Convex Finance

Convex Finance is the largest yield aggregator built on top of Curve, designed to maximize Curve LP rewards without requiring depositors to lock CRV themselves. A user deposits Curve LP tokens into Convex, which stakes them into Curve’s gauge system on the user’s behalf, claims the CRV emissions, votes via its own permanent veCRV lock for the highest-emitting pools, and redirects the boosted rewards back to depositors. The depositor earns trading fees plus boosted CRV plus CVX (Convex’s own token) plus any partner emissions on the underlying gauge - without needing to ever interact with veCRV directly.

The mechanism that makes this work is Convex’s accumulation of one of the largest veCRV positions in existence. Voters who lock CVX into vlCVX (vote-locked CVX) effectively direct Convex’s veCRV voting power, which became the focal point of the “Curve Wars” - protocols would buy CVX off-market and lock it to ensure their pools received maximum CRV emissions. The flywheel has weakened since peak Curve Wars in 2022 but vlCVX still meaningfully influences gauge allocations, and Convex still routes the bulk of yield-aware Curve liquidity.

Audits by MixBytes, Trail of Bits, and Certik cover the booster contracts and the vlCVX system. The protocol has run since 2021 without contract-level exploits on its own code. The most significant historical risk passed through from underlying Curve: the July 2023 Vyper-compiler exploit hit Convex-routed pools, with affected depositors compensated through the same Curve governance process. The dominant risk vectors today are upstream - anything that affects Curve, CRV emissions, or the gauge system affects Convex’s yields directly - plus the standard smart-contract risk of an additional protocol layer between depositor and underlying assets.