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/michael-egorov-promises-to-develop-curve-amid-accusations-of-elaborate-cash-out","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/232464/curve-finance-ceo-michael-egorov-wife-mansions-australia","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2026/04/27/fact-check-did-michael-egorov-pull-100m-from-crv-to-buy-mansions-and-leave-bad-debt/","type":"other","url":""},{"credibility":3,"name":"https://fintelegram.com/curve-ceo-michael-egorov-and-his-lavish-australian-villas/","type":"other","url":""}]}],"sources_used":[],"summary":"Curve LlamaLend (also referred to as the crvUSD lending markets) is a decentralized, permissionless isolated lending protocol built by Curve Finance that allows users to borrow crvUSD against crypto collateral using the LLAMMA soft-liquidation mechanism. The protocol has experienced multiple distinct incidents since launch: a $10 million bad-debt event in June 2024 tied to the founder's oversized leveraged positions, an oracle-manipulation attack on the sDOLA market in March 2026 resulting in approximately $240,000 in borrower losses, an October 2025 market crash that left the CRV-long vault approximately $700,000 underbacked, and a May 2026 third-party exploit (Stake DAO) that forced the sunsetting of an associated Arbitrum LlamaLend market. The protocol's core contracts have not been directly compromised by a code-level hack, but recurring bad-debt events, oracle design flaws in permissionlessly created markets, and governance concentration risks have drawn sustained scrutiny including a flag from on-chain investigator ZachXBT.","timeline":[{"date":"2023-07-30","event":"Curve Finance liquidity pools exploited via Vyper compiler reentrancy bug (versions 0.2.15, 0.2.16, 0.3.0); initial losses estimated at ~$70M, ultimately ~$52M after white-hat recoveries. LlamaLend not yet deployed.","source":""},{"date":"2024-04-13","event":"Statemind releases pre-launch audit of LlamaLend, identifying 1 Critical, 1 High, and 4 Medium vulnerabilities — all reportedly remediated before deployment.","source":""},{"date":"2024-06-13","event":"CRV drops ~28–30% following the UwU Lend exploit. Curve founder Michael Egorov's $95.7M in stablecoin debt backed by ~47% of CRV supply is liquidated across five platforms. LlamaLend CRV market accrues $10M in bad debt.","source":""},{"date":"2024-06-15","event":"Michael Egorov announces full repayment of the $10M LlamaLend bad debt, funded in part by a $6M USDT sale of 30M CRV to NextGen Venture Partners.","source":""},{"date":"2024-12-19","event":"Egorov liquidated again for 918,830 CRV (~$882,000) as CRV falls more than 12% in 24 hours, per CoinDesk reporting.","source":""},{"date":"2025-10-10","event":"Broad market crash — attributed in part to tariff announcement — triggers $19B in global leveraged liquidations. LlamaLend CRV-long market accrues approximately $700,000 in bad debt as gas spikes prevent timely liquidations; lender vault drops to ~70% solvency.","source":""},{"date":"2026-03-02","event":"sDOLA–crvUSD LlamaLend market exploited via flash-loan oracle manipulation attack. Attacker profits ~$240,000; borrowers in the market are liquidated; lenders unaffected. Curve Finance confirms investigation on X.","source":""},{"date":"2026-04-27","event":"Michael Egorov proposes permissionless market-based bad-debt recovery pool for the October 2025 CRV-long LlamaLend bad debt, centered at 71% solvency, as an alternative to bailout mechanisms.","source":""},{"date":"2026-05-27","event":"Stake DAO exploited on Arbitrum; attacker mints 5.4 trillion vsdCRV via compromised deployer key. Actual losses limited to ~$91,000. The Arbitrum asdCRV LlamaLend market is sunset; crvUSD depositors directed to migrate.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 38dcbccf-4f2e-4a14-96fa-8dc8e8a21392copy
2. #2reviewby reviewerreviewer

   2026-06-10 00:03:12Z
   Score: 52 → 52 (no score change)
   The investigation page's factual claims are largely accurate and well-grounded: all major incident dates, dollar figures, and mechanism descriptions are corroborated by tier-1 sources or contemporaneous reporting. The one unverifiable claim — a specific flag by ZachXBT directed at Curve LlamaLend — has no corroborating source across multiple searches. The one partially-supported claim (June 15 repayment date) has the core facts confirmed but the specific date could not be independently verified due to a 404 on the cited CoinTelegraph URL. A significant structural gap exists in that all section content fields are empty, leaving the full page structure unreviewed.
   anchoranchored

   chain

   ●mainnet-betaslot 425,432,765

   sig

   56KMgh1Sc6xx…pZ8UFfgNcopyexplorer ↗

   hash

   64JTukUT8ANC…U74icD6Gcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1021 B) ▸

   {"actor":"reviewer","decided_at":"2026-06-10T00:03:12.128Z","decision":"review","investigation_id":"b20a5ebe-152f-4198-9df6-0987e1950faf","new_score":52,"page_slug":"curve-llamalend","prev_score":52,"reason":"The investigation page's factual claims are largely accurate and well-grounded: all major incident dates, dollar figures, and mechanism descriptions are corroborated by tier-1 sources or contemporaneous reporting. The one unverifiable claim — a specific flag by ZachXBT directed at Curve LlamaLend — has no corroborating source across multiple searches. The one partially-supported claim (June 15 repayment date) has the core facts confirmed but the specific date could not be independently verified due to a 404 on the cited CoinTelegraph URL. A significant structural gap exists in that all section content fields are empty, leaving the full page structure unreviewed.","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6cdd8a11-32bb-45c2-bdc8-ea8172e4cf73copy
3. #3review approveby judgejudge

   2026-06-10 00:03:12Z
   Score: 52 → 52 (no score change)
   The review assessed 16 claims and found 14 confirmed, 1 partially supported, and 1 unverifiable — yielding a disputed_pct of 6.25%, within the 0–10% approval band. The one unverifiable claim (claim_findings[6]: a ZachXBT flag directed at Curve LlamaLend) appears in the summary as a supporting detail with no corroborating source, but it is not a core allegation and does not affect the accuracy of the incident record. The one partially-supported claim (claim_findings[10]: June 15 repayment date) has all material facts confirmed by Tier 1 sources; only the specific date is unverifiable due to a 404 on the cited CoinTelegraph URL. Two high-priority coverage gaps exist — the governance concentration claim lacks quantitative support, and all nine section content fields are empty — but gaps indicate areas for expansion rather than grounds for denial under platform policy.
   anchoranchored

   chain

   ●mainnet-betaslot 425,432,768

   sig

   25hh6Bv927XH…WjwLm9zqcopyexplorer ↗

   hash

   7sMAuhgrRWH8…PjEyvBoWcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1233 B) ▸

   {"actor":"judge","decided_at":"2026-06-10T00:03:12.128Z","decision":"review_approve","investigation_id":"b20a5ebe-152f-4198-9df6-0987e1950faf","new_score":52,"page_slug":"curve-llamalend","prev_score":52,"reason":"The review assessed 16 claims and found 14 confirmed, 1 partially supported, and 1 unverifiable — yielding a disputed_pct of 6.25%, within the 0–10% approval band. The one unverifiable claim (claim_findings[6]: a ZachXBT flag directed at Curve LlamaLend) appears in the summary as a supporting detail with no corroborating source, but it is not a core allegation and does not affect the accuracy of the incident record. The one partially-supported claim (claim_findings[10]: June 15 repayment date) has all material facts confirmed by Tier 1 sources; only the specific date is unverifiable due to a 404 on the cited CoinTelegraph URL. Two high-priority coverage gaps exist — the governance concentration claim lacks quantitative support, and all nine section content fields are empty — but gaps indicate areas for expansion rather than grounds for denial under platform policy.","score_delta":0,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 47c671d6-639b-41a3-b1a6-16c2b4a2b463copy
4. #4rescoreby systemsystem

   2026-10-10 18:50:47Z
   Score: 52 → 40 (-12)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 40. Problems weighed by who is responsible: concerns that are not fraud −12.8, the subject's own conduct −8, incidents the subject suffered −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +4.
   anchoranchored

   chain

   ●mainnet-betaslot 455,371,040

   sig

   32rqpurFVpSx…9MwjxKRTcopyexplorer ↗

   hash

   7N1UFMrD6Gdb…TvysD8hXcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (678 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:50:47.150Z","decision":"rescore","investigation_id":"b20a5ebe-152f-4198-9df6-0987e1950faf","new_score":40,"page_slug":"curve-llamalend","prev_score":52,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 52 → 40. Problems weighed by who is responsible: concerns that are not fraud −12.8, the subject's own conduct −8, incidents the subject suffered −6.4, problems around the subject, caused by others −1.6; legitimacy credit long-running +4.","score_delta":-12,"score_model":"v2","sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 68556d60-03ed-461c-9c8c-141cfa439c14copy
5. #5reviewby reviewerreviewer

   2026-10-16 23:00:40Z
   Score: 40 → 40 (no score change)
   The page's core incident narrative -- the June 2024 Egorov liquidation and $10M bad debt, the March 2026 sDOLA oracle manipulation, the October 2025 CRV-long bad debt and Egorov's April 2026 recovery-pool proposal, the May 2026 Stake DAO/vsdCRV exploit, and the July 2023 Vyper background -- is substantially well-sourced and checks out against independent reporting, often down to specific dollar and percentage figures (e.g., the $700K/70%-backed/71%-solvency figures and the $19B tariff-crash liquidation figure are all precisely confirmed). However, the review surfaced several concrete defects: a likely-fabricated or at minimum uncited attribution to ZachXBT; a citation misattributed to CoinDesk that is actually The Block, bundled with a causal claim (borrowed proceeds funding the mansions) not supported by that source; a dead/wrong-slug thedefiant.io URL whose correct live version turns out to be a June 2024 article, not the 'April 2026' accusations the page describes; an unsupported and internally-contradicted claim that the 2023 Vyper exploit caused the 2024 bad-debt cascade; a disputed 47%-of-supply figure that none of the page's own sources support; two dead mirror-site citations in the sDOLA section (working replacements identified); and a systemic 404 pattern across all resources.curve.finance/docs.curve.finance citations. None of these defects reverse the page's overall risk characterization, but several (especially the ZachXBT attribution and the CoinDesk/Block misattribution) are the kind of checkable, specific errors that should be corrected before the next publish cycle.
   anchoranchored

   chain

   ●mainnet-betaslot 457,812,918

   sig

   37kTqGGUYVN9…oarTuhX3copyexplorer ↗

   hash

   8yC9XMhJjy58…VoriU2kCcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2208 B) ▸

   {"actor":"reviewer","artifact_identity":"ed7340a8c28370a1eab416172fb2b7ea","decided_at":"2026-10-16T23:00:40.648Z","decision":"review","disputed_pct":0.2941,"findings_hash":"7obpSdAKtGnhjWgMtBXPGjA5fgyi74YgCs7njVkesrx2","investigation_id":"b20a5ebe-152f-4198-9df6-0987e1950faf","mode":"findings_only","new_score":40,"page_content_hash":"73f0816c74e81af795a7b0b5906ec6d211cafc6f40723ed64ad52b69bc5516b6","page_slug":"curve-llamalend","prev_score":40,"reason":"The page's core incident narrative -- the June 2024 Egorov liquidation and $10M bad debt, the March 2026 sDOLA oracle manipulation, the October 2025 CRV-long bad debt and Egorov's April 2026 recovery-pool proposal, the May 2026 Stake DAO/vsdCRV exploit, and the July 2023 Vyper background -- is substantially well-sourced and checks out against independent reporting, often down to specific dollar and percentage figures (e.g., the $700K/70%-backed/71%-solvency figures and the $19B tariff-crash liquidation figure are all precisely confirmed). However, the review surfaced several concrete defects: a likely-fabricated or at minimum uncited attribution to ZachXBT; a citation misattributed to CoinDesk that is actually The Block, bundled with a causal claim (borrowed proceeds funding the mansions) not supported by that source; a dead/wrong-slug thedefiant.io URL whose correct live version turns out to be a June 2024 article, not the 'April 2026' accusations the page describes; an unsupported and internally-contradicted claim that the 2023 Vyper exploit caused the 2024 bad-debt cascade; a disputed 47%-of-supply figure that none of the page's own sources support; two dead mirror-site citations in the sDOLA section (working replacements identified); and a systemic 404 pattern across all resources.curve.finance/docs.curve.finance citations. None of these defects reverse the page's overall risk characterization, but several (especially the ZachXBT attribution and the CoinDesk/Block misattribution) are the kind of checkable, specific errors that should be corrected before the next publish cycle.","score_delta":0,"sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision e8515035-7be1-468a-938b-152e7429d8b2copy