The Curve Finance team has accused PancakeSwap of integrating its StableSwap code into the newer PancakeSwap Infinity release without a proper license. The dispute centers on the StableSwap module, which underpins swaps involving stablecoins and tightly pegged assets, and its deployment within Infinity, the latest iteration of the PancakeSwap decentralized exchange. Curve’s public note on X framed licensing as a prerequisite for any continued use of the code, inviting PancakeSwap to engage in formal licensing or collaboration to reduce legal risk and safeguard users. The exchange has signaled it may reach out to Curve to discuss the matter, with Curve replying that “better to be friends and build together.”

Beyond licensing, Curve stressed that deploying stable-swap capabilities safely requires deep specialized know-how. The post pointed to historically high-risk episodes tied to swap-based systems, underscoring that even seemingly straightforward integrations can become attack surfaces if not designed with rigorous safeguards. The reference points include Saddle Finance’s 2022 hack and the 2025 Balancer incident, which saw a $116 million exploit tied to swap-based code. These examples are invoked to warn users and developers about the potential for losses when complex liquidity mechanisms interact with permissionless platforms.

Cointelegraph contacted both Curve and PancakeSwap for comment, but neither side had responded by publication time. The absence of formal statements on licensing terms leaves a broader conversation about DeFi security, intellectual-property rights, and cross-chain interoperability still unresolved. The episode also highlights how fast-moving feature sets—such as cross-chain swaps and programmable liquidity—can collide with the practical and legal complexities of code reuse in open ecosystems.

The timing aligns with PancakeSwap’s ongoing ecosystem expansion. In April 2025, Infinity launched on Arbitrum and BNB Chain, introducing one-click cross-chain swaps intended to streamline asset movement across networks. The upgrade also introduced “hooks” — smart contract plug-ins that let liquidity providers tailor pool parameters, including dynamic fee structures, customized rebates, and on-chain limit orders that execute when predefined conditions are met. PancakeSwap said the upgrade reduced pool-creation fees by as much as 99%, signaling an attempt to accelerate liquidity onboarding and experimentation across chains.

Further growth followed later in 2025, with Infinity extending to Base, an Ethereum layer-2 network. PancakeSwap reported that trading on Base could be up to 50% cheaper when Ether (CRYPTO: ETH) trades against ERC-20 tokens, underscoring the economic incentives behind cross-chain expansions and the continued push to lower trading costs for users who bridge assets across networks. The Base deployment exemplifies how DeFi aggregators are increasingly pursuing multi-chain footprints to improve liquidity depth and user experience, even as they navigate new regulatory and security considerations. ERC-20 remains the dominant token standard on Ethereum-based assets, including many that flow through L2 ecosystems and cross-chain adapters.

Taken together, the episode illustrates a core tension in DeFi: rapid feature innovation and cross-chain interoperability versus the need for rigorous license compliance and robust security controls. As Infinity’s architecture becomes more sophisticated—incorporating hooks, dynamic fees, rebates, and conditional orders—the potential attack surface grows, even as the market appetite for seamless, multi-chain swaps intensifies. The fact that Curve explicitly linked licensing discussions with user safety signals that governance and IP considerations may increasingly influence how DeFi projects collaborate and compete in the coming years.

For readers tracking the evolution of cross-chain DeFi, the exchange between Curve and PancakeSwap is a useful case study in how open-source finance negotiates the line between rapid innovation and formal protection of codebases. It also raises practical questions for developers and users: how are licenses enforced in permissionless environments, what constitutes a legally safe deployment of shared code, and how quickly can open collaboration be formalized when risk signals emerge?

PancakeSwap Infinity launches and goes cross-chain

PancakeSwap Infinity debuted on Arbitrum and BNB Chain in April 2025, following the project’s earlier adoption of one-click cross-chain swaps to facilitate asset movement across different blockchains. The Infinity upgrade introduced “hooks,” programmable plug-ins that let liquidity pools adapt to varying strategies, including dynamic fees, tailored rebates, and on-chain limit orders triggered by user-defined conditions. The intent was to give liquidity providers greater control and to optimize trading experiences across an expanding ecosystem of connected networks.

In addition to the feature set, the upgrade also reduced pool-creation costs by up to 99%, which PancakeSwap framed as a measure to encourage experimentation and liquidity provisioning across chains. The company stressed that Infinity was designed with flexibility in mind, enabling multiple liquidity approaches and enabling developers to customize pool behavior without sacrificing core usability.

Base, launched later in 2025, represented the project’s move onto another major Ethereum layer-2. On Base, PancakeSwap Infinity again marketed cost savings for traders, claiming that ether-based trades against ERC-20 tokens could be significantly cheaper. This expansion aligns with broader industry interest in scaling Ethereum-based assets and reducing friction for users who want to move assets between Layer 1 and Layer 2 ecosystems while maintaining efficient execution and competitive fees. The emphasis on Base reflects a broader trend of DeFi platforms extending their reach to Layer-2 networks in pursuit of higher throughput and lower costs for on-chain activity.

Throughout these developments, ERC-20 remains a central element in the cross-chain narrative, given its role as the primary token standard for assets minted on Ethereum and widely adopted across L2s and sidechains. The practical implications of this reality are clear: as more protocols enable cross-chain swaps and multi-network liquidity, the compatibility and security of ERC-20 contracts—along with the associated wallets and bridges—becomes an ever more critical factor for users and developers alike.

In this context, the licensing debate between Curve and PancakeSwap serves as a reminder that DeFi’s future depends not only on clever feature design but also on the governance, licensing, and security frameworks that enable collaboration across networks. The dynamics of cross-chain liquidity—and the legal and technical safeguards that protect it—will likely shape how other protocols approach similar integrations in the months ahead. The industry will be watching closely to see whether licensing discussions translate into formal agreements, and whether security practices evolve in step with the increasingly interconnected DeFi landscape.

Why it matters

What makes this dispute notable is its potential to influence the pace and direction of DeFi interoperability. Licensing friction, if not resolved, could slow down the adoption of shared code and cross-chain features, prompting projects to pursue bespoke solutions rather than open collaborations. Conversely, a constructive licensing outcome could establish a template for responsible code reuse, enabling faster deployment of complex liquidity primitives while maintaining safeguards for users.

Beyond licensing, the case spotlights the broader risk-management challenges in DeFi. As protocols push dynamic fee schemes, programmable pools, and cross-chain bridges, the importance of robust security practices and audited codebases becomes more pronounced. The references to Saddle Finance’s 2022 incident and Balancer’s 2025 exploit highlight the real costs of insufficient safeguards, reinforcing the view that risk assessment must accompany innovation. In short, the industry is weighing how to balance rapid iteration with disciplined, verifiable security and licensing processes that protect users and the broader ecosystem.

For builders, the episode reinforces the value of collaboration under clear, enforceable terms and the importance of pre-emptive security design when deploying reusable components. For investors and users, it underscores the ongoing need to assess not just the functionality of new features but also the licensing posture and risk controls that accompany them. As cross-chain ecosystems mature, the ability to navigate legal and technical risk will be as critical as the product features themselves.

What to watch next

• Public licensing negotiations between Curve and PancakeSwap: will a formal agreement or licensing framework emerge?
• Security reviews and audits of Infinity’s hooks and cross-chain components, including any new penetration testing results.
• Additional Infinity deployments on other networks and any changes to pool-creation economics or fee structures.
• Regulatory and governance developments that could influence how open-source DeFi code is shared and deployed across ecosystems.

Sources & verification

• Curve Finance X posts discussing licensing and collaboration for StableSwap features.
• Curve Finance X posts emphasizing the need for deep stableswap expertise for safe integration and safety considerations.
• PancakeSwap Infinity launch announcement and description of hooks and dynamic parameters.
• Cross-chain swap developments and the Base deployment, including cost-structure improvements.
• Historical references to Saddle Finance 2022 hack and Balancer’s $116 million exploit, cited as cautionary examples of swap-based code vulnerabilities.