When Owen Kemeys opened his bitcoin lending app Lava on September 22, he found an alert: “Upgrade Your Lava Vaults.”
“In order to take advantage of Lava’s newest features, you’ll need to migrate funds from your existing Lava Vaults to the latest versions,” the message read.
Thinking nothing of it – and having no choice but to update to access his bitcoin-collateralized loan on the app – Kemeys obliged.
Kemeys, an early user of Lava and head of physical design at Bitcoin wallet Foundation, was drawn in by the app’s use of discreet log contracts (DLCs), a form of Bitcoin-based smart contracts. In this case, DLCs allow users to take out non-custodial loans on their bitcoin. At first, he liked what he saw. The update seemed like a significant buff to the app’s user experience.
“I was even telling friends like, hey, look how great this update is. They finally kind of nailed it. I’m so pleased with those guys,” Kemeys told Blockspace.
But then he learned why the app became so much more user friendly a few weeks later, when Lava CEO Shehzan Maredia, provided additional context in a November 4 X post: Lava had moved its entire design away from DLCs and into a custodial solution.
Kemeys and other users were nonplussed not so much by the decision, but because the messaging for the update did not make it clear it was a fundamental overhaul of Lava’s custodial design.
“You cannot, CAN NOT, alter the trust model without the user’s fully informed consent,” Kemeys told Blockspace.
User frustrations and the ostensible lack of transparency from Lava would be less notable maybe if not for the company’s $200 million raise announced last week, which prompts questions regarding the timing of the change and whether it was a requisite for Lava’s latest round.
In sum, the entire episode is a puzzling about-face from a company that originally marketed itself as a non-custodial option for bitcoin-backed lending.
Lava goes full-custodial
Maredia told Blockspace that the “update did require users to manually authorize the update transactions,” adding that “this was one of several changes to [Lava’s] tech infrastructure that we’ve made over the course of the past year.”
In the November 4 X post, Maredia said that Lava now uses a “cold storage and institutional-grade security systems that have safeguarded over $100B in assets globally.”
But the crux of the problem to Kemeys is that he and other users had no idea the update authorized a change from a non-custodial to a custodial setup.
Kemeys, and others like him who saw Lava’s original DLC model as a selling point, felt blindsided, arguing that Lava’s update never explicitly spelled out a change to Lava’s custodial setup. (Per a Lava support email Blockspace reviewed, Lava did notify users about September’s update, a major overhaul that would require users to “manually perform an upgrade” and “migrate [their] funds” to upgraded vaults. However, the update did not specify that the underlying technology nor the custody model were changing).
“I was presuming, under the hood, they’ve done something with the DLCs to make all this work, still with their stated values of not surrendering full custody,” he told us.
“I was signing up to something where I held a key to the collateral in some way, basically, and it appears that is no longer the case…Did you have my app signing transactions that changed my role in the custody setup? Because you certainly did not tell me that that’s what I was doing or approving,” Kemeys asked rhetorically.
Other users shared Kemeys’ sentiments in replies and posts referencing the change, with comments ranging from mild to pointed to vociferous.
“I’m not gonna mince words. this is fucked,” tweeted Harsha Goli, Founder and CEO of Bitcoin custody solution Magnolia.
In a statement to Blockspace, Maredia said that communicating technical upgrades is a “fine line since many users are not highly technical,” but he expressed regret for not making the true meaning of the update clear.
“We realize that some users feel that we under-communicated here and that they weren’t aware of the specifics. At the end of the day, that means we didn’t communicate with them properly, and we take responsibility for that. We’ve spoken directly to most of these users over the past week, but we’re also planning to release more information publicly this week to clarify these changes,” he wrote in an email.
Lava then and now
The Lava team first introduced The Lava Loans Protocol in October 2023 white paper, opining on the need for “good options for users that wish to use native-bitcoin as collateral for loans without trusting a custodian.”
Lava’s solution until recently relied on discreet-log-contracts (DLCs),which would allow Lava’s users to hold the bitcoin in their collateralized-loans in a two-of-two multi-signature wallet in the user’s control. The user would hold one key; Lava, the other. Lava pitched – and early users received – the setup as an improvement on the custodial models, like BlockFi and Celsius, that went bellyup in 2022.
Should the user default on the loan, pay back the loan in full, or fulfill some other loan condition, the wallet unlocks the underlying bitcoin and sends it to the legal owner according to the loan conditions (the user in the event of a loan pay off, or the lender in the event of a default).
Now, Lava holds its funds in an institution-grade, cold storage wallet.
One X sleuth said he tracked Lava funds to Kraken, indicating that Lava may be using the exchange for custody now. But this is not confirmed and Lava declined Blockspace’s request for comment specifically on this and other points. Maredia has emphasized repeatedly that funds are 1:1 and not rehypothecated.
What is clear, as Goli tweeted, is that “‘self-custodial’ funds were moved WITHOUT CLEAR PERMISSION into custodial accounts.”
“This is bad, it destroys trust,” Goli continued, further claiming that Lava’s original terms-of-service stated the company could never make such a move. (As recently as November 10, Lava’s terms of service stated that “The Company has no exclusive custody or control over the contents of your wallet” and “that such wallet is purely self-custodial.”).
Custodial bait-and-switch or honest fumble?
The September update made it clear that users needed to move funds to new vaults to complete the update, but as both Goli and Kemeys noted, the message wasn’t clear that the new vault would be full custodial. Why Lava decided to abandon the non-custodial DLC model – a distinguishing feature and a point of appeal for day-one users – is a question users are grappling with after the change.
The most digestible answer is that the new model helps Lava secure a lower interest rate for its users.
Focusing on the positives from the update, Maredia posted on X that, now, Lava has “the lowest possible cost of capital” with loans starting at 5% with a 2% capital charge fee. Ultimately, he opined in another post, Lava’s old model “wasn’t secure enough for what we needed to build.”
But Kemeys, who pushed back in the replies to maredia’s post, said that the concerns Lava’s CEO cites with regards to DLCs are elementary (namely, that funds have to stay on a hot wallet connected to the internet and an “oracle” has to translate loan conditions like bitcoin price, expiration, and other details to the DLC).
“Everything he described as being like a security concern with DLCs are the fundamental assumptions at the beginning of designing a DLC-based product…This is not something that surprises you later on.”
Lava’s capitulating on DLCs coincides with its $200 million raise, raising questions about whether or not the custody change was a precondition for the raise – or whether Lava could scale or, as Maredia put it in the early tweet, “build” to the next level without the change.
Has Lava burned user trust or kindled a wider user base?
Lava did not return Blockspace’s question regarding whether or not the raise prompted Lava to ditch DLCs. However, Maredia told Blockspace that he will be releasing a post mortem to clear the air this Wednesday, and we will update this article as relevant.
In addition to the raise’s coincidence with the custody alteration, there are other looming questions, such as whether or not this change will necessitate mandatory know-your-customer for Lava clients in the future.
Ultimately, Lava did not lose user funds in the process, and the “misstep” as Goli called it gives Lava the opportunity to “learn.” The most charitable reading, the argument goes, is that Lava made a decision to prioritize growth at the expense of its non-custodial model, and they fumbled communicating this properly to its users, many of which were attracted by the non-custodial model to begin with.
But to users like Kemeys, the entire ordeal may not have left a sour taste if there had been fair warning, but instead, he feels like Lava’s actions fly in the face of its earlier marketing.
“They were not good at putting themselves in the user’s shoes…because in their eyes, they’ve moved to a superior security model. And that may actually be true, but I didn’t sign up for just whatever Lava decides is the best security model they can provide. I signed up for a particular business model – self custody, your real brand positioning.”
Goli called the change “disrespectful” and said that it undermines user trust.
And trust is hard to come by in the bitcoin-lending business. Last cycle, two of crypto’s premier lenders, BlockFi and Celsius, went bust in the 2022’s tumult of scams and insolvencies.
Conditioned by the blowups of yesteryear, Bitcoiners are generally leery of relinquishing their hard-earned bitcoin to bitcoin-backed loan providers, and Lava’s self-custodial, DLC-based lending was originally hailed as an antidote to the risks of these products.
Now, Lava is moving away from this model in favor of scaling its offering and unlocking lower rates, with the bet resting that more clients will sacrifice custody for lower rates than vice versa.
Kemeys has already closed his Lava account, and there are doubtless others who were attracted by DLC-powered bitcoin loans that have done the same. But Maredia is optimistic, telling Blockspace that “many of Lava’s existing users were really happy with the recent changes since we delivered a much improved product experience, security, and lower rates.”
The bet’s been made – let’s see how the market reacts.
Header image by Toby Elliott via Unsplash.
