How Does CrossCurve Work?

Bridge|Risk D+|7 mechanisms|5 interactions

A cross-chain bridge built specifically for Curve Finance pools, letting you swap stablecoins across blockchains. It raised $7M and processed $1.85B in its first year. Its D+ grade reflects a $3M hack in February 2026 caused by a missing security check that let anyone forge fake cross-chain messages.

TVL

Sector

Bridge

Risk Grade

D+

Value Grade

D-

Core Mechanisms

8.1.3

Novel

Consensus Bridge: cross-chain messages validated through Axelar, LayerZero, and EYWA Oracle Network in parallel

CrossCurve routes cross-chain transactions through multiple independent validation protocols to reduce single points of failure. However, the February 2026 exploit showed that a bypass in just the Axelar pathway (ReceiverAxelar.expressExecute) was sufficient to drain funds.

8.1.1

PortalV2: lock-and-mint bridge contract holding cross-chain liquidity across Ethereum, Arbitrum, Optimism, BSC, Polygon

Standard lock-and-mint pattern where tokens are locked on the source chain and minted/unlocked on the destination. PortalV2 was the contract drained from ~$3M to near zero in the exploit.

4.1.3

Novel

Cross-chain Curve pool access: routes swaps through Curve's stableswap pools across multiple chains

CrossCurve provides seamless access to Curve Finance pools across chains, tapping into $2.7B+ of Curve TVL. Novel cross-chain DEX aggregation pattern built specifically for Curve ecosystem.

8.4.2

Novel

EYWA Oracle Network: proprietary oracle validators providing cross-chain state proofs

CrossCurve operates its own oracle network (inherited from EYWA Protocol rebrand) alongside Axelar and LayerZero. Custom oracle with smaller validator set than established networks.

8.4.1

Relayer fee model for cross-chain message delivery across supported chains

Standard relayer-based fee model for delivering cross-chain messages. Relayers are paid per message to facilitate bridge operations.

2.1.2

Percentage-based bridge fees on cross-chain swap volume ($1.85B annual volume)

Standard percentage fee on each cross-chain swap. Protocol generated revenue from $1.85B in trading volume in its first year.

Yield/LP-Rewards

Cross-chain yield farming: LP rewards for providing liquidity in CrossCurve-connected Curve pools

LPs earn yield from both Curve pool fees and CrossCurve bridge fees. Liquidity mining incentives to attract cross-chain liquidity providers.

How the Pieces Interact

ReceiverAxelar gateway validationPortalV2 token unlock mechanismCritical

The expressExecute function in ReceiverAxelar allowed anyone to call it with a spoofed cross-chain message, bypassing the intended Axelar gateway validation. This triggered unauthorized token unlocks on PortalV2, draining $3M across multiple chains in February 2026.

Multi-validator consensusSingle-pathway bypassHigh

Despite routing through three independent validation layers (Axelar, LayerZero, EYWA Oracle), a validation bypass in just the Axelar pathway was sufficient to drain funds. The 'consensus' model provided false security because each pathway could independently authorize unlocks.

Cross-chain liquidity poolsBridge exploit contagionHigh

CrossCurve pools are connected to Curve Finance's $2.7B TVL. A bridge exploit that manipulates token balances across chains could create imbalanced Curve pools, causing impermanent loss for uninvolved LPs in connected Curve pools.

EYWA Oracle NetworkAxelar/LayerZero dependenciesMedium

CrossCurve depends on three separate oracle/messaging networks with different security models and trust assumptions. A compromise of any single network is sufficient to forge messages, and coordinating security patches across three protocols is operationally complex.

SafeHarbor bounty policyExploit recoveryMedium

The 10% bounty offered post-exploit relies on attacker cooperation. If the attacker launders funds through mixers (as commonly occurs), the protocol has no recovery mechanism. The CEO identified 10 Ethereum addresses but has no enforcement power.

What Could Go Wrong

  1. Exploited for $3M in February 2026 via spoofed cross-chain messages bypassing gateway validation in the ReceiverAxelar contract
  2. Multi-validator consensus bridge (Axelar + LayerZero + EYWA Oracle) had a missing validation check that allowed unauthorized token unlocks from PortalV2
  3. Cross-chain message validation is inherently complex; the protocol routes through three independent validation layers but a single bypass in one layer was sufficient to drain funds

Consensus Bridge Validator Collusion

Moderate

Trigger: Attackers compromise or collude with a sufficient subset of CrossCurve's multi-validator consensus bridge (Axelar + LayerZero + EYWA Oracle) to forge cross-chain messages at will

  1. 1.Attacker identifies that the ReceiverAxelar contract's expressExecute function can be called with spoofed messages that bypass gateway validation (as demonstrated in Feb 2026 exploit) Unauthorized token unlocks drain the PortalV2 contract across multiple chains simultaneously
  2. 2.Exploited validation bypass is replicated across all chains where CrossCurve operates (Ethereum, Arbitrum, Optimism, BSC, Polygon) Total protocol TVL is drained as the same exploit pattern works on each chain's PortalV2 deployment
  3. 3.Curve Finance liquidity pools integrated with CrossCurve face imbalance as exploited tokens are dumped Contagion spreads to Curve pools with $2.7B TVL; LPs in CrossCurve-connected pools face significant impermanent loss

Risk Profile at a Glance

Mechanism Novelty6/15
Interaction Severity20/20
Oracle Surface5/10
Documentation Gaps7/10
Track Record15/15
Scale Exposure0/10
Regulatory Risk4/10
Vitality Risk5/10
D+

Overall: D+ (62/100)

Lower score = safer

More on CrossCurve

Related Bridge Explainers