The Curve DAO governance and its core contracts operate on Ethereum, but the protocol is deployed on more than 20 other chains. Each chain requires access to governance messages, crvUSD price updates, and config changes. However, existing bridges present limitations. Native bridges like those from Optimism or Arbitrum are reliable but limited to specific chains. Broader solutions like LayerZero and CCIP connect more networks but introduce protocol risk.
Curve Block Oracle uses a different model. It avoids a central trust point by combining storage proofs and bridge-agnostic transport. This structure reduces the risk of value loss or frozen operations due to bridge failure.
Storage proofs are the core of the system. The process starts by sending a blockhash from Ethereum using a native bridge or LayerZero. Then, users or keepers submit a Merkle-Patricia-Trie storage proof on the destination chain. That proof confirms data from the source chain’s storage slot.
Using this system, apps receive verified information like crvUSD price or governance actions directly. They do not depend on any single bridge. This approach ensures a low-trust, lightweight, and repeatable method to confirm data across chains.
Curve wrote the verifier in Vyper, the same language used for its smart contracts. At the time, Vyper did not support dynamic arrays, so the team rewrote an existing Solidity-based proof verifier into Vyper. This version helps maintain compatibility and simplifies audit review.
The Curve Block Oracle allows integration with any DeFi governance module, oracle-dependent app, or cross-chain infrastructure. Developers can implement it using two GitHub repositories:
The storage-proofs code was audited in a public Cyfrin CodeHawks contest. Curve plans to link the ChainSecurity audit for the blockhash-oracle module when complete.
To integrate, projects choose a transport layer. Native bridges are preferred for minimal trust, while LayerZero serves as a fallback option. Developers submit the blockhash and its corresponding proof. This confirms Ethereum-based data on the destination chain without full bridging dependencies.
Protocols already connected to Curve can also reuse Curve’s Oracle system to access verified crvUSD price data. This simplifies integration and avoids duplicate setups.
While adapting the Merkle proof verifier to Vyper, Curve found a critical bug. The issue allowed a missing node in the proof path to return a false zero value that could pass as valid.
This vulnerability was not unique to Curve. Other protocols using similar proof libraries — Aave, Frax, and StakeDAO — were affected. Curve coordinated with ChainSecurity to privately disclose the bug and support patch deployment.
Curve confirmed that the issue has now been resolved. All affected systems were updated before the public release of this information.
