Convex Finance Review
Fees itemized to the component, under an MIT licence
of 10
Convex Finance scores 8.6 out of 10 in yield aggregators: it itemizes every fee component with adjustable ranges, licenses all its code under MIT and states that its multisig cannot reach deposits. Admin powers are not time-locked and core audits date from 2021. Desk research, checked November 1, 2026.
Curve fee
17% of CRV: 10% cvxCRV, 4.5% CVX, 2% treasury, 0.5% caller; cap 20%
Frax and f(x) fees
20% of FXS rewards; 17% for boosted FXN LPs
LP costs
Zero deposit and withdrawal fees
Licence
MIT across convex-eth repositories, including voting
Audits
Seven linked reports: MixBytes, PeckShield, Nomoi, ChainSecurity
Admin
3-of-5 multisig, no timelock; states no direct access to deposits
Scores
Each criterion carries equal weight. The overall score is the average of these 5 scores — (10.0 + 10.0 + 8.0 + 7.0 + 8.0) ÷ 5 = 8.6.
Pros
- Fee disclosure 10: 17% CRV fee itemized, with adjustable ranges, a 20% ceiling and zero LP deposit or withdrawal fees
- Licence 10: MIT LICENSE file in platform; every public convex-eth repository checked reports MIT
- Strategy transparency 8: both current and projected APR stated to have all fees subtracted
- Custody 7: docs state the 3-of-5 multisig does not have direct access to user deposits
Cons
- Admin actions (pause, fee changes, treasury, votes) are not time-locked
- Core platform audit is a single MixBytes report from April 2021; the June 2026 voting auditor is unnamed
- No 'never locked' statement for LP deposits; a known attack path on deposits is documented
- Serves only Curve, Frax and f(x) Protocol LPs, with a one-way CRV-to-cvxCRV conversion
How Convex Finance scores in yield aggregators
This entry rates Convex Finance's staking platform for Curve, Frax and f(x) Protocol liquidity providers in our yield aggregator ranking. Convex pools its own vote-locked CRV (veCRV) so that LPs who stake through it earn boosted CRV without locking CRV themselves. The basis is desk research of Convex's documentation and its convex-eth GitHub repositories, checked on November 1, 2026. No position was opened. The category uses five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.
| Criterion | What the sources show | Mark |
|---|---|---|
| Fee disclosure | 17% of CRV rewards, itemized as 10% cvxCRV stakers, 4.5% CVX stakers, 2% treasury and 0.5% harvest caller. Frax 20% and f(x) 17% are split the same way. Adjustable ranges and a 20% ceiling are published, and LPs pay zero deposit and withdrawal fees. | 10 |
| Licence & code openness | convex-eth/platform carries an MIT LICENSE file, which GitHub detects as MIT. Every public convex-eth repository we listed, including the new on-chain voting contracts, is MIT. | 10 |
| Audit disclosure | Seven linked reports from four named firms: MixBytes (April 2021), PeckShield (2022), Nomoi (January 2023) and ChainSecurity (April 2023). A June 2026 voting-contract report is in the voting repository, with no firm named in the docs. | 8 |
| Custody & control | The multisig admin page states that the 3-of-5 multisig "does NOT" have direct access to user deposits, and that pausing deposits still lets users withdraw everything. Admin actions are not time-locked. | 7 |
| Strategy transparency | The APR page states that all fees are already subtracted from both the current and the projected APR, and explains how each is calculated. Where LP tokens go (Curve gauges through Convex's boosted position) is documented. | 8 |
The overall score is the plain average: (10 + 10 + 8 + 7 + 8) / 5 = 43 / 5 = 8.6.
Three marks changed at this check, all upward. Licence & code openness rose from 9 to 10, because an MIT file in the repository is the top band of the rubric and is how MIT-licensed peers are marked. Custody & control rose from 5 to 7 after we found the multisig admin page's explicit statement on deposits, which the previous check had not located. Strategy transparency rose from 6 to 8 on the APR page's statement that displayed returns are net of fees. The previous overall was 7.6.
Strongest criteria: fees and licence
Fee disclosure carries the full 10, and it is the most complete in this category. On its fees page Convex publishes the total and each component, and also how far the multisig may move each Curve component: 10% to 15% for cvxCRV stakers, 3% to 6% for CVX stakers, 0% to 2% for the treasury and 0.1% to 1% for the harvest caller, with an absolute ceiling of 20%. Fees come only from CRV revenue, not from incentive tokens or veCRV admin fees. A worked example: on 1,000 CRV of boosted rewards, an LP keeps 830 CRV at today's split.
Licence & code openness also scores 10. The platform repository's LICENSE file is the standard MIT text, and the GitHub API reports MIT for platform, frax-cvx-platform, sidechain-platform, function_x and voting. For a protocol that holds LP tokens, a permissive licence across all the code we checked is the strongest position the rubric allows.
Weakest criteria: custody wording and audit coverage
Custody & control at 7 is now a partial finding rather than a missing one. The statement that the multisig has no direct access to deposits is explicit. The docs do not use "never locked" wording for LP deposits, though. The multisig can pause deposits, change fee splits within the ranges, manage the treasury and vote Convex's veCRV without a timelock. Convex's known-issues page also describes one remaining attack path on deposits, which would need a malicious Curve gauge to pass a Curve DAO vote and a 30-day timelock to expire. Two Convex products lock by design: vlCVX for 16 to 17 weeks, and the CRV-to-cvxCRV conversion, which the docs say cannot be reversed. Neither applies to a plain LP stake, but both matter to anyone using Convex beyond LP staking.
Audit disclosure at 8 reflects coverage rather than missing reports. All seven reports listed are linked. The core platform contracts, though, rest on a single 2021 MixBytes audit, and the later reports cover wrappers, Frax staking and sidechains. The June 2026 voting audit is published, but the docs do not name its auditor. Peers that name more firms against their current core code score higher.
What the score does not cover
- APR levels and the value of CRV, CVX or cvxCRV, which move with the market.
- The risks of Curve, Frax and f(x) pools underneath. Convex's risks page warns that users carry those risks too and can lose some or all funds.
- The discount at which cvxCRV may trade to CRV after the one-way conversion.
- Who runs Convex. The rubric has no entity criterion, and no legal entity is named.
For how the pools themselves work, see our Curve review and the guide to how yield farming works.
Convex Finance vs Yearn Finance and Beefy
| Criterion | Convex | Yearn Finance | Beefy |
|---|---|---|---|
| Fee disclosure | 10 | 7 | 8 |
| Licence & code openness | 10 | 10 | 8 |
| Audit disclosure | 8 | 9 | 10 |
| Custody & control | 7 | 7 | 9 |
| Strategy transparency | 8 | 8 | 7 |
| Overall | 8.6 | 8.2 | 8.4 |
Against Yearn Finance (8.2), Convex leads on fees, matches it on licence, custody and strategy transparency, and trails on audits. Against Beefy (8.4), Convex leads on fees, licence and strategy transparency and trails on audits and custody; on licence, Beefy's source files carry MIT tags, but only Convex has a repository licence file. Peer marks are as currently published and may change as those entries are rechecked.
Who it suits
The score suits a Curve, Frax or f(x) liquidity provider who wants the cost of boosted rewards stated to the component, open code and a written statement that admins cannot reach deposits. It is narrower than a general vault aggregator: Convex only serves those ecosystems. It suits less well anyone who needs time-locked admin powers, or who would convert CRV to cvxCRV without accepting that the step is permanent.
How it compares
Origin (OUSD)
Open code and component-level audits for a yield-bearing dollar
Beefy
Named auditors and a plain no-custody statement
Yearn Finance
AGPL code with audits tied to each vault version
Pendle
Audit reports filed by component and a single published YT fee
Harvest Finance
Linked audits and net-of-fee APY with a 12-hour timelock
Idle Finance
Exact per-product fees and a dated, linked audit table
Sommelier
Apache-licensed code and a written user-only withdrawal rule
Yield Yak
Open code and no deposit or withdrawal fees
Sources
Scored from published primary sources rather than hands-on use. Every figure above comes from one of the pages below, on the date shown. Manufacturers change prices and specifications without notice — if something here no longer matches the source, tell us and we will correct it.
- 1.Convex docs: Fees — checked
- 2.Convex docs: Convex for liquidity providers — checked
- 3.Convex docs: Multisig admin rights — checked
- 4.Convex docs: Current vs projected APR — checked
- 5.Convex docs: Audits — checked
- 6.Convex docs: Voting contracts and security — checked
- 7.Convex docs: Known issues — checked
- 8.Convex docs: Risks — checked
- 9.GitHub: convex-eth/platform LICENSE (MIT) — checked
Frequently asked questions
Why does Convex Finance score 8.6?
It is the plain average of five equal marks: fee disclosure 10, licence 10, audit disclosure 8, custody 7 and strategy transparency 8. Itemized fees and MIT code carry it; admin powers without a timelock and older core audits hold it back.
What holds Convex's score back?
Custody and audits. The multisig can pause deposits, move fees within ranges and manage the treasury with no timelock. The core platform was last audited by MixBytes in April 2021, and the June 2026 voting audit names no firm in the docs.
What changed at the November 2026 check?
Licence rose from 9 to 10 on the MIT file, custody from 5 to 7 on the multisig page's explicit no-access statement, and strategy transparency from 6 to 8 on the net-of-fees APR statement. The overall moved from 7.6 to 8.6.
Is the APR shown on Convex before or after fees?
After. Convex's APR page says all fees are already subtracted from both the current APR, based on harvests already called, and the projected APR, based on today's TVL, boost and reward prices.
How does Convex compare with Yearn Finance and Beefy?
Convex scores 8.6, Beefy 8.4 and Yearn Finance 8.2. Convex leads both on fee disclosure, matches Yearn on licence, custody and strategy transparency, and trails both on audits; Beefy also leads it on custody.
Nothing here is financial advice. Editorial policy · How we score · How we're funded.