Convex Finance

Curve pays liquidity providers in CRV, and pays more (a boost) to those who also lock CRV as veCRV. Convex does the locking once, for everyone. When you deposit CRV into Convex it is locked forever as veCRV and you get cvxCRV 1:1 in return. The combined veCRV gives Convex a maximum boost, which it passes to anyone who stakes Curve LP tokens through it, with zero deposit and withdrawal fees (docs).

LPs on Convex earn the boosted CRV (minus the platform fee), Curve trading fees, any extra pool incentives untouched, and newly minted CVX pro-rata to the CRV they earn. The same model has been applied to Frax (veFXS, cvxFXS), f(x) Protocol (cvxFXN) and, in the past, Prisma.

Fees apply only to the CRV revenue, not to extra incentive tokens or veCRV admin fees. The multisig can move the Curve split within hard-coded ranges (10–15% cvxCRV, 3–6% CVX, 0–2% treasury, 0.1–1% caller) but never above a 20% total ceiling (fees). There is no interest rate as such: the return is Curve's pool APR plus boost, paid in tokens whose prices move.

• cvxCRV is tokenised veCRV. The CRV behind it can never be withdrawn, so the only exit is selling cvxCRV on the market, at whatever price the market sets (cvxCRV docs). Staked cvxCRV earns the 10% share of platform CRV, Curve admin fees in crvUSD and CVX.
• vlCVX is CVX locked for 16 weekly epochs. It votes Convex's veCRV on Curve gauge weights and DAO proposals, which makes vlCVX votes valuable to any protocol that wants CRV emissions pointed at its pool. Unlocked CVX left in the contract more than 4 epochs can be kicked out by anyone for a 0.25% per-epoch bounty (vote locking).

Convex has no loans, so it cannot become insolvent in the usual sense. Your Curve LP tokens sit in Curve gauges through Convex's contracts, and the docs state that the 3-of-5 multisig has no direct access to user deposits; it can pause new deposits, shut pools down (with withdrawals left open) and adjust fees within the ranges above (admin rights).

The docs also publish a known weakness: an attacker who got a fake gauge approved by a Curve DAO vote (7 days), then shut down a real Convex pool and waited out a 30-day timelock, could withdraw real LP tokens against fake deposit tokens (known issues). It is slow and public, which is the point of listing it.

The larger risk sits one layer down. When a Vyper compiler bug let attackers drain several Curve pools in July 2023, the pools themselves lost money regardless of whether LP tokens were staked directly or through Convex. The only incident DefiLlama attributes to Convex itself is a small DNS hijack of its website in June 2022.

DefiLlama counted about $603 million in Convex on 27 September 2026, with a further $114 million of staked CVX counted separately, against a peak of $21.2 billion on 5 January 2022 (DefiLlama). That still makes it one of the largest holders of veCRV and a decisive voter on Curve gauges.

Recent work has been on the Frax side: after Frax merged its FPIS token into FXS, Convex retired cvxFPIS and offers a 3-to-1 migration into cvxFXS on Fraxtal (migration guide).