Verify a decision

{"actor":"system:backfill","investigation_id":"2739097c-d622-4726-906c-3e73e85e4f48","kind":"publish","page_slug":"lava","published_at":"2026-05-30T11:47:59.123Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Lava","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/lava-decentralized-lending-mitigate-impermanent-loss","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/lava","type":"other","url":""},{"credibility":3,"name":"https://docs.lavadefi.io/transparency/contract-audits","type":"other","url":""},{"credibility":3,"name":"https://lavadefi.io/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/lavalendingflashloanattack.php","type":"other","url":""},{"credibility":3,"name":"https://www.chainsec.io/defi-hacks","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/lava","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://zachxbt.mirror.xyz/","type":"other","url":""},{"credibility":3,"name":"https://x.com/zachxbt","type":"other","url":""},{"credibility":3,"name":"https://en.wikipedia.org/wiki/ZachXBT","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.lavadefi.io/info/usdlava-token-summary","type":"other","url":""},{"credibility":3,"name":"https://etherscan.io/token/0xd89c37fd7c0fa3b107b7e4a8731dd3aaec488954","type":"other","url":""},{"credibility":3,"name":"https://bscscan.com/token/0xfaff5251ea98f90540d6bacdf7a458f61b456c06","type":"other","url":""},{"credibility":3,"name":"https://docs.lavadefi.io/transparency/contract-audits","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://gizmodo.com/bitcoin-wallet-lava-removes-decentralization-via-sneaky-app-update-2000685725","type":"other","url":""},{"credibility":3,"name":"https://blockspace.media/insight/bitcoin-lending-app-lava-quietly-shifted-its-custody-model-users-are-demanding-answers/","type":"other","url":""},{"credibility":3,"name":"https://bitcoinmagazine.com/business/lava-abandons-self-custody-amidst-fund-raise-sparking-controversy","type":"other","url":""},{"credibility":3,"name":"https://protos.com/who-really-controls-lavas-bitcoin-collateral/","type":"other","url":""},{"credibility":3,"name":"https://blockworks.com/news/lava-raise-17m-lending-platform","type":"other","url":""},{"credibility":3,"name":"https://bitcoinmagazine.com/business/lava-raises-200m-for-bitcoin-backed-line-of-credit-announces-new-borrow-rates-starting-at-5","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.lavadefi.io/transparency/contract-audits","type":"other","url":""},{"credibility":3,"name":"https://quadrigainitiative.com/casestudy/lavalendingflashloanattack.php","type":"other","url":""},{"credibility":3,"name":"https://www.chainsec.io/defi-hacks","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.crunchbase.com/person/shehzan-maredia-cfec","type":"other","url":""},{"credibility":3,"name":"https://theorg.com/org/lava-2/org-chart/shehzan-maredia","type":"other","url":""},{"credibility":3,"name":"https://bitcoinmagazine.com/business/lava-abandons-self-custody-amidst-fund-raise-sparking-controversy","type":"other","url":""}]}],"sources_used":[],"summary":"Lava (lavadefi.io) is a decentralized, non-custodial multichain lending and borrowing protocol deployed on Arbitrum and Base, operating since March 2024. The protocol suffered two documented exploit incidents in 2024 totaling approximately $470,000 in losses, both rooted in protocol logic vulnerabilities and flash loan abuse. The platform was flagged by on-chain investigator ZachXBT, and separately the lava.xyz Bitcoin lending product drew significant backlash in late 2025 after quietly switching users from a self-custodial DLC-based model to a fully custodial setup without adequate disclosure.","timeline":[{"date":"2024-03-07","event":"Lava Finance (lavadefi.io) launches as a decentralized multichain lending and borrowing protocol on Arbitrum and Base.","source":""},{"date":"2024-03-28","event":"PeckShield Alert publicly reports an active exploit on Lava Finance. All lending markets are paused within 15 minutes.","source":""},{"date":"2024-03-29","event":"Lava Finance flash loan exploit confirmed. Approximately $340,000 lost via a protocol logic vulnerability in the liquidation engine. Law enforcement reports filed; attacker address flagged on Arbiscan.","source":""},{"date":"2024-04-26","event":"Lava Finance publishes a post-mortem on HackMD detailing the exploit, remediation steps including the _limitFees function fix, and Insurance Fund compensation for affected users.","source":""},{"date":"2024-10-04","event":"A second exploit targets Lava Finance on Arbitrum, resulting in approximately $130,000 in losses via a protocol logic flash loan attack, despite prior mitigations.","source":""},{"date":"2025-09-01","event":"Lava (lava.xyz) pushes an app update prompting users to migrate funds to new vaults, without disclosing the transition from self-custodial DLCs to a fully custodial cold-storage model.","source":""},{"date":"2025-11-04","event":"Owen Kemeys of Foundation Devices publicly questions Lava's consent practices on X, triggering widespread media coverage of the custody model shift.","source":""},{"date":"2025-11-14","event":"Gizmodo, Bitcoin Magazine, Blockspace, and Protos publish investigations into Lava's custody model pivot. Jack Mallers raises regulatory legality concerns. Lava CEO Shehzan Maredia defends the change citing DLC technology risks.","source":""},{"date":"2025-11-01","event":"Lava (lava.xyz) announces $200 million in new funding from Founders Fund, Khosla Ventures, Susquehanna, and angels including Anthony Pompliano, concurrent with the custody controversy.","source":""}]},"v":1}