Curve Review

How Curve scores in decentralized exchanges

This entry rates the Curve DEX, the Stableswap and Cryptoswap pools governed by the Curve DAO, in our decentralized exchange ranking. The basis is desk research of the Curve Knowledge Hub, its developer documentation, its contract deployments directory and the LICENSE files on GitHub, checked on November 1, 2026. No swap was made. The category uses five criteria, each marked 0 to 10 and weighted equally, as set out in our ratings methodology.

The overall score is the plain average: (6 + 1 + 8 + 10 + 10) ÷ 5 = 35 ÷ 5 = 7.0. On the scores currently recorded for the other eight protocols, that places Curve fifth, behind Raydium at 8.2 and ahead of Orca at 6.2.

Three marks changed on this pass. Fee transparency rose from 3 to 6 because the fee pages that returned errors in July now load and state figures. Immutability & governance rose from 4 to 8 after the pool risk page was found to state that pools cannot be upgraded. Audit disclosure rose from 9 to 10 because the audits page now names a fifth firm and links every report with a date. The licence and chain marks were rechecked and stand. The overall score moves from 5.4 to 7.0.

Strongest criteria: chains, audits and immutability

Chain coverage (10)

Curve's contract deployments directory lists 1,327 contracts across 30 networks, among them Ethereum, Arbitrum, Base, BNB Chain, Optimism, Polygon, Gnosis, Fraxtal, Sonic and Monad. The page itself warns that some entries may be outdated, so the count is the protocol's own figure rather than an independent check. It is the widest list in the category.

Audit disclosure (10)

The audits page lists 19 reports, each with a "View Full Report" link, from Trail of Bits, MixBytes, Quantstamp, ChainSecurity and StateMind. They run from Trail of Bits' review of the DAO contracts on July 10, 2020 to ChainSecurity's cross-chain governance audit on September 17, 2025, and six cover the DEX itself. Named firms with linked, dated reports meet the rubric in full. An audit reviews code at a point in time and is not insurance: in July 2023, several older pools were drained through a reentrancy bug in the Vyper compiler, which the Vyper team's post-mortem describes.

Immutability & governance (8)

The pool risk page states that Curve pool contracts are intentionally designed to be immutable and noncustodial and cannot be upgraded. It adds that the time-limited freeze in early pools has been deprecated in current implementations. Power is named: the DAO of veCRV holders decides in one-week votes, and a 5-of-9 Emergency Admin can cancel DAO-approved parameter changes and halt CRV emissions to a pool. The factory documentation says implementation contracts are upgradable for new pools. The mark stays below Uniswap's 10 because the Stableswap-NG documentation lets the factory admin change a deployed pool's fee through set_new_fee.

Weakest criteria: licence and fees

Licence & code openness (1): no rights granted

The stableswap-ng LICENSE, copyright Swiss Stake AG 2020 to 2026, says the code has been published for informational purposes only and that no licence, right of reproduction or distribution or other right is granted or implied. GitHub's classifier returns NOASSERTION for stableswap-ng, twocrypto-ng, tricrypto-ng and curve-contract. Anyone may read the contracts; nobody is given the right to reuse them. That is a deficiency under the rubric, not a gap in measurement, and it is the lowest licence mark in the category.

Fee transparency (6): typical ranges, not tiers

The DEX overview says most Stableswap pools charge 0.005% to 0.02%, the Strategic Reserve pools about 0.001%, and Cryptoswap pools from about 0.05% to around 0.4%. Both pool types use dynamic fees that rise when a swap worsens an imbalance. The Stableswap-NG documentation fixes the admin fee as a constant 50% of the trading fee, and the fee documentation says admin fees are collected, converted and distributed to veCRV holders. On a $10,000 swap through a pool charging 0.01%, the fee is $1, half to the pool's liquidity providers. Because the figures are typical ranges and each pool sets its own rate, a trader still needs the quote for the exact pool. The rubric places that with the bounded-fee 6s, below fixed tiers.

What the score does not cover

The rubric reads published disclosures. It does not measure liquidity depth, slippage, how often dynamic fees apply or the risks of individual pool tokens; Curve's own risk page warns that permissionless factory pools may hold unvetted tokens. crvUSD, scrvUSD and Llamalend are outside this DEX rating. For how stableswap pricing differs from constant-product pools, see our explainer on how automated market makers work.

Curve vs PancakeSwap and SushiSwap

Curve matches or beats PancakeSwap on every criterion except fees and the licence, where the gap of eight points does most to decide the order. It leads SushiSwap on audits and immutability, matches it on fees and trails it on licence.

Who this rating suits

The score is most useful to readers who swap stablecoins or pegged assets across many networks and weigh audit depth and non-upgradeable pools. It is a poor signal for developers or projects that want to fork or build on the code, since the licence grants no reuse rights. The score describes disclosure, not the risk of any particular pool.