Fact-check findings
What an automated fact-checker found when it re-read Lava against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #1[disputed][awaiting moderator]in the summary
“The protocol suffered two documented exploit incidents in 2024 totaling approximately $470,000 in losses, both rooted in protocol logic vulnerabilities and flash loan abuse.”
reviewerTwo exploits in 2024 totaling about $470,000Only the March 2024 incident was found in any source I reached. I found no source for an October 2024 $130,000 exploit. Proposed correction rests on the quadriga fetch and the DefiLlama search snippet.Proposed correction (not yet applied)The protocol suffered one documented exploit in March 2024, with losses of approximately $340,000, rooted in a protocol logic vulnerability and flash loan abuse. - #4[disputed][awaiting moderator]in section: Security Incidents and Exploit History
“The exploit abused a calculation error in the protocol's liquidation engine via flash loans.”
reviewerExploit abused a calculation error in the liquidation engineThe correction rests on a search-result description of the post-mortem rather than a direct read, so confidence is moderate.Proposed correction (not yet applied)The exploit inflated the price of an LP token used as collateral via flash loans, giving the attacker enough borrowing power to borrow out the protocol's assets.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #2[unverifiable][awaiting moderator]in section: Security Incidents and Exploit History
“A second exploit occurred on October 4, 2024, resulting in an additional $130,000 in losses.”
reviewerSecond exploit on Oct 4, 2024 for $130,000The search turned up no corroboration. The chainsec page was not fetched. Related claims (combined $470,000, 'recurrence', 'incomplete remediation', timeline[4]) depend on this one. - #5[unverifiable][awaiting moderator]in section: Security Incidents and Exploit History
“A post-mortem was published on HackMD on April 26, 2024”
reviewerPost-mortem published April 26, 2024Could not read the post-mortem. - #6[unverifiable][awaiting moderator]in section: ZachXBT Flag
“On-chain investigator ZachXBT flagged Lava Finance as a protocol of concern.”
reviewerZachXBT flagged Lava; this is reflected in the trust scoreThe page itself admits the flag was never confirmed through a retrievable post, and the cited sources are generic ZachXBT pages. Yet the summary and other sections state the flag as fact. I found no evidence of it.citedzachxbt.mirror.xyz/
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #7[partially supported][awaiting moderator]in section: Protocol Overview
“The DeFi protocol at lavadefi.io is the entity that suffered the documented exploits and was flagged by ZachXBT.”
reviewerLava Finance is at lavadefi.io; the exploit is attributed to that domainIdentity of the exploited Lava with lavadefi.io is not established. DefiLlama may refer to a different Lava. The ZachXBT flag is unverified.citedlavadefi.io/
confirmed
2 claimsThe cited evidence supports the claim as written.
- #3[confirmed][no action needed]in section: Security Incidents and Exploit History
“The first incident occurred on March 29, 2024, resulting in losses of approximately $340,000.”
reviewerMarch 2024 exploit: $340,000, Mar 29 per DefiLlama, reported Mar 28 by PeckShield, flash loanAmount, report date, 90% offer and Insurance Fund match. The cause given in the post-mortem snippet is LP token price inflation as collateral, not a liquidation-engine calculation error. I could not fetch the HackMD post-mortem (403). - #8[confirmed][no action needed]in section: Related Entity: Lava (lava.xyz) Bitcoin Lending Custody Controversy
“Simultaneous with the $200 million announcement, users discovered that a September 2025 app update had silently migrated their funds”
reviewerlava.xyz custody pivot (DLC to custodial), Sept 2025 updateCorroborated by search-result summaries only. I did not fetch Gizmodo, Protos or Bitcoin Magazine, so quotes and details (Mallers, Maredia, rates) are not individually checked.