For our follow up to the Swiss Stake analysis, Tulipa would like to make public the questions and answers that we were asked by Swiss Stake and provide our answers.
1. Can Tulipa offer a leaner version focused on core risk work?
We can separate the mandate into a $700,000 core package and five optional modules. The lean package uses the same scope and internal allocation presented in the original proposal.
Internal allocation of the original $1 million fee
| Service line | Total | Core risk work | Optional work |
|---|---|---|---|
| Monitoring and 24/7 on-call | $275,000 | $245,000 | $30,000 for community bots and indicator feeds |
| Reviews, parameters, economics, and scenarios | $250,000 | $185,000 | $45,000 for gauges and pool parameters; $20,000 for investigative diligence |
| Incident response | $100,000 | $70,000 | $30,000 for incident forensics |
| Reporting and governance | $100,000 | $55,000 | $45,000 for BD support |
| DAO tooling, documentation, and KPI ledger | $125,000 | $45,000 | $80,000 for public dashboards, APIs, and builder tools |
| Infrastructure, data, and integration | $150,000 | $100,000 | $50,000 for public data serving, APIs, and bots |
| Total | $1,000,000 | $700,000 | $300,000 |
Optional modules
Each optional module runs on the core data and monitoring foundation.
| Module | Included work | Annual price |
|---|---|---|
| Dashboards | Six products: Contagion Graph, Oracle Observatory, Position Explorer, Market Economics, Gauge and Emissions, and LlamaLend/earn/APR | $90,000 |
| User tools | DAO-branded alert bots, frontend risk indicators, position disclosures, a public read API, and a community dashboard builder | $70,000 |
| Investigations | Counterparty and issuer diligence plus incident forensics, engaged when triggered | $50,000 |
| Gauges and pool parameters | Gauge proposal reviews, identification of stale or extractive gauges, CRV emissions analysis, and pool parameter recommendations | $45,000 |
| BD support | Up to two asset pre-screens per month, risk-screened opportunities, and contact with relevant asset and protocol teams | $45,000 |
Available configurations
We view this engagement as the start of a long-term partnership with Curve. To reflect that, Tulipa will discount both configurations by 10% for the initial term.
| Configuration | Included work | Initial-term fee | Payment mix |
|---|---|---|---|
| Core | Core risk mandate | $630,000, discounted from $700,000 | $472,500 crvUSD and $157,500 CRV |
| Core plus Risk Tooling and Investigations | Core package, six public dashboards, and triggered investigations | $750,000, discounted from $840,000 | $562,000 crvUSD and $187,500 CRV |
Our Recommendation
We recommend the Core plus Risk Tooling and Investigations package at the discounted initial-term fee of $750,000. Its public tools, including the Contagion Graph, will be vital to how Curve monitors interconnected risk as the protocol grows. We believe this package gives Curve the strongest foundation for a durable, long-term risk function.
2. Who would work on Curve, what would each person do, and how much time would they commit?
| Contributor | Responsibilities | Commitment |
|---|---|---|
| Mandate Lead | Leads the mandate end to end: monitoring stack, assessment methodology, review and escalation sign-off, weekly Swiss Stake session. VP of Engineering at Tulipa; previously high-frequency trading infrastructure in Rust; cybersecurity professor and Web3 security educator with 1,500+ alumni. | 1.0 FTE |
| Senior Engineer, planned addition | Second engineer on the monitoring stack and alert pipeline, joining at award from one of DeFi’s largest protocols; five years of systems engineering at Intel, crypto-native since 2018. Identity disclosed privately via Swiss Stake before any payment flows. | Planned: 1.0 FTE |
| Quantitative Analyst, planned addition | Supports risk modeling and market analytics. | Planned: 1.0 FTE |
| Vault Strategy | Leads per-market fee and yield analysis, revenue-sustainability scoring, risk-economics assessment inputs, and LlamaLend, earn, and APR coverage. DeFi Vault Strategist at Tulipa. | 0.8 FTE |
| Vault Strategy | Risk market management and mint/redeem functions of crvUSD and LlamaLend; eight years of prior experience in banking focused primarily on business performance and analysis. | 0.5 FTE |
| Founder | Partner and ecosystem relations, mandate oversight. Tulipa founder; co-founder and former CFO of ARK Ecosystem; led Protokol as CEO for six years. Extra weight during the first months. | 0.2 FTE |
| Chief Investment Officer | Advises on asset and issuer quality and ecosystem relations. Four years of DeFi BD, formerly at Gearbox; now CEO of Syntetika, where Tulipa is a strategic partner. | Advisor |
| Private Investigator | Supports protocol dependency mapping, issuer diligence, AML review, onchain tracing, and incident forensics using Chainalysis and OSINT. | 0.5 FTE |
At start, core staffing would total 4 FTE and increase to 5 FTE after the quantitative analyst joins.
Automation handles alert triage, governance-proposal intake, investigation legwork, and report drafting. It runs on Tulipa’s own in-house LLM infrastructure rather than third-party APIs. This means every alert and proposal gets processed, not sampled; coverage is never limited by outside rate limits or per-query costs; and sensitive material never leaves Tulipa’s systems. Every validation, recommendation, and escalation remains a human decision.
Coverage is 24/7. Automated detection and prioritization run around the clock, and the validation rotation provides primary and backup on-call coverage at all hours, so no escalation depends on one person. Named alert recipients, escalation contacts, and severity owners will be agreed with the eDAO and Swiss Stake in Month 1.
3. What comparable risk-provider work has the proposed team completed?
Our record is primarily operational. We have managed risk for our own capital and third-party capital for six years.
Tulipa’s proprietary record
The strategies that became Tulipa have operated across BTC, ETH, stablecoins, and major DeFi protocols since 2020. Across that period, the portfolio has realized two losses, both disclosed: Euler v1 and Maple v1. The combined loss was under 0.01% of portfolio capital, which equated to ~2 weeks of yield allowing the quarter to still end positive.
This does not mean the process prevents every loss. It shows a six-year operating record through multiple DeFi market cycles, with losses identified rather than omitted.
Managed vaults
Since the public launch in 2024, Tulipa vaults have reached peak AUM of approximately $500 million. Current AUM is $43 million across vaults on Lagoon and Ember.
RockSolid
Tulipa is the main curator for RockSolid, supporting the protocol across strategy, risk, and market coverage on an ongoing basis. This work requires continuing risk review rather than a one-time report.
- Official Mandate: RockSolid’s rETH Vault maximizes rETH-based returns by allocating it across DeFi protocols like AAVE and Morpho. Our asset manager constantly monitors funding rates and DeFi opportunities to ensure maximum performance. Additionally, rETH deposits are used to negotiate new deals for depositors. The vault may deploy assets across mainnet and L2s. An allocation towards to rETH looping is kept whenever funding rates are positive.
Kelp Gain
Tulipa ran Kelp Gain from August 2024 through August 2025. The strategy reached peak AUM of $250 million and recorded no losses.
Giddy YieldBasis Vault Incident
On April 23, 2026, Tulipa detected an incident involving a vault from Giddy DeFi that had YieldBasis as a part of its strategy. It was not an attack on YieldBasis contracts. Tulipa alerted the YieldBasis team, identified a custom contract draining approximately $1.25 million of wrapped BTC from three individual vaults, confirmed that YieldBasis core contracts were unaffected, and published a public notice.
4. How often does the system check the data, and how long could an onchain event take to reach a human?
All risk-relevant data is tracked block by block. When a transaction lands onchain, it is processed by our system at max within two minutes. Critical alerts are answered by a human within a maximum of 30 minutes after the notification, the reference point is transaction confirmation plus two minutes, so the worst case from onchain inclusion to a validated human response is 32 minutes. The 30 minutes is a ceiling, not a target.
The public KPI ledger will record the trigger time, page time, and escalation time for each critical alert, so the DAO can verify actual response times, including the median, against these bounds.
5. How would Tulipa handle conflicts involving its Curve and YieldBasis positions?
Tulipa does not believe its Curve or YieldBasis positions create a conflict of interest. Tulipa, its LPs, Curve, and YieldBasis all benefit from the same long-term outcome: healthy markets, sustainable liquidity, and continued protocol growth.
Where returns conflict with the health or growth of a position or pool, Tulipa will prioritize long-term safety and sustainable growth. Recommendations will favor sound parameters over yield that creates avoidable risk and drives growth.
Tulipa will make recommendations using the same data, methodology, and risk standards applied across the mandate. We will state when Tulipa has relevant economic exposure but will not disclose specific positions or position sizes. Each recommendation will explain the expected impact on Curve DAO, the protocol, and LPs.