Convex Finance

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED because Convex does not create a new low-risk return source; it adds a reward, governance and contract layer to Curve or Frax positions the client must already be willing to own. Curve LP deposits remain redeemable through Convex, but their pool inventory, depeg, liquidity and smart-contract risks remain. CRV converted to cvxCRV is different: Convex locks that CRV permanently as veCRV and gives the holder a transferable cvxCRV receipt with no protocol redemption back to CRV. Exit therefore depends on secondary-market liquidity and price. CVX vote locking adds a separate sixteen-epoch liquidity commitment. The protocol discloses a 3-of-5 multisig with fee, pool-management, shutdown and voting powers, and its own known-issues page documents a complex residual fake-gauge/shutdown path. Convex may be useful infrastructure for specialists already underwriting Curve governance, but the extra boost does not justify irreversible cvxCRV conversion or delegated gauge exposure in this advisor diversification sleeve.

Kill criteria: the events that revoke this verdict
• Any underlying pool or asset lacks its own current approval and proposed-size exit test
• cvxCRV-to-CRV executable price falls more than 5% below parity at the proposed exit size
• Any live Booster, reward wrapper or admin-controlled component is not mapped to a current audit
• The published fake-gauge and forced-shutdown path loses its thirty-day warning period or gains a shorter route
• A Convex shutdown, Curve pool imbalance or CVX lock prevents the documented client exit inside its written limit

The research file

Mechanism and source of return

For a Curve LP position, Convex deposits the LP token into the corresponding Curve gauge through its Booster and issues a one-for-one Convex deposit token. That receipt can be staked in a reward pool to collect CRV, CVX and any extra pool incentives. Convex improves the CRV boost by concentrating veCRV voting power; it does not change the economic inventory inside the Curve pool. Pool fees, token prices, depegs and adverse rebalancing remain the underlying return and loss drivers, while reward emissions can make a temporary APY look durable.

The CRV path is materially different. Deposited CRV is locked forever by Convex as veCRV and cvxCRV is minted one-for-one. Staked cvxCRV receives Curve admin fees plus portions of Convex platform rewards, but the conversion is explicitly one-way. CVX is another exposure: it captures platform fees and voting influence, and must be locked for at least sixteen weekly epochs to vote.

Control and governance

Convex documents a 3-of-5 multisig whose named signers include two Convex contributors and representatives associated with Llama Airforce, Votium and Frax. It can update pool and stash factories, vary platform-fee allocations inside hard-coded ranges, set the treasury address, control shutdowns, change specified vlCVX reward parameters and sign Curve votes. The documentation says the multisig cannot directly take user deposits and shutdown leaves withdrawals available. Those are meaningful constraints, not removal of admin dependence.

vlCVX holders direct gauge and governance preferences through Snapshot, but the multisig still signs the resulting Curve vote and reserves discretion not to execute a result it views as an attack. A client is therefore relying on code, Curve governance, Convex voters and a small execution group at the same time.

Security and incident record

The official audit index lists MixBytes review of the original contracts and later PeckShield, ChainSecurity and Nomoi reviews of wrappers, Frax and sidechain components. It was last updated two years before this review, so it does not by itself establish that every live pool, wrapper or deployment maps to a current report. No successful loss of principal from the Ethereum Booster or main reward pool was identified in the primary materials reviewed.

Convex nevertheless publishes a residual known path in which a fake Curve gauge, a legitimate pool shutdown, duplicate deposit receipts and the forced system-shutdown sequence could reach real LP tokens. The documented mitigation requires a visible Curve vote, shutdown steps and a thirty-day delay. Disclosure and delay improve detectability; they do not justify treating the composed system as simpler or safer than holding the approved underlying directly.

Exit and liquidity

Ordinary Curve LP deposits can be unstaked and unwrapped through Convex at any time according to the Booster and reward-pool interfaces, returning the Curve LP token. That is only the first leg of exit: the holder must still withdraw or swap through Curve, where pool imbalance and token impairment determine realizable value. A Convex shutdown blocks new deposits but is documented to preserve user withdrawals.

cvxCRV has no protocol redemption to CRV; the holder must sell it in a liquidity pool, so the discount and executable depth are part of principal risk. vlCVX is inaccessible for sixteen full epochs plus the partial entry epoch, and expired locks left idle beyond four epochs can be kicked for an increasing bounty. These are three different exit profiles and must never be summarized as one Convex APY.

Comparison and decision

Compared with direct Curve LP staking, Convex can raise reward capture while adding Booster, receipt-token, reward-distribution, governance and CVX-emission dependencies. Compared with simply holding CRV, cvxCRV trades liquidity and redemption certainty for veCRV-derived fees without giving the holder a direct claim to unlock the permanently committed CRV. Compared with an approved lending or staking sleeve, neither path supplies a cleaner principal claim or a simpler exit waterfall.

Reject for this mandate. The decision is not that Convex is unusable infrastructure; it is that reward optimization cannot rehabilitate an underlying LP exposure the mandate declines, and irreversible cvxCRV conversion is not suitable client exit design. A future review must evaluate a named pool and product, not protocol TVL.

Observable reopening conditions

Reopen only for a named Convex product whose underlying exposure is independently approved, whose incremental net reward remains material after fees and CVX emissions, and whose proposed-size withdrawal succeeds through both Convex and the underlying pool inside a written slippage limit. cvxCRV would require an enforceable protocol redemption or sustained proposed-size secondary depth at a documented discount ceiling. Before any change, map every live contract and admin role to a current audit and re-test the published fake-gauge shutdown sequence.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Convex docs — understanding cvxCRV · primary · accessed 2026-08-14
  Supports: permanent CRV lock, one-way cvxCRV conversion, cvxCRV rewards
• Convex integration docs — Booster deposits and withdrawals · primary · accessed 2026-08-14
  Supports: LP receipt token, Curve gauge deposit, LP withdrawal
• Convex docs — multisig admin rights · primary · accessed 2026-08-14
  Supports: 3-of-5 multisig, fee bounds, shutdown powers, no direct access claim
• Convex docs — CVX vote locking · primary · accessed 2026-08-14
  Supports: sixteen-epoch lock, unlock process, kick bounty
• Convex docs — audits · primary · accessed 2026-08-14
  Supports: audit firms, audit dates, component scope
• Convex docs — known issues · primary · accessed 2026-08-14
  Supports: fake gauge path, shutdown sequence, thirty-day mitigation
• Convex docs — platform risks · primary · accessed 2026-08-14
  Supports: Curve dependency, Frax dependency, smart-contract loss risk

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.