Curve has assigned its risk mandate to two developers associated with Resupply, handing responsibility for protocol risk oversight to an external team rather than an in-house committee. The move formalizes who is accountable for monitoring risk parameters across Curve’s lending and stablecoin stack.

What Curve Changed With the New Risk Mandate

The decision routes Curve’s risk mandate to two Resupply developers, placing day-to-day risk responsibility with a named external party. It is a governance and operational assignment, not a response to an exploit or a depeg event.

The appointment follows Curve’s risk service provider selection process, which the DAO tracked publicly through its call-for-proposals result and next-steps thread. That process was designed to pick a party accountable for risk parameters across crvUSD and Curve’s Llamalend markets, as reported in The Defiant’s coverage of the risk-provider decision.

Hiring an external risk specialist is an established pattern in DeFi governance. Major lending protocols such as Aave have historically contracted dedicated risk-management firms to model and adjust collateral and borrowing parameters, and Curve’s move follows the same logic: independent analysis from a party whose sole job is risk, rather than spreading that duty across core contributors.

Why the Move Matters for Curve Governance and Oversight

A risk mandate determines who sets and adjusts the parameters that govern collateral factors, liquidation thresholds, and market caps. Delegating that authority to a specific team makes accountability explicit, which matters for a protocol running a stablecoin and permissionless lending markets side by side.

Curve’s governance conducts these assignments through its on-chain DAO, where mandate holders operate under veCRV-directed oversight rather than unilateral control. The framing here is a protocol operations update: the DAO is defining who holds the risk function, not disclosing a security incident.

Concentrating the risk function in one external team is a trust decision. It raises the question of mandate scope, how much discretion the two developers hold over parameter changes, and how those changes are reviewed before they reach production. Resupply itself is a lending protocol built in the Curve ecosystem, so the appointment places oversight of Curve’s risk parameters with developers who have hands-on experience designing lending-market mechanics in that same environment.

What to Watch After Curve’s Appointment Decision

The open questions are scope, transparency, and reporting cadence. Readers should watch whether the two developers publish parameter-change rationales, how often risk reviews are posted to the governance forum, and what escalation path exists if a market approaches distress.

It is also worth watching whether Curve formalizes the arrangement through an on-chain vote and ownership assignment, similar to how the DAO has previously handled contract control in proposals such as its ownership proposal flow. A ratified mandate with documented scope would give veCRV holders a clearer basis to audit the risk function going forward.