Lava service changes custody arrangements, communicated to users as an "upgrade"

Lava offered self-custody loans using DLC (discrete log contracts).

An update changed this from the non-custodial setup to a fully trusted and custodial model, with Lava now having full control over users funds.

This fundamental change was not communicated to user in the upgrade process

After the controversy blew up, Shehzan of Lava had the following to say:

"Lava no longer uses DLCs — discrete log contracts — for loans because the technology doesn’t meet our security standards. Our team built the largest application using DLCs, but we discovered vulnerabilities that we weren’t comfortable having (ex., client-side key risk, hot keys)."

"Risks we previously thought were impossible, such as thinking oracles couldn’t be manipulated to liquidate individual users, we figured out were possible in practice. We are unwilling to compromise on security for our users at any level, and we take a very holistic view on removing trust, dependencies, and counterparty risk."

Screenshots of the language used in the upgrade notice to user:

https://x.com/OwenKemeys/status/1986206658486227396?s=20

https://bitcoinmagazine.com/business/lava-abandons-self-custody-amidst-fund-raise-sparking-controversy