Convex Finance

Convex launched in May 2021 around a simple bargain: pool Curve LP positions, claim their CRV at scale and keep the underlying liquidity withdrawable through Convex receipts. Curve still defined the gauges and veCRV rules; Convex became an aggregator on top.

The voter proxy concentrated CRV locks and gauge influence that individuals would struggle to match. That aggregation made vote direction valuable, but it did not turn CVX into ownership of Curve, Convex's treasury or the deposited LP assets.

CrvDepositor sends CRV into the Convex staker, renews the long Curve lock and mints cvxCRV in the same amount. Its code has no reverse burn-and-redeem function. The 1:1 number describes issuance, while an exit through a liquidity pool depends on market price and depth.

CVX does not mint on a flat calendar. When Curve LP rewards are claimed through the Booster, the minter reads total supply and reduces the CVX-per-CRV ratio across 1,000 cliffs. Each cliff spans 100,000 CVX, and minting stops at 100 million.

The initial plan reserved 50% for Curve LP rewards and 25% for four-year liquidity mining. Treasury received 9.7%, team 10%, investors 3.3%, and two groups received 1% airdrops; treasury, investor and team portions carried one-year vesting in the published plan.

Staked cvxCRV can receive CRV fees, CVX and Curve vote-escrow rewards such as crvUSD. CVX staking can receive configured fees, but voting requires a different action: locking CVX for 16 full weekly epochs to create vlCVX.

vlCVX holders direct how Convex uses pooled veCRV in gauge and proposal votes. External incentive markets may pay for those choices, yet those offers are variable third-party arrangements, not a fixed protocol dividend owed to every CVX holder.

The legacy Booster lets designated roles add or shut pools, update certain factories, set the treasury and change fees within code limits. cvxCRV staker fees can be 10–15%, CVX staker fees 3–6%, treasury 0–2% and caller 0.1–1%, with 20% as the aggregate ceiling.

OpenZeppelin disclosed that the old architecture could have let two of three anonymous multisig signers obtain unrestricted LP access, contradicting the public control description. Convex patched the path on 14 December 2021; the independent report says no funds were lost.

In June 2022, attackers instead hijacked DNS and served a cloned interface asking for malicious approvals. Convex's post-mortem promised treasury compensation in CVX equivalent for identified losses. Contract control and website trust had failed on different layers.

Convex later published a ConvexCore and VotingRegistry architecture in which governance authorizes operators to execute calls across supported voting systems. That makes authority more legible in code, but a holder still has to verify live owners, operators, proxies and reward distributors for the exact deployment being used.