Question
Provide a concise narrative that clearly states each of (a)–(e) below.
Response
Convex Finance solves the capital and governance inefficiency of the Curve Finance vote escrow model. Curve pays its highest CRV rewards to liquidity providers who lock CRV as veCRV for up to four years, which forces small providers to choose between illiquid multi-year locks and materially lower yields. Convex pools CRV from many depositors into a single protocol owned veCRV position and passes the resulting boost to every depositor, so a liquidity provider earns boosted CRV rewards without locking anything and without running their own veCRV position. Convex applies the same model to Frax Finance through cvxFXS and to FX Protocol through cvxFXN.
(Source: Convex Docs, Understanding CVX, Tokenomics)
Convex operates as an immutable deployed protocol rather than an actively roadmapped product. Its published operating priorities are maintaining the Curve, Frax, and FX Protocol integrations, running the biweekly gauge weight vote cycle through Snapshot, distributing protocol fees to cvxCRV stakers and vote locked CVX holders, maintaining sidechain deployments on Arbitrum and Polygon, and funding security work through the audit programme and the bug bounty.
(Source: Voting and Gauge Weights, Fees, Contract Addresses, Bug Bounties)
Convex Finance is a yield and governance aggregation protocol deployed on Ethereum mainnet with sidechain deployments on Arbitrum and Polygon. Curve liquidity providers stake their LP tokens into the Convex Booster contract at 0xF403C135812408BFbE8713b5A23a04b3D48AAE31, which routes them through the Convex Voter Proxy at 0x989AEb4d175e16225E39E87d0D97A3360524AD80 and earns boosted CRV. CRV depositors receive cvxCRV, a liquid tokenised claim on the protocol's permanently locked veCRV position. CVX holders lock their tokens for sixteen weeks or more to receive vlCVX, which directs the protocol's veCRV and veFXS gauge weight votes and earns a share of protocol fees. Governance runs through Snapshot at cvx.eth, and the Convex multisig signs to establish the outcome of every CVX Snapshot vote onchain.
CVX is the native platform token of Convex Finance. Staked CVX earns a share of the CRV and FXS that Convex collects from Curve and Frax liquidity providers, delivered as cvxCRV and cvxFXS after Convex locks the underlying as veCRV and veFXS. CVX locked for sixteen weeks or longer becomes vlCVX, which votes on Convex governance proposals through Snapshot, directs Convex's veCRV and veFXS gauge weight votes, and earns additional fees from Frax Finance liquidity providers. CVX is minted pro rata for every CRV token that Curve liquidity providers claim on Convex, and the CVX to CRV mint ratio reduces every 100,000 CVX minted.
(Source: Understanding CVX, Tokenomics, Vote Locking, Fees)
Convex concentrates administrative control in a single 3 of 5 multisig at 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB. That multisig updates the stash factory and pool manager, controls the arbitrator vault, adjusts fees within hard coded ranges, sets the treasury address, controls the Convex Treasury Account holding 9.7 percent of supply, votes Curve DAO proposals and gauge weights, manages Master Chef distribution weights, pauses new deposits while leaving withdrawals open, applies new operators on the whitelisted proxy, manages vlCVX rewards and boost parameters, and shuts down the vlCVX contract with immediate withdrawals enabled. The documentation states that admin controls hold no access to user funds and that the multisig holds no direct access to user deposits. The multisig is also required to sign the outcome of every CVX Snapshot vote, so vlCVX voting is advisory at the execution layer.
Question
For each existing entity: Labs/DevCo (e.g., Founder, CEO, CTO, COO), Foundation (e.g., President, Executive Director, CFO, COO), and DAO / onchain governance leadership (if applicable) list the: (a) full names, (b) official titles, (c) and prior experience of key team members. For any non-existent entity, explicitly mention it does not exist. External links may be included but they will not factor into the score.
Response
Full Name | Entity | Official Title | Prior Experience |
|---|---|---|---|
C2tP | Labs | Co-founder, Convex Finance | Pseudonymous. Serves on the Convex multisig and represents Convex Finance in protocol governance across Curve, Frax, and FX Protocol. No legal name, employment history, or jurisdiction is publicly disclosed. |
Winthorpe | Labs | Co-founder, Convex Finance | Pseudonymous. Serves on the Convex multisig and works on Convex smart contract development. No legal name, employment history, or jurisdiction is publicly disclosed. |
Convex Finance operates no foundation entity. No non-profit, association, or foundation has been incorporated or announced for the protocol, and the documentation names no such body. | Foundation | ||
C2tP | DAO | Convex multisig signer, Convex Finance | Pseudonymous Convex Finance co-founder. |
Winthorpe | DAO | Convex multisig signer, Convex Finance | Pseudonymous Convex Finance co-founder. |
Benny | DAO | Convex multisig signer, Llama Airforce | Operates Llama Airforce, the bribe and reward dashboard used across the Curve and Convex ecosystem. |
Tommy | DAO | Convex multisig signer, Votium | Operates Votium, the incentive marketplace through which vlCVX holders sell their gauge weight votes. |
Sam | DAO | Convex multisig signer, Frax Finance | Represents Frax Finance, whose gauge system Convex integrates through cvxFXS. |
Blockworks note: Convex Finance operates without a publicly identified legal entity. The founders remain pseudonymous, and public profiles of the protocol record that the heads of Convex Finance are not known. No incorporation record, registered address, or jurisdiction has been published for a Convex development company. |
Question
Provide a structured description of the DAO's governance, powers, and economic rights. If a DAO does not exist, state so. Address the lettered items below. Even if there is no DAO, there must be an answer to (d).
Response
No DAO entity holds Convex intellectual property. The protocol publishes its contract source under the convex-eth GitHub organisation across the platform, frax-cvx-platform, and sidechain-platform repositories, and the audit reports live in those same repositories. No trademark filing, brand registration, domain assignment, or subsidiary has been attributed to a Convex DAO, and no legal wrapper exists to hold such assets.
(Source: Audits, Convex Docs, Cypherhunter Convex Finance)
Convex governance holds no direct contract or administrative power. Every administrative function sits with the 3 of 5 multisig at 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB, which updates the stash factory and pool manager, controls the arbitrator vault, sets fees within hard coded ranges, sets the treasury address and allocates up to 2 percent of platform fees, controls the treasury account, casts Curve DAO and gauge weight votes, manages Master Chef distribution weights, pauses new deposits while leaving withdrawals open, applies new operators on the whitelisted proxy, manages vlCVX rewards, distributors, staking ratios, boost parameters, kick incentives, and token recovery, and shuts down the vlCVX contract. vlCVX holders vote through Snapshot, and the multisig executes those outcomes onchain. The documentation states that admin controls hold no access to user funds and that the multisig holds no direct access to user deposits.
(Source: Multisig Admin Rights, Voting and Gauge Weights, Contract Addresses)
CVX locked in the CVX Locker at 0x72a19342e8F1838460eBFCCEf09F6585e32db86E becomes vlCVX and carries defined rights. vlCVX votes on Convex governance proposals through Snapshot, directs the protocol's veCRV and veFXS gauge weight votes, earns a share of protocol fees, and receives additional fees from Frax Finance liquidity providers. Locks run a minimum of sixteen weeks and are grouped into weekly epochs starting Thursday at 00:00 UTC. Tokens auto unlock after sixteen full epochs but stay in the locker until the holder withdraws, and after a four epoch grace period any third party kicks idle CVX out for a 0.25 percent bounty per epoch elapsed. Holders delegate their vlCVX voting power to another address without transferring the tokens.
(Source: Vote Locking, Understanding CVX, CVX Vote Delegation, Contract Addresses)
CVX accrues value from the protocol fee stack. Convex charges 17 percent on Curve earnings, split as 10 percent to cvxCRV stakers paid in CRV, 4.5 percent to CVX stakers paid in cvxCRV, 2 percent to the treasury in CRV, and 0.5 percent to the harvest caller in CRV. Frax earnings carry a 20 percent charge, split as 10 percent to cvxFXS liquidity providers in FXS, 5 percent to vlCVX holders in FXS, and 5 percent to the treasury. FX Protocol routes 75 percent of revenue to cvxFXN stakers and 25 percent to the treasury, with boosted liquidity providers charged 8.5 percent to stakers and 8.5 percent to the treasury. Fee parameters are bounded in the contracts, with Curve ranges of 10 to 15 percent for cvxCRV stakers, 3 to 6 percent for CVX stakers, 0 to 2 percent for the treasury, and 0.1 to 1.0 percent for the caller, under an absolute 20 percent ceiling. Beyond fee share and gauge weight direction, CVX confers no claim on protocol assets and no redemption right.
(Source: Fees, Understanding CVX, Multisig Admin Rights)
Convex publishes no dissolution or wind down procedure and no asset distribution authority for a DAO. The closest published mechanism is the multisig shutdown power. The multisig pauses new deposits while leaving withdrawals open, and it shuts down the vlCVX contract in a way that allows immediate withdrawal of locked CVX. Neither action distributes protocol assets, and no vlCVX vote triggers either one.
(Source: Multisig Admin Rights, Known Issues)
Question
For the Primary Foundation do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist.
Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
Response
Convex Finance operates no foundation entity. No non-profit, association, stiftung, or foundation company has been incorporated or announced for the protocol, and the Convex documentation names no such body anywhere in its governance, treasury, or administration pages.
(Source: Convex Docs, Multisig Admin Rights, Convex Treasury)
No foundation exists, so no foundation holds Convex intellectual property. Contract source and audit reports sit in the public convex-eth GitHub repositories.
(Source: Audits, Convex Docs)
No foundation exists, so no foundation holds power over governance, the treasury, protocol controlled resources, or token administration. The 3 of 5 Convex multisig governs the treasury account and every administrative parameter.
(Source: Convex Treasury, Multisig Admin Rights)
No foundation exists, so no foundation holds power over any development entity. Convex has no publicly identified legal entity of any kind.
(Source: Cypherhunter Convex Finance, Multisig Admin Rights)
No foundation exists, so no foundation holds pause, upgrade, or executor authority over Convex contracts. Those powers sit with the multisig at 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB.
(Source: Multisig Admin Rights, Contract Addresses)
No foundation exists, so no foundation receives token allocations, fee share, or protocol distributions. Protocol fees route to cvxCRV stakers, CVX stakers, vlCVX holders, the harvest caller, and the treasury account controlled by the multisig.
(Source: Fees, Convex Treasury)
Question
For the Primary DevCo do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist.
Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
Response
Convex Finance operates without a publicly identified legal entity. The protocol was launched in May 2021 by pseudonymous founders known as C2tP and Winthorpe, and public profiles of the protocol state that the heads of Convex Finance are not known. No company registration, jurisdiction of incorporation, registered address, or corporate officer has been published for a Convex development company, and the documentation refers to the operating group only as the Convex Team.
(Source: Cypherhunter Convex Finance, RootData C2tP, Cypherhunter Winthorpe, Convex Treasury)
No legal entity is identified to hold Convex intellectual property. Contract source is published in the public convex-eth GitHub organisation across the platform, frax-cvx-platform, and sidechain-platform repositories, together with all seven audit reports. No trademark filing, registered brand, or subsidiary has been publicly attributed to Convex Finance.
(Source: Audits, Convex Docs, Cypherhunter Convex Finance)
The Convex Team exercises effective control through its seats on the 3 of 5 multisig, where C2tP and Winthorpe hold two of the five keys alongside Benny of Llama Airforce, Tommy of Votium, and Sam of Frax Finance. The multisig controls the Convex Treasury Account at 0x1389388d01708118b497f59521f6943Be2541bb7, which holds 9.7 percent of total CVX supply, and the documentation states that use of treasury funds is currently at the discretion of the Convex Team. The multisig also sets fee parameters within hard coded ranges, allocates up to 2 percent of platform fees to the treasury address, manages Master Chef distribution weights, and signs the outcome of every CVX Snapshot vote.
(Source: Multisig Admin Rights, Convex Treasury, Contract Addresses, Voting and Gauge Weights)
Convex operates no foundation, so no development entity holds power over one.
(Source: Convex Docs, Convex Treasury)
Contract and administrative powers run through the 3 of 5 multisig at 0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB and the Booster Owner contract at 0x3cE6408F923326f81A7D7929952947748180f1E6. Those powers cover the stash factory, the pool manager, the arbitrator vault, fee parameters, the treasury address, Curve DAO and gauge weight voting, Master Chef distribution weights, pausing new deposits while leaving withdrawals open, applying new operators on the whitelisted proxy, vlCVX rewards, distributors, staking ratios, boost parameters, kick incentives, token recovery, and shutdown of the vlCVX contract with immediate withdrawals. The documentation states that admin controls hold no access to user funds.
(Source: Multisig Admin Rights, Contract Addresses)
The Convex Team allocation is 10 percent of total supply, vested over one year from launch, and the investor allocation is 3.3 percent on the same one year vest. The treasury holds 9.7 percent of supply, also vested over one year, and the documentation states that the treasury exists for awarding or incentivising actions, tokens, people, and platforms deemed to have a positive influence on the well being of the Convex Finance platform, with use currently at the discretion of the Convex Team. Ongoing revenue to the treasury runs at 2 percent of Curve earnings, 5 percent of Frax earnings, 25 percent of FX Protocol revenue, and 8.5 percent from FX Protocol boosted liquidity providers. Convex publishes no salary, distribution, or profit sharing policy for the team beyond those allocations.
(Source: Tokenomics, Convex Treasury, Fees)
Blockworks note: Public sources refer to a Convex Team, but the cited sources do not disclose a separately named DevCo legal entity, its jurisdiction, or the requested nonpublic control and economic-arrangement details. Convex Treasury Convex Finance: Pre-Launch Announcement
Question
Disclose launch and initial supply details in a single initial allocation schedule covering the token's launch.
Response
Maximum supply of CVX is 100,000,000 tokens. CVX was not fully minted at launch. Instead CVX is minted pro rata for each CRV token that Curve liquidity providers claim on Convex, and the CVX to CRV mint ratio reduces every 100,000 CVX minted, so supply issues over time in proportion to protocol usage. Two allocations were claimable immediately at launch, the 1 percent veCRV holder airdrop and the 1 percent veCRV whitelist voter airdrop, together 2,000,000 CVX. As of 27 July 2026 total supply stands at 99,982,000 CVX and circulating supply at 99,978,000 CVX, so the emission curve is effectively complete.
(Source: Tokenomics, Understanding CVX, CoinGecko)
Convex held no public sale and set no offering price for CVX. The two airdrop allocations were distributed free of charge to qualifying veCRV holders, and the 75 percent of supply routed to Curve liquidity provider rewards and liquidity mining is earned rather than purchased. Convex has not disclosed a price per token for the 3.3 percent investor allocation. (Source: Contract Addresses, Etherscan CVX Token, CoinGecko)
CVX. The token contract sits on Ethereum mainnet at 0x4e3FBD56CD56c3e72c1403e103b45Db9da5B9D2B. (Source: Tokenomics, Understanding CVX, CoinGecko)
Maximum supply is hard capped at 100,000,000 CVX with no inflation mechanism beyond that cap and no burn mechanism. Issuance is demand driven rather than time scheduled. CVX mints pro rata against each CRV token claimed by Curve liquidity providers on Convex, and the mint ratio steps down every 100,000 CVX minted, which produces a decaying emission curve that asymptotes toward the cap. Total supply reached 99,982,000 CVX by 27 July 2026, leaving roughly 18,000 CVX of the cap unminted. (Source: Tokenomics, Understanding CVX, CoinGecko)
Question
Address each of the following sub-items based on the project's airdrop status. If a sub-item does not apply to the project's situation, state that explicitly.
Response
Planned but not yet executed airdrop: Not applicable. The Convex launch airdrop has been executed.
Executed airdrop: Per-address source: Convex publishes a per-address allocation file in its GitHub repository at userconvex_final_formatted.json. The file is a JSON object mapping Ethereum addresses to CVX allocation amounts denominated to 18 decimals. The claim process and the link to the allocation list are documented at Claiming your Airdrop.
Covered user segments and allocation method: The launch airdrop covered veCRV holders as of block 12296676 and veCRV holders who voted to whitelist Convex on Curve. Allocation amounts per address are published in the GitHub JSON file. (Claiming your Airdrop)
Question
Projects must disclose all material terms of market-making arrangements that affect token liquidity. If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. For each market maker, include in a table:
If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. If no native tokens were loaned or allocated to market makers, state that explicitly; cash/fiat retainers or fees are not required for this item.
Response
Blockworks note: Convex Finance engaged no market maker for CVX. The protocol held no public sale, listed no token through an exchange partnership, and allocated no portion of supply to liquidity provision or market making. The full 100,000,000 CVX supply routes to Curve liquidity provider rewards at 50 percent, liquidity mining at 25 percent, the team at 10 percent, the treasury at 9.7 percent, investors at 3.3 percent, and the two airdrops at 2 percent combined, with no liquidity bucket among them. CVX liquidity formed organically on decentralised exchanges and through the protocol's own Curve pools. Convex has disclosed no token loan, option agreement, or market maker counterparty at any point since the May 2021 launch. (Source: Tokenomics, Understanding CVX, Convex Docs)
Question
Projects must disclose all material terms of centralized or decentralized exchange listings that affect token liquidity. For each listing, include in a table:
If the project has no agreements or deals with CEX or DEX, state that explicitly; doing so earns full credit; cash/fiat fee amounts are not required for this item.
Response
Blockworks note: Convex Finance pursued no exchange listing programme and disclosed no listing agreement, token commitment, or listing fee for CVX. The documentation names three ways to acquire CVX, which are purchasing on a decentralised exchange, earning it as a CRV staker or Curve liquidity provider on Convex, and claiming the launch airdrop. CVX trades on centralised venues that listed it independently, and the protocol allocated no supply to any of them. Primary onchain liquidity sits on Ethereum mainnet decentralised exchanges, and the token is also deployed on Arbitrum and Polygon through the Convex sidechain platform.
(Source: Understanding CVX, Tokenomics, Contract Addresses, CoinGecko)
Question
Disclose all prior token sales by the Project — including fundraising rounds, any material OTC sales to investors, and any discounted market-maker sales. For each sale, provide:
If no prior sales occurred, state that explicitly (e.g., "No prior fundraising, OTC, or discounted MM sales have occurred.").
Response
Blockworks note: Convex Finance conducted no public token sale, no initial exchange offering, and no launchpad round. The tokenomics disclose a single investor allocation of 3.3 percent of total supply, 3,300,000 CVX, vested over one year from the May 2021 launch. Convex has not published the identity of those investors, the price paid, the date of the sale, or the terms of the instrument used. No SAFT, token warrant, or purchase agreement has been made public. (Source: Tokenomics, Contract Addresses)
Question
If any, list prior exploits or incidents that directly affected the token, token supply, tokenholder balances, token contract, minting controls, burn mechanics, or custody of token supply. This question is not asking about general protocol, application, or smart contract exploits unless the incident directly affected the native token itself.
If no prior incidents, state this explicitly (e.g., "No exploits affecting tokenholders or protocol funds as of YYYY-MM-DD").
Response
The attack ran from 20 June 2022 to 23 June 2022 and affected the convexfinance.com domain name system records held at the registrar NameCheap. The Convex smart contracts, the treasury, and the vlCVX locker were not touched.
A NameCheap customer support agent altered the domain's DNS records without authorisation, defeating both two factor authentication and a strong account password. The hijacked records pointed convexfinance.com at a copy of the Convex website containing malicious contracts. The attacker generated contract addresses that mimicked the first four and last four characters of the legitimate Convex addresses, so users performing an abbreviated address check approved token allowances to attacker controlled contracts.
Forty addresses approved the malicious contracts. Three of those forty lost funds. Total losses were 15,968 cvxCRV and 433 CRV.
@alexintosh and @samczsun reported the hijack on 23 June 2022. Convex regained control of the domain on 24 June 2022, moved it to a new registrar, and deployed multiple layers of DNS monitoring. Convex instructed all affected users to revoke the malicious approvals through Etherscan or revoke.cash and confirmed revocation before compensating. Compensation was paid from the treasury in CVX valued at the United States dollar value of each loss at the time it occurred, sent directly to the affected addresses.
The incident is closed and all three affected addresses were compensated. Convex maintains a seven audit programme covering MixBytes in April 2021 on the core platform, PeckShield in April 2022 on the Frax staking platform, PeckShield in September 2022 on the staking wrapper, PeckShield in November 2022 on the sidechain platform, Nomoi in January 2023 on the cvxCRV staking wrapper, Nomoi in January 2023 on the sidechain platform, and ChainSecurity in April 2023 on the Silo Finance Curve and Convex feature. Convex runs a bug bounty with a maximum payout of 250,000 dollars scaled across likelihood and severity from 1,000 dollars upward, reported to contact@convexfinance.com. The documentation discloses one known unmitigated weakness, a fake gauge and fake pool path against the shutdown system that requires an attacker to pass a Curve DAO proposal undetected through a seven day vote, manipulate gauge weight, shut down legitimate pools, create fake gauge pools, loop deposits and withdrawals, trigger emergency shutdown, and exploit the 30 day timelock. Convex treats that path as mitigated by its complexity, its visibility, the waiting periods involved, and the multiple shutdown mechanisms in place.
Question
Describe material risk factors across the three categories below. Each category includes prompts to address at a minimum.
(a) Regulatory, Legal & Tax Risks — Describe how evolving laws and regulations could affect the project by answering, at a minimum, questions like:
Impact of Regulatory Change on TGE and Listings: (If applicable) How could evolving or conflicting laws and regulations affect your ability to complete the TGE, deliver tokens to purchasers, and list or maintain the token on trading venues in key jurisdictions?
Entity-Level Regulatory Impact: (If applicable) How could regulatory or legal changes impact your core entities (Foundation, DevCo, DAO, affiliated service providers), including enforcement actions, licensing requirements, or forced changes to structure or operations?
Tokenholder Tax Treatment: (If applicable) What uncertainties exist around how tokenholders may be taxed, and make clear that tokenholders are responsible for understanding their own tax obligations?
Jurisdictional & User Access Restrictions: (If applicable) If the project restricts access for certain jurisdictions or user types (e.g., U.S. persons, sanctioned countries, retail vs. professional), what are those restrictions and what risks do they create for users and for the project?
(b) Protocol, Technology & Security Risks — Describe risks to network and contract reliability, correctness, and safety by answering, at a minimum, questions like:
Bugs and Design Flaws: (If applicable) What bugs, design flaws, or implementation errors could exist in your core protocol code, smart contracts, and any bridges, rollups, or oracles that you depend on, and how could these lead to loss of funds or disruption of the protocol?
Security Measures & Their Limitations: (If applicable) What security measures have you taken (audits, formal verification, bug bounties), and what types of failures might these measures still fail to detect or prevent?
(c) Token Economics, Unlocks & Incentive Risks — Describe how the token's economic design and supply schedule could affect holders by answering, at a minimum, questions like:
Critical Economic Assumptions: (If applicable) Which economic assumptions (e.g., staking yields, fee revenue, liquidity incentives, MEV capture, demand for blockspace) are critical for protocol security, utility, and governance, and what happens if those assumptions fail?
Question
Identify to the best of your ability the token's current deployments across chains, including project-issued deployments, project-endorsed representations, and, if possible, documented third-party wrapped or bridged representations.
For each entry, provide:
Multiple entries on the same chain are permitted.
Definition: A protocol-level asset is an asset whose balances and transfers are handled directly by the blockchain's core rules, rather than by a token smart contract. For protocol-level assets without a token contract address, enter "No contract address" and identify the asset and chain.
Response
This Token Transparency Filing is provided for general informational purposes only and does not verify or warrant the accuracy of individual answers.
No airdrop planned or conducted: Not applicable. Convex has conducted an airdrop.
(Source: DNS Hijack Post-Mortem, Audits, Bug Bounties, Known Issues)
Blockworks note: Convex Finance suffered one security incident affecting users, a DNS hijack of the convexfinance.com domain in June 2022. No Convex smart contract has been exploited.
Governance Control over Monetary Policy & Rewards: (If applicable) To what extent can governance change monetary policy, fee parameters, or reward allocations (e.g., inflation rate, treasury flows, incentive programs), and how could such changes adversely affect tokenholders?
Response
Convex Finance carries an unusually high level of regulatory and legal risk because no legal entity stands behind it. The protocol was launched in May 2021 by pseudonymous founders known as C2tP and Winthorpe, public profiles record that the heads of Convex Finance are not known, and no incorporation record, jurisdiction, registered address, or corporate officer has ever been published. Convex has produced no legal opinion on the status of CVX in any jurisdiction, no MiCAR white paper for European Union distribution, no terms of service governing tokenholders, and no tax guidance. Tokenholders therefore hold no identified counterparty to sue, no governing law clause, no forum selection, and no dispute resolution path. Regulatory action against the protocol, its founders, or the multisig signers would leave holders without recourse and without an entity able to respond.
Token classification risk is unresolved and untested. CVX carries governance rights over the protocol's veCRV and veFXS gauge weight votes and a direct claim on a defined share of protocol fees, at 4.5 percent of Curve earnings to CVX stakers and 5 percent of Frax earnings to vlCVX holders. Regulators assessing those fee entitlements against securities frameworks in the United States, the European Union, or elsewhere would reach a different conclusion from the protocol's silence on the point. Convex distributed 2 percent of supply through airdrops and sold 3.3 percent to undisclosed investors on undisclosed terms, neither of which has been publicly analysed against any offering exemption. The multisig signers are identified only by pseudonym and by affiliation to Llama Airforce, Votium, and Frax Finance, which exposes those named counterparties to regulatory attention that Convex itself is structured to avoid. Tax treatment of vlCVX fee income, cvxCRV rewards, Votium bribe income, and airdrop receipts is determined entirely by each holder's own jurisdiction, and Convex publishes nothing on the subject.
Convex holds a large and permanently locked veCRV position on behalf of depositors and layers integrations with Curve, Frax Finance, and FX Protocol on top of it. The documentation states plainly that there is a non zero chance of losing some or all deposited funds, that smart contract risk is inherent to decentralised finance, and that users are beholden to any risk that pertains to the Curve and Frax platforms because Convex integrates directly with them. That dependency is structural. A failure in Curve's gauge system, the veCRV contract, or the Frax gauge system propagates directly into Convex deposits, and Convex holds no ability to unwind its locked veCRV position in response.
Security coverage is broad but not complete. Seven audits cover the platform, with MixBytes reviewing the core platform in April 2021, PeckShield reviewing the Frax staking platform in April 2022, the staking wrapper in September 2022, and the sidechain platform in November 2022, Nomoi reviewing the cvxCRV staking wrapper and the sidechain platform in January 2023, and ChainSecurity reviewing the Silo Finance Curve and Convex feature in April 2023. A bug bounty pays up to 250,000 dollars. Against that, Convex publicly discloses one unmitigated weakness, a fake gauge and fake pool path against the shutdown system that Convex treats as impractical rather than impossible, relying on the seven day Curve DAO vote period, the 30 day timelock, visibility, and multiple shutdown mechanisms as the barrier. Operational security has already failed once. The June 2022 DNS hijack of convexfinance.com succeeded through a registrar support agent despite two factor authentication and a strong password, cost three users 15,968 cvxCRV and 433 CRV, and demonstrated that the perimeter outside the contracts is the weaker one. Administrative concentration compounds this. A 3 of 5 multisig sets fee parameters, controls the treasury, applies new operators on the whitelisted proxy, casts all Curve DAO votes, and shuts down the vlCVX contract, and three compromised keys reach every one of those functions even though the documentation confirms the multisig holds no direct access to user deposits.
CVX supply is effectively fully diluted. Maximum supply is capped at 100,000,000 tokens, total supply reached 99,982,000 by 27 July 2026, and circulating supply reached 99,978,000, so no unlock overhang remains and the demand driven mint that pays Curve liquidity providers has almost exhausted its budget. That removes dilution risk and removes the primary incentive lever at the same time. Convex minted CVX pro rata against CRV claimed on the platform, with the mint ratio stepping down every 100,000 CVX, and that emission is now spent. Curve liquidity providers depositing on Convex from here receive boosted CRV and fee share but almost no new CVX, which weakens the acquisition mechanism that built the protocol's veCRV position in the first place.
The demand side has deteriorated sharply. CVX trades at 1.34 dollars on 27 July 2026 for a market capitalisation of 133.97 million dollars against 8.13 million dollars of daily volume, 97.8 percent below the all time high of 60.09 dollars set on 1 January 2022 and within 29 percent of the all time low of 1.04 dollars set on 1 July 2026. Vote locking requires a sixteen week minimum commitment with auto unlock only after sixteen full epochs and a 0.25 percent per epoch kick bounty on idle locks after a four epoch grace period, so holders take real illiquidity risk in a falling market to earn fee share and Votium bribe income. Both of those revenue streams scale with Curve and Frax total value locked and with third party demand for gauge weight, neither of which Convex controls. Governance offers a limited check. vlCVX votes are weighted proportionally through Snapshot, gauge votes run biweekly with a 0.05 percent threshold, and the multisig is still required to sign every outcome onchain, so vlCVX directs gauge weight but does not unilaterally execute it.
(Source: Multisig Admin Rights, Risks, Audits, Known Issues, DNS Hijack Post-Mortem, Tokenomics, Fees, Vote Locking, Voting and Gauge Weights, CoinGecko, Bug Bounties, Cypherhunter Convex Finance)
