Protocol Upgrade Compatibility Review: Curve DEX

The Curve Finance decentralized exchange (DEX) on Ethereum and multiple Layer 2 solutions manages approximately $1.30 billion in total value locked (TVL). The platform's core contracts are highly upgradeable using a proxy-based governance model, and they are interconnected with various auxiliary contracts, such as gauges, factories, meta-pools, and the veCRV voting escrow.

This report examines the compatibility of upgrades to the Curve DEX protocol, focusing on potential security issues that could arise during the introduction of new features or parameters.

The evaluation reveals a mixed overall health rating of 4.7 out of 10, indicating a medium-high level of risk associated with upgrade compatibility. This assessment includes several critical and medium-risk issues that could potentially be exploited during a rushed or inadequately audited upgrade, especially given the high TVL and the involvement of substantial institutional participants.

A few key findings highlight areas of concern. First, there is a risk of storage-slot collisions during new implementations, which could lead to unauthorized access to funds and manipulation of gauge addresses. A second issue concerns improper initializer guards in new contracts, allowing for the manipulation of critical parameters and the distortion of pool price oracles.

Third, the emergency pause feature of the governance system could be compromised, granting attackers the ability to bypass the 48-hour timelock and perform malicious upgrades without community oversight. Fourth, there exists a potential re‑entrancy window in the cross-chain and Layer 2 bridges, which could result in double-counted fees, inflation of rewards, or token minting overflow.

Fifth, the lack of a hard cap on the fee model migration could enable attackers to set extremely high fees, leading to immediate financial losses for users. Finally, the absence of formal verification of upgrade paths could result in undetected storage collisions, leading to silent state corruption over time.

To mitigate these risks, the report suggests several prioritized technical recommendations. First, implementing automated checks to enforce storage-slot invariance would help prevent issues related to storage collisions and unauthorized parameter changes. Second, introducing an initializer guard into all upgradeable contracts would mitigate the risk of parameter manipulation during contract upgrades.

Third, restricting the authority of the emergency pause feature would address the potential for malicious upgrades without adequate scrutiny. Fourth, addressing re‑entrancy vulnerabilities in the Layer 2 bridges would prevent double-counted fees and other exploitative actions. Fifth, limiting the fee model migration would protect users from excessive fee settings.

Lastly, the report emphasizes the need for formal verification of upgrade paths to avoid unnoticed storage collisions during multiple upgrades.

In conclusion, while the Curve DEX protocol is fundamentally sound, the identified compatibility issues, particularly surrounding upgrade mechanisms, warrant immediate attention and action. Implementing the recommended measures will help ensure the continued security and integrity of the platform, safeguarding its users' funds and maintaining market confidence.