(a) Problem the project solves

Convex Finance solves the capital and governance inefficiency of the Curve Finance vote escrow model. Curve pays its highest CRV rewards to liquidity providers who lock CRV as veCRV for up to four years, which forces small providers to choose between illiquid multi-year locks and materially lower yields. Convex pools CRV from many depositors into a single protocol owned veCRV position and passes the resulting boost to every depositor, so a liquidity provider earns boosted CRV rewards without locking anything and without running their own veCRV position. Convex applies the same model to Frax Finance through cvxFXS and to FX Protocol through cvxFXN.

(Source: Convex Docs, Understanding CVX, Tokenomics)

(b) Operational priorities

Convex operates as an immutable deployed protocol rather than an actively roadmapped product. Its published operating priorities are maintaining the Curve, Frax, and FX Protocol integrations, running the biweekly gauge weight vote cycle through Snapshot, distributing protocol fees to cvxCRV stakers and vote locked CVX holders, maintaining sidechain deployments on Arbitrum and Polygon, and funding security work through the audit programme and the bug bounty.

(Source: Voting and Gauge Weights, Fees, Contract Addresses, Bug Bounties)

(c) High-level project overview

Convex Finance is a yield and governance aggregation protocol deployed on Ethereum mainnet with sidechain deployments on Arbitrum and Polygon. Curve liquidity providers stake their LP tokens into the Convex Booster contract at 0xF403C135812408BFbE8713b5A23a04b3D48AAE31, which routes them through the Convex Voter Proxy at 0x989AEb4d175e16225E39E87d0D97A3360524AD80 and earns boosted CRV. CRV depositors receive cvxCRV, a liquid tokenised claim on the protocol's permanently locked veCRV position. CVX holders lock their tokens for sixteen weeks or more to receive vlCVX, which directs the protocol's veCRV and veFXS gauge weight votes and earns a share of protocol fees. Governance runs through Snapshot at cvx.eth, and the Convex multisig signs to establish the outcome of every CVX Snapshot vote onchain.

(Source: Convex Docs, Contract Addresses, Voting and Gauge Weights, Understanding CVX)

(d) Primary token functions

CVX is the native platform token of Convex Finance. Staked CVX earns a share of the CRV and FXS that Convex collects from Curve and Frax liquidity providers, delivered as cvxCRV and cvxFXS after Convex locks the underlying as veCRV and veFXS. CVX locked for sixteen weeks or longer becomes vlCVX, which votes on Convex governance proposals through Snapshot, directs Convex's veCRV and veFXS gauge weight votes, and earns additional fees from Frax Finance liquidity providers. CVX is minted pro rata for every CRV token that Curve liquidity providers claim on Convex, and the CVX to CRV mint ratio reduces every 100,000 CVX minted.

(Source: Understanding CVX, Tokenomics, Vote Locking, Fees)

(e) Control surface reliance

Convex concentrates administrative control in a single 3 of 5 multisig at 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB. That multisig updates the stash factory and pool manager, controls the arbitrator vault, adjusts fees within hard coded ranges, sets the treasury address, controls the Convex Treasury Account holding 9.7 percent of supply, votes Curve DAO proposals and gauge weights, manages Master Chef distribution weights, pauses new deposits while leaving withdrawals open, applies new operators on the whitelisted proxy, manages vlCVX rewards and boost parameters, and shuts down the vlCVX contract with immediate withdrawals enabled. The documentation states that admin controls hold no access to user funds and that the multisig holds no direct access to user deposits. The multisig is also required to sign the outcome of every CVX Snapshot vote, so vlCVX voting is advisory at the execution layer.

(Source: Multisig Admin Rights, Voting and Gauge Weights, Convex Treasury, Contract Addresses)

Labs / DevCo

Foundation

DAO / Onchain Governance

Convex Finance operates without a publicly identified legal entity. The founders remain pseudonymous, and public profiles of the protocol record that the heads of Convex Finance are not known. No incorporation record, registered address, or jurisdiction has been published for a Convex development company.

Convex governance runs offchain through Snapshot at cvx.eth and is weighted by vlCVX balance. Proposal outcomes are proportional rather than binary, so a vote splitting 60 percent yes and 40 percent no results in Convex submitting an onchain vote of 60 percent yes and 40 percent no. Gauge weight votes run biweekly, opening Thursdays at 00:00 UTC and closing Tuesdays at 00:00 UTC, and each gauge must clear 0.05 percent of votes before weight is assigned. The 3 of 5 Convex multisig signs to establish the outcome of every CVX Snapshot vote.

(Source: Voting and Gauge Weights, Multisig Admin Rights, CVX Snapshot Space, Vote Locking, Convex Docs, Multisig Admin Rights, Convex Treasury, RootData C2tP, Cypherhunter Winthorpe, Cypherhunter Convex Finance, Multisig Admin Rights)

(a) IP ownership & control

No DAO entity holds Convex intellectual property. The protocol publishes its contract source under the convex-eth GitHub organisation across the platform, frax-cvx-platform, and sidechain-platform repositories, and the audit reports live in those same repositories. No trademark filing, brand registration, domain assignment, or subsidiary has been attributed to a Convex DAO, and no legal wrapper exists to hold such assets.

(Source: Audits, Convex Docs, Cypherhunter Convex Finance)

(b) Contract/admin powers

Convex governance holds no direct contract or administrative power. Every administrative function sits with the 3 of 5 multisig at 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB, which updates the stash factory and pool manager, controls the arbitrator vault, sets fees within hard coded ranges, sets the treasury address and allocates up to 2 percent of platform fees, controls the treasury account, casts Curve DAO and gauge weight votes, manages Master Chef distribution weights, pauses new deposits while leaving withdrawals open, applies new operators on the whitelisted proxy, manages vlCVX rewards, distributors, staking ratios, boost parameters, kick incentives, and token recovery, and shuts down the vlCVX contract. vlCVX holders vote through Snapshot, and the multisig executes those outcomes onchain. The documentation states that admin controls hold no access to user funds and that the multisig holds no direct access to user deposits.

(Source: Multisig Admin Rights, Voting and Gauge Weights, Contract Addresses)

(c) Locked-token rights (conditional)

CVX locked in the CVX Locker at 0x72a19342e8F1838460eBFCCEf09F6585e32db86E becomes vlCVX and carries defined rights. vlCVX votes on Convex governance proposals through Snapshot, directs the protocol's veCRV and veFXS gauge weight votes, earns a share of protocol fees, and receives additional fees from Frax Finance liquidity providers. Locks run a minimum of sixteen weeks and are grouped into weekly epochs starting Thursday at 00:00 UTC. Tokens auto unlock after sixteen full epochs but stay in the locker until the holder withdraws, and after a four epoch grace period any third party kicks idle CVX out for a 0.25 percent bounty per epoch elapsed. Holders delegate their vlCVX voting power to another address without transferring the tokens.

(Source: Vote Locking, Understanding CVX, CVX Vote Delegation, Contract Addresses)

(d) Value accrual & holder rights

CVX accrues value from the protocol fee stack. Convex charges 17 percent on Curve earnings, split as 10 percent to cvxCRV stakers paid in CRV, 4.5 percent to CVX stakers paid in cvxCRV, 2 percent to the treasury in CRV, and 0.5 percent to the harvest caller in CRV. Frax earnings carry a 20 percent charge, split as 10 percent to cvxFXS liquidity providers in FXS, 5 percent to vlCVX holders in FXS, and 5 percent to the treasury. FX Protocol routes 75 percent of revenue to cvxFXN stakers and 25 percent to the treasury, with boosted liquidity providers charged 8.5 percent to stakers and 8.5 percent to the treasury. Fee parameters are bounded in the contracts, with Curve ranges of 10 to 15 percent for cvxCRV stakers, 3 to 6 percent for CVX stakers, 0 to 2 percent for the treasury, and 0.1 to 1.0 percent for the caller, under an absolute 20 percent ceiling. Beyond fee share and gauge weight direction, CVX confers no claim on protocol assets and no redemption right.

(Source: Fees, Understanding CVX, Multisig Admin Rights)

(e) Dissolution authority

Convex publishes no dissolution or wind down procedure and no asset distribution authority for a DAO. The closest published mechanism is the multisig shutdown power. The multisig pauses new deposits while leaving withdrawals open, and it shuts down the vlCVX contract in a way that allows immediate withdrawal of locked CVX. Neither action distributes protocol assets, and no vlCVX vote triggers either one.

(Source: Multisig Admin Rights, Known Issues)

(a) Entity

Convex Finance operates no foundation entity. No non-profit, association, stiftung, or foundation company has been incorporated or announced for the protocol, and the Convex documentation names no such body anywhere in its governance, treasury, or administration pages.

(Source: Convex Docs, Multisig Admin Rights, Convex Treasury)

(b) IP ownership & control

No foundation exists, so no foundation holds Convex intellectual property. Contract source and audit reports sit in the public convex-eth GitHub repositories.

(Source: Audits, Convex Docs)

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

No foundation exists, so no foundation holds power over governance, the treasury, protocol controlled resources, or token administration. The 3 of 5 Convex multisig governs the treasury account and every administrative parameter.

(Source: Convex Treasury, Multisig Admin Rights)

(d) Powers over DevCo

No foundation exists, so no foundation holds power over any development entity. Convex has no publicly identified legal entity of any kind.

(Source: Cypherhunter Convex Finance, Multisig Admin Rights)

(e) Contract/admin powers

No foundation exists, so no foundation holds pause, upgrade, or executor authority over Convex contracts. Those powers sit with the multisig at 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB.

(Source: Multisig Admin Rights, Contract Addresses)

(f) Current economic arrangements and distribution policies

No foundation exists, so no foundation receives token allocations, fee share, or protocol distributions. Protocol fees route to cvxCRV stakers, CVX stakers, vlCVX holders, the harvest caller, and the treasury account controlled by the multisig.

(Source: Fees, Convex Treasury)

(a) Entity

Convex Finance operates without a publicly identified legal entity. The protocol was launched in May 2021 by pseudonymous founders known as C2tP and Winthorpe, and public profiles of the protocol state that the heads of Convex Finance are not known. No company registration, jurisdiction of incorporation, registered address, or corporate officer has been published for a Convex development company, and the documentation refers to the operating group only as the Convex Team.

(Source: Cypherhunter Convex Finance, RootData C2tP, Cypherhunter Winthorpe, Convex Treasury)

(b) IP ownership & control

No legal entity is identified to hold Convex intellectual property. Contract source is published in the public convex-eth GitHub organisation across the platform, frax-cvx-platform, and sidechain-platform repositories, together with all seven audit reports. No trademark filing, registered brand, or subsidiary has been publicly attributed to Convex Finance.

(Source: Audits, Convex Docs, Cypherhunter Convex Finance)

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

The Convex Team exercises effective control through its seats on the 3 of 5 multisig, where C2tP and Winthorpe hold two of the five keys alongside Benny of Llama Airforce, Tommy of Votium, and Sam of Frax Finance. The multisig controls the Convex Treasury Account at 0x1389388d01708118b497f59521f6943Be2541bb7, which holds 9.7 percent of total CVX supply, and the documentation states that use of treasury funds is currently at the discretion of the Convex Team. The multisig also sets fee parameters within hard coded ranges, allocates up to 2 percent of platform fees to the treasury address, manages Master Chef distribution weights, and signs the outcome of every CVX Snapshot vote.

(Source: Multisig Admin Rights, Convex Treasury, Contract Addresses, Voting and Gauge Weights)

(d) Powers over Foundation

Convex operates no foundation, so no development entity holds power over one.

(Source: Convex Docs, Convex Treasury)

(e) Contract/admin powers

Contract and administrative powers run through the 3 of 5 multisig at 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB and the Booster Owner contract at 0x3cE6408F923326f81A7D7929952947748180f1E6. Those powers cover the stash factory, the pool manager, the arbitrator vault, fee parameters, the treasury address, Curve DAO and gauge weight voting, Master Chef distribution weights, pausing new deposits while leaving withdrawals open, applying new operators on the whitelisted proxy, vlCVX rewards, distributors, staking ratios, boost parameters, kick incentives, token recovery, and shutdown of the vlCVX contract with immediate withdrawals. The documentation states that admin controls hold no access to user funds.

(Source: Multisig Admin Rights, Contract Addresses)

(f) Current economic arrangements and distribution policies

The Convex Team allocation is 10 percent of total supply, vested over one year from launch, and the investor allocation is 3.3 percent on the same one year vest. The treasury holds 9.7 percent of supply, also vested over one year, and the documentation states that the treasury exists for awarding or incentivising actions, tokens, people, and platforms deemed to have a positive influence on the well being of the Convex Finance platform, with use currently at the discretion of the Convex Team. Ongoing revenue to the treasury runs at 2 percent of Curve earnings, 5 percent of Frax earnings, 25 percent of FX Protocol revenue, and 8.5 percent from FX Protocol boosted liquidity providers. Convex publishes no salary, distribution, or profit sharing policy for the team beyond those allocations.

(Source: Tokenomics, Convex Treasury, Fees)

Public sources refer to a Convex Team, but the cited sources do not disclose a separately named DevCo legal entity, its jurisdiction, or the requested nonpublic control and economic-arrangement details. Convex Treasury Convex Finance: Pre-Launch Announcement

(a) Planned but not yet executed airdrop

Not applicable. The Convex launch airdrop has been executed.

(b) Executed airdrop

Per-address source: Convex publishes a per-address allocation file in its GitHub repository at userconvex_final_formatted.json. The file is a JSON object mapping Ethereum addresses to CVX allocation amounts denominated to 18 decimals. The claim process and the link to the allocation list are documented at Claiming your Airdrop.

Covered user segments and allocation method: The launch airdrop covered veCRV holders as of block 12296676 and veCRV holders who voted to whitelist Convex on Curve. Allocation amounts per address are published in the GitHub JSON file. (Claiming your Airdrop)

(c) No airdrop planned or conducted

Not applicable. Convex has conducted an airdrop.

Convex Finance engaged no market maker for CVX. The protocol held no public sale, listed no token through an exchange partnership, and allocated no portion of supply to liquidity provision or market making. The full 100,000,000 CVX supply routes to Curve liquidity provider rewards at 50 percent, liquidity mining at 25 percent, the team at 10 percent, the treasury at 9.7 percent, investors at 3.3 percent, and the two airdrops at 2 percent combined, with no liquidity bucket among them. CVX liquidity formed organically on decentralised exchanges and through the protocol's own Curve pools. Convex has disclosed no token loan, option agreement, or market maker counterparty at any point since the May 2021 launch. (Source: Tokenomics, Understanding CVX, Convex Docs)

Convex Finance pursued no exchange listing programme and disclosed no listing agreement, token commitment, or listing fee for CVX. The documentation names three ways to acquire CVX, which are purchasing on a decentralised exchange, earning it as a CRV staker or Curve liquidity provider on Convex, and claiming the launch airdrop. CVX trades on centralised venues that listed it independently, and the protocol allocated no supply to any of them. Primary onchain liquidity sits on Ethereum mainnet decentralised exchanges, and the token is also deployed on Arbitrum and Polygon through the Convex sidechain platform.

(Source: Understanding CVX, Tokenomics, Contract Addresses, CoinGecko)

Convex Finance conducted no public token sale, no initial exchange offering, and no launchpad round. The tokenomics disclose a single investor allocation of 3.3 percent of total supply, 3,300,000 CVX, vested over one year from the May 2021 launch. Convex has not published the identity of those investors, the price paid, the date of the sale, or the terms of the instrument used. No SAFT, token warrant, or purchase agreement has been made public. (Source: Tokenomics, Contract Addresses)

(a) Date & component affected

The attack ran from 20 June 2022 to 23 June 2022 and affected the convexfinance.com domain name system records held at the registrar NameCheap. The Convex smart contracts, the treasury, and the vlCVX locker were not touched.

(b) Exploit vector summary

A NameCheap customer support agent altered the domain's DNS records without authorisation, defeating both two factor authentication and a strong account password. The hijacked records pointed convexfinance.com at a copy of the Convex website containing malicious contracts. The attacker generated contract addresses that mimicked the first four and last four characters of the legitimate Convex addresses, so users performing an abbreviated address check approved token allowances to attacker controlled contracts.

(c) Quantified impact

Forty addresses approved the malicious contracts. Three of those forty lost funds. Total losses were 15,968 cvxCRV and 433 CRV.

(d) Remediation/response taken

@alexintosh and @samczsun reported the hijack on 23 June 2022. Convex regained control of the domain on 24 June 2022, moved it to a new registrar, and deployed multiple layers of DNS monitoring. Convex instructed all affected users to revoke the malicious approvals through Etherscan or revoke.cash and confirmed revocation before compensating. Compensation was paid from the treasury in CVX valued at the United States dollar value of each loss at the time it occurred, sent directly to the affected addresses.

(e) Current status

The incident is closed and all three affected addresses were compensated. Convex maintains a seven audit programme covering MixBytes in April 2021 on the core platform, PeckShield in April 2022 on the Frax staking platform, PeckShield in September 2022 on the staking wrapper, PeckShield in November 2022 on the sidechain platform, Nomoi in January 2023 on the cvxCRV staking wrapper, Nomoi in January 2023 on the sidechain platform, and ChainSecurity in April 2023 on the Silo Finance Curve and Convex feature. Convex runs a bug bounty with a maximum payout of 250,000 dollars scaled across likelihood and severity from 1,000 dollars upward, reported to [email protected]. The documentation discloses one known unmitigated weakness, a fake gauge and fake pool path against the shutdown system that requires an attacker to pass a Curve DAO proposal undetected through a seven day vote, manipulate gauge weight, shut down legitimate pools, create fake gauge pools, loop deposits and withdrawals, trigger emergency shutdown, and exploit the 30 day timelock. Convex treats that path as mitigated by its complexity, its visibility, the waiting periods involved, and the multiple shutdown mechanisms in place.

(Source: DNS Hijack Post-Mortem, Audits, Bug Bounties, Known Issues)

Convex Finance suffered one security incident affecting users, a DNS hijack of the convexfinance.com domain in June 2022. No Convex smart contract has been exploited.

(a) Regulatory, Legal & Tax Risks

Convex Finance carries an unusually high level of regulatory and legal risk because no legal entity stands behind it. The protocol was launched in May 2021 by pseudonymous founders known as C2tP and Winthorpe, public profiles record that the heads of Convex Finance are not known, and no incorporation record, jurisdiction, registered address, or corporate officer has ever been published. Convex has produced no legal opinion on the status of CVX in any jurisdiction, no MiCAR white paper for European Union distribution, no terms of service governing tokenholders, and no tax guidance. Tokenholders therefore hold no identified counterparty to sue, no governing law clause, no forum selection, and no dispute resolution path. Regulatory action against the protocol, its founders, or the multisig signers would leave holders without recourse and without an entity able to respond.

Token classification risk is unresolved and untested. CVX carries governance rights over the protocol's veCRV and veFXS gauge weight votes and a direct claim on a defined share of protocol fees, at 4.5 percent of Curve earnings to CVX stakers and 5 percent of Frax earnings to vlCVX holders. Regulators assessing those fee entitlements against securities frameworks in the United States, the European Union, or elsewhere would reach a different conclusion from the protocol's silence on the point. Convex distributed 2 percent of supply through airdrops and sold 3.3 percent to undisclosed investors on undisclosed terms, neither of which has been publicly analysed against any offering exemption. The multisig signers are identified only by pseudonym and by affiliation to Llama Airforce, Votium, and Frax Finance, which exposes those named counterparties to regulatory attention that Convex itself is structured to avoid. Tax treatment of vlCVX fee income, cvxCRV rewards, Votium bribe income, and airdrop receipts is determined entirely by each holder's own jurisdiction, and Convex publishes nothing on the subject.

(b) Protocol, Technology & Security Risks

Convex holds a large and permanently locked veCRV position on behalf of depositors and layers integrations with Curve, Frax Finance, and FX Protocol on top of it. The documentation states plainly that there is a non zero chance of losing some or all deposited funds, that smart contract risk is inherent to decentralised finance, and that users are beholden to any risk that pertains to the Curve and Frax platforms because Convex integrates directly with them. That dependency is structural. A failure in Curve's gauge system, the veCRV contract, or the Frax gauge system propagates directly into Convex deposits, and Convex holds no ability to unwind its locked veCRV position in response.

Security coverage is broad but not complete. Seven audits cover the platform, with MixBytes reviewing the core platform in April 2021, PeckShield reviewing the Frax staking platform in April 2022, the staking wrapper in September 2022, and the sidechain platform in November 2022, Nomoi reviewing the cvxCRV staking wrapper and the sidechain platform in January 2023, and ChainSecurity reviewing the Silo Finance Curve and Convex feature in April 2023. A bug bounty pays up to 250,000 dollars. Against that, Convex publicly discloses one unmitigated weakness, a fake gauge and fake pool path against the shutdown system that Convex treats as impractical rather than impossible, relying on the seven day Curve DAO vote period, the 30 day timelock, visibility, and multiple shutdown mechanisms as the barrier. Operational security has already failed once. The June 2022 DNS hijack of convexfinance.com succeeded through a registrar support agent despite two factor authentication and a strong password, cost three users 15,968 cvxCRV and 433 CRV, and demonstrated that the perimeter outside the contracts is the weaker one. Administrative concentration compounds this. A 3 of 5 multisig sets fee parameters, controls the treasury, applies new operators on the whitelisted proxy, casts all Curve DAO votes, and shuts down the vlCVX contract, and three compromised keys reach every one of those functions even though the documentation confirms the multisig holds no direct access to user deposits.

(c) Token Economics, Unlocks & Incentive Risks

CVX supply is effectively fully diluted. Maximum supply is capped at 100,000,000 tokens, total supply reached 99,982,000 by 27 July 2026, and circulating supply reached 99,978,000, so no unlock overhang remains and the demand driven mint that pays Curve liquidity providers has almost exhausted its budget. That removes dilution risk and removes the primary incentive lever at the same time. Convex minted CVX pro rata against CRV claimed on the platform, with the mint ratio stepping down every 100,000 CVX, and that emission is now spent. Curve liquidity providers depositing on Convex from here receive boosted CRV and fee share but almost no new CVX, which weakens the acquisition mechanism that built the protocol's veCRV position in the first place.

The demand side has deteriorated sharply. CVX trades at 1.34 dollars on 27 July 2026 for a market capitalisation of 133.97 million dollars against 8.13 million dollars of daily volume, 97.8 percent below the all time high of 60.09 dollars set on 1 January 2022 and within 29 percent of the all time low of 1.04 dollars set on 1 July 2026. Vote locking requires a sixteen week minimum commitment with auto unlock only after sixteen full epochs and a 0.25 percent per epoch kick bounty on idle locks after a four epoch grace period, so holders take real illiquidity risk in a falling market to earn fee share and Votium bribe income. Both of those revenue streams scale with Curve and Frax total value locked and with third party demand for gauge weight, neither of which Convex controls. Governance offers a limited check. vlCVX votes are weighted proportionally through Snapshot, gauge votes run biweekly with a 0.05 percent threshold, and the multisig is still required to sign every outcome onchain, so vlCVX directs gauge weight but does not unilaterally execute it.

(Source: Multisig Admin Rights, Risks, Audits, Known Issues, DNS Hijack Post-Mortem, Tokenomics, Fees, Vote Locking, Voting and Gauge Weights, CoinGecko, Bug Bounties, Cypherhunter Convex Finance)