Select members of the protocol’s governing body voted to terminate CRV governance rewards for liquidity pools affected by recent exploits.

The Curve Finance emergency decentralized autonomous organization (E-DAO) voted to remove CRV rewards for alETH, msETH, pETH, crvCRVETH, Arbitrum Tricrypto and multi-BTC pools.

Gabriel Shapiro, general counsel at Delphi Labs and a member of the protocol’s E-DAO, notified users of the action in an Aug 2 tweet, explaining that the termination of rewards was done to avoid further incentivizing participation in the pools affected by the Vyper and Multichain exploits.

ATTENTION, FROM A CURVE E-DAO SIGNER:

The @CurveFinance emergency multisig has terminated CRV rewards (gauges) to the liquidity pools affected by recent exploits, including pools affected by the recent Vyper compiler exploit and the multiBTC pool affected by the recent…

— _gabrielShapir0 (@lex_node) August 2, 2023

The E-DAO is a nine-person group that controls a multisig with limited governance powers, which include the ability to shut down a pool that has been operating for under two months if a bug has been discovered and terminate rewards for a pool that would push its participants to migrate elsewhere.

Last month, more than $100 million was withdrawn from the Multichain protocol’s bridges in what appeared to be an exploit, prompting Curve to warn users to “Exit multichain assets such as multiBTC (including the pool).”

On July 30, an estimated $52 million was drained from several DeFi protocols that relied on Curve’s stablepools running on vulnerable Vyper smart contracts.

Curve pools that were affected by these exploits continued to produce governance token rewards during this time, and users who deposited their tokens into them could still earn CRV.   

Still, some blockchain users took issue with the fact that there was no apparent documentation of the E-DAO’s powers, despite the fact that its actions can be overruled by the Curve DAO.

why is there no mention of it in the docs, only on a semi-hidden emergency page, which explicitly states it’s only functionality is to call kill_me() which “disables all functionality except for withdraw”?

no mention of being able to just kill rewards to a gauge pic.twitter.com/U2ADpK6okR

— tk (@tomkysar) August 2, 2023

“just hope you can also understand that as a somewhat passive user of the protocol, if I am told an emergency DAO can only do X then it does Y, I am wondering when it obtained said new powers and how,” tweeted one Curve user.

Another member of the E-DAO, “@nagakingg” acknowledged the users’ concerns as “fair enough points,” and said that the multisig’s powers are actually more limited than the doc suggests.