Deployed bytecode reproducibility

Curve Finance's assessment for RD-F-145 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Vyper contracts are deterministically reproducible from source + compiler version. NG contracts specify pragma version 0.3.10 in source headers. Full bytecode reproducibility verification for all 2000+ pool deployments is not publicly documented by Curve. Core DAO contracts (2020-2021 vintage) are reproducible from Etherscan-verified source.

Sources #

GitHub
Tricrypto-NG main contract — Vyper 0.3.10 pragmagithub.com/curvefi/tricrypto-ng — CurveTricryptoOptimizedWETH.vy: '# pragma version 0.3.10'retrieved 2026-04-28

Methodology #

Determine whether anyone can independently reproduce the deployed bytecode from the repo and declared build toolchain.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol curve-v2 factor RD-F-145 score yellow collected_at 2026-04-28 19:48:40