Curve Finance is extending a $1.85 million bug bounty offer to anyone who can identify the exploiter of its stable pools.