On March 6, 2026, Curve Finance publicly accused PancakeSwap of copying its StableSwap algorithm without proper licensing, reigniting a dispute that has simmered across decentralized finance since 2020. The accusation centers on a file called `CLStableSwapHook` in PancakeSwap's Infinity upgrade, ...
"The license requires developers to follow strict attribution and compliance rules. Open source does not mean open season." — Curve Finance, via official statement on X, March 6, 2026
On March 6, 2026, Curve Finance publicly accused PancakeSwap of copying its StableSwap algorithm without proper licensing, reigniting a dispute that has simmered across decentralized finance since 2020. The accusation centers on a file called CLStableSwapHook in PancakeSwap's Infinity upgrade, which listed PancakeSwap as the author and carried a placeholder comment — @license # TODO: Which license should we use? — where the license field should have been.
The incident is the latest in a series of code-ownership conflicts that have defined DeFi's evolution. From SushiSwap's 2020 vampire attack on Uniswap to Saddle Finance's shutdown in 2023 after years of IP accusations, the industry has cycled between open-source idealism and commercial protectionism. An estimated $130–140 billion in total DeFi TVL now runs on code derived from a handful of original protocols, making the question of who owns that code increasingly consequential.
This report examines the economic and legal dimensions of code ownership in DeFi, comparing the strategies of major protocols and assessing what the Curve-PancakeSwap dispute signals for the industry's future.
The dispute surfaced when Curve's verified X account posted a screenshot of PancakeSwap's CLStableSwapHook file, part of the exchange's concentrated liquidity infrastructure on PancakeSwap Infinity. The file used Vyper pragma version 0.3.10 and was credited to PancakeSwap. Its license field read: TODO: Which license should we use?
Curve's StableSwap algorithm — the mathematical formula that enables low-slippage trading between stablecoins and pegged assets — is published as open-source code. However, Curve maintains that its license imposes attribution and compliance requirements that PancakeSwap did not follow.
PancakeSwap responded the same day, stating its team was reaching out to Curve "to discuss the matter." Both sides publicly signaled a preference for licensing negotiation over litigation.
The stakes are not trivial. As of early March 2026, Curve holds approximately $7.1 billion in TVL according to Stelareum data, while PancakeSwap maintains roughly $1.8 billion. PancakeSwap processed $2.36 trillion in trading volume during 2025, capturing 37.8% of total DEX market share. PancakeSwap Infinity, the upgrade at the center of the dispute, launched on BNB Chain and Arbitrum in April 2025.
The Curve DAO Token (CRV) trades at approximately $0.24 with a market capitalization near $340–370 million — down 98.5% from its all-time high of $15.37. The protocol's economic significance far exceeds its token valuation: its StableSwap invariant underpins stablecoin liquidity across the industry.
The Curve-PancakeSwap confrontation follows a pattern that dates to DeFi's formative period.
The original "vampire attack." In August 2020, an anonymous developer known as "Chef Nomi" forked Uniswap V2's open-source code, launched SushiSwap, and used aggressive token incentives to drain liquidity. SushiSwap attracted over $1 billion in deposits within a week by offering higher rewards on copied infrastructure. Uniswap's code was published under a GPL license, which permitted commercial forking. The attack was legal. It was also devastating.
Burned by the SushiSwap episode, Uniswap Labs launched V3 in March 2021 under a Business Source License 1.1 (BSL). The license restricted commercial production use for two years, with governance holding authority to grant exceptions via Additional Use Grants. The BSL expired on April 1, 2023, converting to a GPL license and making V3 freely forkable.
In 2021, Curve accused Saddle Finance of porting its StableSwap code "line by line" into Solidity from Vyper — a different programming language, but functionally identical logic. Saddle, backed by prominent venture firms, argued the StableSwap algorithm was published in the public domain. No formal legal action followed, but the reputational damage was significant. Saddle suffered a $11 million hack in April 2022, recovered $3.8 million via white-hat intervention, and ultimately voted to shut down operations in August 2023, liquidating its treasury into Arbitrum ARB tokens.
Uniswap doubled down. V4 launched under a BSL that restricts commercial use until June 15, 2027 — a four-year lockout, double the V3 precedent. Several DeFi developers publicly accused Uniswap of incorporating ideas from rival protocols and then locking them behind the BSL. The Uniswap Foundation maintains that governance can still grant exceptions through formal proposals.
Aave followed Uniswap's lead, delaying open-source access to its V3 code under a business license. In December 2025, a community proposal to transfer all protocol intellectual property — including social media accounts and the aave.com domain — to the DAO failed on Christmas Day. The failed vote exposed a governance deadlock over IP ownership between the founding team and token holders.
DeFi protocols now occupy a range of licensing positions:
| Protocol | License | Commercial Restriction | Current Status | |----------|---------|----------------------|----------------| | Uniswap V2 | GPL | None | Freely forkable | | Uniswap V3 | BSL → GPL | Expired April 2023 | Freely forkable | | Uniswap V4 | BSL | Until June 2027 | Restricted | | Curve | Open-source w/ conditions | Attribution required | Active enforcement | | Aave V3 | Business license | Time-limited | Restricted | | PancakeSwap | Mixed | Varies by component | Under dispute |
The spectrum reflects a broader tension. DeFi's founding ethos was radical openness — "code is law," composability as a design principle, permissionless forks as a feature rather than a bug. The SushiSwap attack demonstrated that pure openness creates a free-rider problem: developers invest years building infrastructure, only to watch competitors copy it overnight and compete on token incentives alone.
The BSL model attempts a compromise: open for inspection, closed for commercial use, with a time-delayed conversion to full open-source. The approach borrows from enterprise software licensing (MariaDB popularized the BSL in 2013) but sits uneasily in a sector that positions itself as an alternative to corporate gatekeeping.
The financial magnitude of DeFi's codebase is substantial. Total DeFi TVL across all chains sits at approximately $130–140 billion in early 2026. A significant portion of this TVL runs on code derived from a small number of original implementations:
According to DeFiLlama, over 500 DeFi protocols operate across 200 blockchains as of early 2026. The majority share architectural DNA with fewer than ten original codebases. The economic value generated by this shared infrastructure — in trading fees, lending interest, and MEV extraction — runs to billions of dollars annually.
For the original developers, the question is existential: if anyone can fork your code and compete on marketing alone, what incentive exists to build in the first place? For the broader ecosystem, the counter-argument is equally forceful: composability and forkability are what made DeFi possible. Lock down the code, and you replicate the walled gardens DeFi was built to dismantle.
Even where licensing restrictions exist on paper, enforcement remains difficult:
Jurisdictional ambiguity. Most DeFi protocols operate through DAOs without clear legal domicile. Curve Finance is associated with a Swiss entity, but its code runs on Ethereum, its users are global, and PancakeSwap operates primarily on BNB Chain. Cross-border IP enforcement for smart contract code has no established legal precedent.
The public domain question. Curve's StableSwap algorithm was published as a whitepaper. Saddle Finance argued successfully (in the court of public opinion, if not in any court of law) that reimplementing a published algorithm in a different language does not constitute code copying. The distinction between an algorithm (potentially public domain) and its specific implementation (copyrightable) remains legally untested in the DeFi context.
On-chain immutability. Once code is deployed to a blockchain, it cannot be retracted. Even if a court ordered PancakeSwap to cease using Curve's code, already-deployed contracts would continue to function. New deployments could be blocked, but existing infrastructure would persist indefinitely.
Community enforcement. In practice, DeFi's primary enforcement mechanism is reputational. Saddle Finance did not lose a lawsuit — it lost community trust and subsequently failed commercially. The Curve-PancakeSwap dispute may follow a similar pattern, with market participants choosing sides based on perceived legitimacy rather than legal outcomes.
The Curve-PancakeSwap dispute arrives at a moment when DeFi's relationship with IP is being tested across multiple fronts. The Uniswap V4 BSL remains in effect until 2027, creating a two-tier system where some protocols are freely composable and others are not. Aave's governance continues to wrestle with IP ownership questions that have no clean resolution within existing DAO structures.
Three possible trajectories emerge:
1. Licensing becomes standard. Protocols adopt BSL-style restrictions as default, with negotiated licensing agreements between major players. DeFi starts to resemble enterprise software, with code audits and licensing compliance as part of the development stack.
2. Enforcement fails and openness prevails. The jurisdictional and technical barriers to enforcement prove insurmountable. Protocols compete on execution, community, and liquidity rather than code exclusivity. The BSL becomes a signaling device rather than a legal tool.
3. Hybrid models emerge. Protocols open-source their base implementations but monetize through proprietary hooks, plugins, or off-chain services. Uniswap V4's hook architecture already points in this direction — the core protocol is restricted, but the hook ecosystem is designed to be extensible.
The Curve-PancakeSwap dispute is not about one file with a missing license header. It is about whether DeFi's foundational infrastructure can sustain both open composability and economic viability for its builders. The protocols that wrote the algorithms underpinning billions in TVL are watching their code replicated across chains, languages, and competitors — often without attribution, rarely with compensation.
The industry's response so far has been ad hoc: time-delayed licenses, social media accusations, and governance proposals that fail on holidays. A more systematic framework — whether through formal licensing standards, on-chain attribution mechanisms, or industry-wide agreements — appears increasingly necessary. The alternative is a sector where the rational strategy is to copy rather than create, and the builders who wrote the original code eventually stop building.
The $130+ billion locked in DeFi protocols depends on continued innovation from a remarkably small number of development teams. How the industry resolves the code ownership question will determine whether those teams have reason to keep writing.