Emergency DAO Proxy Upgrade

Proposals
1

Summary

yRisk recommends this migration as part of its risk mandate. It extends Curve’s Emergency DAO (eDAO) coverage to LLv2 and selected AMM factories, narrows some LLv1 powers, and adds targeted emergency calls.

This is not the final set of eDAO permissions. Further updates may follow as Curve expands to new chains.

Motivation

Curve’s current eDAO proxies predate LLv2, leaving eDAO without direct access to its policy, cap, admin, and deployment controls during an emergency. The new proxies add these controls while the Curve DAO retains full admin control through execute.

Specification

On Ethereum:

  • Deploy one immutable proxy for LLv1/crvUSD, LLv2 and the LM Callback factory.
  • Deploy one immutable proxy for Stable-NG, Tricrypto-NG and TwoCrypto-NG.
  • Transfer admin of the two zkBTC oracles separately.

On L2s and sidechains:

  • Deploy the same lending proxy contract on Optimism for LLv2.
  • Deploy one child-gauge proxy per eligible chain and make it admin of the DAO-owned factory.
Permission Proxy Calls Effect
Keep:
Existing permissions		 AMM
Lending		 emergency_parameters
set_callback, set_monetary_policy, reduce_debt_ceiling, remove_emergency		 No change
Remove:
LLv1 fee setters		 Lending set_amm_fee, set_admin_fee eDAO loses these calls
Narrow:
LLv1 discounts		 Lending set_borrowing_discounts → increase_loan_discount Loan discount can be raised only; no access to liquidation discount
Add:
LLv2 policy and callback		 Lending set_v2_monetary_policy, set_v2_callback Replace policy or callback
Add:
LLv2 exposure controls		 Lending increase_v2_loan_discount, set_v2_borrow_cap_zero, set_v2_max_supply_zero, remove_v2_custom_admin Raise discount, zero limits, or remove custom admin
Add:
LLv2 oracle repair		 Lending set_v2_price_oracle Replace an oracle that reverts
Add:
Deployment pauses		 Lending pause Pause new markets or callbacks
Add:
Oracle failover		 Lending set_use_chainlink Toggle Chainlink oracle paths
Add:
Gauge manager		 AMM
Lending
L2 child gauge		 set_gauge_manager Reassign reward manager; Tricrypto-NG gauges have no manager setter
Add:
Gauge kill		 AMM
Lending		 set_killed Kill Stable-NG, Tricrypto-NG, TwoCrypto-NG, LLv1 and LLv2 gauges; True only
Keep / add:
eDAO revocation		 All proxies remove_emergency Existing on mainnet lending; added elsewhere

In some cases, the proxies constrain the underlying function:

  • set_killed: always True.
  • set_v2_borrow_cap_zero, set_v2_max_supply_zero: underlying limits fixed to 0.
  • remove_v2_custom_admin: underlying admin fixed to the zero address.
  • increase_loan_discount, increase_v2_loan_discount: only raise the loan discount; liquidation discount unchanged.
  • set_v2_price_oracle: current oracle fails a bounded price() or price_w() probe; replacement returns nonzero values.
  • reduce_debt_ceiling: cannot raise the ceiling.
2 Likes
2

The hardcoded constraints in the last section cover four calls: set_killed is True only, the cap and supply calls fix the underlying limit at 0, the custom admin calls fix the admin at the zero address, and reduce_debt_ceiling cannot raise. Three of the added powers sit outside that list: set_monetary_policy, set_gauge_manager and set_use_chainlink.

set_use_chainlink is the one worth pinning down, because the table describes it as a toggle rather than a one way action. Zeroing a cap or killing a gauge stops activity, and a wrong call there is bounded and visible. Switching which path prices collateral moves the liquidation point for every open position in that market, and a toggle moves it in both directions.

Two things the specification could settle before this goes to a vote:

  1. Is set_use_chainlink intended to be one way, like set_killed, with the return path reserved to the DAO through execute? As the table reads, the eDAO holds both directions, so the oracle path for those markets becomes an eDAO decision rather than a DAO one.
  2. Which addresses receive admin of the two zkBTC oracles, and does that admin sit inside one of the new immutable proxies or stay held directly?