How Does Resupply Work?
Resupply is a stablecoin protocol built by Convex Finance and Yearn Finance that lets you borrow reUSD against yield-bearing stablecoin positions from Curve Lend and Fraxlend. It was exploited for $9.6M in June 2025 via a donation attack on an empty vault.
TVL
$39M
Sector
CDP
Risk Grade
C
Value Grade
C-
Core Mechanisms
Stablecoin/CDP
reUSD minted against Curve Lend and Fraxlend LP positions as collateral
Standard CDP model where users deposit lending pool tokens (crvUSD/frxUSD lending positions) and borrow reUSD. Conceptually similar to MakerDAO but using yield-bearing stablecoin collateral.
Lending/Sub-DAO
NovelSub-DAO structure shared between Convex Finance and Yearn Finance
Novel governance structure where Resupply operates as a sub-DAO of both Convex (20% allocation) and Yearn (10% allocation), with perpetually staked voting power. This dual-parent sub-DAO model is uncommon in DeFi.
Staking/Revenue-Share
RSUP staking for protocol fee revenue and governance voting power
Stakers earn reUSD fees and gain voting power. 14-day withdrawal delay. Standard revenue-share staking pattern.
Insurance/Pool
Insurance pool funded by 25% of RSUP emissions to backstop reUSD
Dedicated insurance pool absorbs losses if collateral value drops below reUSD liabilities. Similar to Aave safety module concept.
Governance/Vote-Incentives
50% of emissions directed to vote incentives for gauge-style allocation
Emission-weighted voting incentives modeled after Curve/Convex gauge system. Borrowers generating more revenue receive proportionally more emissions.
Oracle/Multi-Source
Price feeds for Curve Lend and Fraxlend LP token valuations
Relies on oracle pricing for underlying lending pool tokens. Exchange rate calculations are a known attack surface as demonstrated by the June 2025 exploit.
Risk-Management/Liquidation
Automated liquidation of undercollateralized CDP positions
Standard CDP liquidation mechanism. Positions falling below collateral ratio thresholds are liquidated.
How the Pieces Interact
If Curve Lend or Fraxlend suffer exploits, smart contract bugs, or liquidity crises, the LP tokens backing reUSD lose value, directly threatening the stablecoin peg.
Freshly deployed or empty vaults can have manipulated exchange rates via donation attacks, as demonstrated in the $9.6M June 2025 exploit where inflated pricing allowed unlimited borrowing against negligible collateral.
If RSUP token price declines due to emission dilution, the insurance pool's dollar-denominated value shrinks, reducing the protocol's backstop capacity during stress events.
Convex and Yearn hold 30% of perpetually staked RSUP, giving them outsized influence on emission direction. Misaligned incentives between parent DAOs could lead to suboptimal parameter choices.
Revenue-proportional emissions create a reflexive loop: more emissions attract borrowers, but if underlying yield declines, emissions become the primary incentive, leading to unsustainable growth.
What Could Go Wrong
- Resupply suffered a $9.6M donation-attack exploit in June 2025 on a newly deployed wstUSR vault, demonstrating that empty-pool vulnerabilities in freshly launched markets remain a critical attack vector.
- reUSD is a stablecoin backed by other stablecoins deposited in Curve Lend and Fraxlend — any depeg or insolvency in those underlying lending markets cascades directly into reUSD collateral quality.
- RSUP has no max supply and follows a perpetual inflation schedule (2% per year after year 5), diluting holders if protocol revenue does not grow to offset emission pressure.
Cascading Lending Platform Failure and reUSD Depeg
ModerateTrigger: A critical exploit or insolvency event in Curve Lend or Fraxlend causes the underlying LP tokens used as reUSD collateral to lose significant value
- 1.Curve Lend or Fraxlend suffers a smart contract exploit or liquidity crisis — LP tokens deposited as collateral in Resupply CDPs lose 20-50% of their face value
- 2.Resupply oracle feeds reflect the impaired collateral values — Mass CDP liquidations triggered as collateral ratios fall below thresholds
- 3.Liquidation proceeds are insufficient due to illiquid or impaired LP tokens — Protocol accumulates bad debt; reUSD becomes undercollateralized
- 4.Insurance pool activated to cover shortfall — RSUP sell pressure from insurance pool payouts further depresses token price and remaining backstop value
- 5.Confidence crisis triggers reUSD sell-off on secondary markets — reUSD depegs significantly below $1 as holders rush to exit positions
Risk Profile at a Glance
Overall: C (45/100)
Lower score = safer