swap it like it's hot
a deep dive into Lava.xyz
A new whitepaper got dropped by Lava Global Inc on August 16, 2024, for the Lava Loans Protocol v2. They also released a really slick demo of taking out a loan against your bitcoin.
Let’s dig into what they’re doing, and how these loans work. They’re the first two-step contract I’ve seen for bitcoin “native” loans, and have a pretty unique bitcoin script design that uses atomic swaps and DLCs (discreet log contracts) to govern the issuance of the stablecoins for your bitcoin collateral and then monitoring the contract price for bitcoin during the loan duration to make sure the price doesn’t slip too far, and let the loan originator take your collateral.
tl;dr: You doing a bitcoin/solana swap for their proprietary, USD backed Solana** coin called LavaUSD. The bitcoin collateral can be liquidated or expired directly via bitcoin transactions thanks to the magic of DLCs.
** Because in theory you could use a different chain, they’re using Solana right now.
How it works
On-chain loans tend to follow the same playbook. You take an amount of a ‘collateral asset’, let’s say $10k of it. This gets locked into a contract. The contract then emits some “loan to value” ratio, let’s say 30%. So you’d get $3k in USD out. That’s the setup or ‘swap’ phase.
During the duration of the loan, if the value of the bitcoin collateral you put up dips beneath a certain loan-to-value ratio, let’s say 50%, your loan gets liquidated. The lender gets all of your collateral and the loan is effectively canceled. You get to keep the USD that you were given, the loan originator gets to keep your bitcoin. If the bitcoin price dips enough such that your bitcoin is now worth $5k, you’d get liquidated. You’d keep the $3k that you got, the lender keeps your bitcoin. (I think my math is a bit inexact math, but the illustration is accurate).
Lava’s v2 loan protocol relies on two bitcoin script contracts and a Solana contract. to make all this work. The general idea is that you take some bitcoin, you do an atomic swap for a USD-backed stablecoin on Solana. You can then trade your Solana stablecoin for the USD equivalent, and transfer that out to a bank account. Once you’ve swapped the bitcoin for LavaUSD on Solana’s chain, the loan originator can move the bitcoin you’ve locked as collateral into a second bitcoin script, one which uses two sets of DLCs to monitor both the duration of the loan and then what to do if the loan hasn’t been paid back before the loan duration expires.
There’s two pieces here. First you execute a cross-chain swap of your bitcoin (to the lender) and the LavaUSD (to the borrower). This is the first bitcoin script listed in the Lava Loans Protocol v2 paper.
How it works: the borrower locks up their bitcoin (the collateral) into a bitcoin UTXO who’s script has two different unlock paths. Either the borrower can wait a certain number of blocks and get their funds back (the time out case) or the lender can move the funds from that bitcoin script into a *second* bitcoin script. (Basically they make a bitcoin transaction that spends the funds out of the first script and locks them into a second script.) The lender can’t move the funds into the second script until the borrower executes an atomic swap and pulls LavaUSD out of a contract on Solana. This exposes a secret that allows the lender to use the second unlock, and move the funds into a second UTXO, which is locked by a “DLC” governed script.
This second script, “DLC” script basically governs the ‘loan during the duration’. From this point on there’s only three ways to get the collateral out. It can be liquidated; it can be returned to the lender after they’ve paid the loan back plus interest on the Solana side; or it gets divvy’d up between the lender and borrower on the date that the loan expires.
Restated more concisely: the basic idea is to do an atomic swap of bitcoin to LavaUSD (bitcoin/solana cross chain swap). After the swap is executed, move the bitcoin collateral into a second DLC bitcoin contract which has three different ways to be unlocked (liquidated, paid back, expired).
The Swap
Cross chain swaps are fairly basic and well understood at this point. The borrower puts their bitcoin into a transaction where they can’t get it back until a timeout. They’ll also put in this transaction a payout clause where the funds can move to the DLC-contract, but only if the lender signs off on it and the lender can prove they know a secret.
Once the borrower’s funds are locked into this swap transaction, the lender should publish on the Solana contract funds to borrow. These funds should only be claimable to the person who knows the same secret that will unlock the funds on the bitcoin contract.
The borrower will publish a Solana transaction that includes the secret only they know, making it public. This will allow them to access the loan funds.
The lender will be watching the Solana chain for this transaction. Once the lender sees the LavaUSD get claimed by the borrower, they’ll have the secret they need to go back to the bitcoin chain and make an onchain transaction that moves the bitcoin collateral from the swap-staging UTXO into a DLC “holding” UTXO.
After the borrower has claimed the LavaUSD on Solana, and the lender has moved the bitcoin collateral into the DLC “holding” UTXO, the swap has been successfully executed and the loan is in effect.
It takes two bitcoin transactions and one* Solana transactions to initialize the loan.
(*I’m guessing one Solana transaction, but there’s no way to verify this with the information the team has put out so far, as the Solana contracts haven’t been published or linked to in the paper).
Managing the Loan
There’s two ‘normal’ exit cases for a loan: paying the loan back or the loan expiring at term. Let’s say that it’s a loan for 90 days.
You can pay the loan back, with interest, any time before the 90 days expires. The borrower does this by sending LavaUSD (loan amount plus owed-interest) to the Solana contract and telling it that you want to do a pay off. You do this with a Solana transaction (guessing here). You then wait for the lender to execute a second Solana transaction which accepts your loan payoff. This loan acceptance transaction carries a secret that only the lender knew, but which can be used by the borrower to get their bitcoin out of the DLC contract.
It’s possible that the lender may not accept your loan payoff, and instead will wait until the loan expires, or possibly gets liquidated. The protocol attempts to prevent inaction on the part of the lender on terminating the loan by requiring the lender to over-supply LavaUSD to the Solana contract. This ‘oversupply’ is called the lender’s Stake. It sits in the Solana contract until the loan is terminated. Its purpose is to incentivize the lender to claim back both their stake as well as the loan payoff.
The other ‘normal’ exit case for the loan is that the 90-days ends and the loan hasn’t been repaid. Let’s say that this is the loan expiring. This is the first use case for the “DLC” portion of the protocol. The other exit case, which also uses DLCs, is for liquidating the loan.
What is a DLC?
DLC is short for ‘discreet log contract’. The basic idea is that two parties agree on a payout schedule that depends on an event’s outcome. They both then pre-generate a large number of signatures for the range of values that the outcome can be within.
You then wait for the event to happen, so you know what the outcome is.
There’s a service that will produce a signed message which ‘attests’ to what the event’s outcome is. The name of this service is called an “oracle”. The oracle can only ever sign one message for the event.
The oracle’s signature can then be combined with one (and only one!) of the pre-generated signatures between the two parties. That signature will validate a bitcoin transaction that pays out the two parties a pre-agreed amount, based on what the oracle says happened.
These contracts are used in two places in the Lava protocol: for liquidation and for loan termination.
Liquidating the Loan
For the Lava protocol, at loan setup, two sets of DLC signatures have to be calculated. One for the liquidation case, and another for the expiration case.
For liquidation, you need a signature that will give the lender the right to claim all of the collateral. This signature is only valid if the oracle signs an event that says the price of bitcoin is below a certain number.
The price oracle that Lava is using produces one new event every day, which says what the BTCUSD price is. This means that at set up time, the two parties will need to make a DLC liquidation signature set for every day that the loan is valid. (Note that the ‘signature sets’ are called CETs in DLC vocabulary).
Why only once a day?
Setup for a DLC contract can be quite time and space intensive. The more oracle events that you need to make CETs for, the more time and CPU and hard disk space you’ll need both to generate and then store the signatures for possible outcomes. By limiting the oracle events to once a day, you cut down on the amount of time it takes to set these up.
I’m guessing here, but I would bet that the expense of DLC setup is a large contributing factor to the oracle only emitting daily events.
Expiring the Loan
Loan expiration has a second, separate DLC setup from liquidation. This will require a second set of CETs. These will be signed to a single oracle event: the price of the BTCUSD pair on the day that the loan expires. This set of CETs will pay out to both the lender and the borrower, depending on what the collateral is worth on the expiration date and the amount of interest owed.
The Lava Loans Protocol v2 paper goes into depth about the tradeoffs of how precise the payout return should be. This again is tied to how computationally intensive it is to generate CETs. The more precise the loan payout, the more CETs you need to generate. The less precise the payout, the fewer CETs, which means much less CPU usage and less storage space on the client’s device.
Potential Drawbacks
Overall I think this is a pretty solid loan contract construction. There’s a few drawbacks however. The first is that you’re relying on an oracle to say what the price is once a day. If there’s big intraday swings in the price, I’m not sure how you’d have confidence that the price the oracle signed is going to liquidate your position or not.
They could switch to hourly oracle price updates, but that would 24x the amount of data and computation time required to setup the DLC contracts for the liquidation portion. You can find their current price oracle feed, with its daily events, here.
Another thing to note is that their swap protocol requires the lender to put up a stake of some amount of USD into the Solana contract in order to initialize the loan. This means that the Lava organization (or whoever’s facilitating these loans) needs to be over-capitalized in USD terms.
Since it’s a USD-backed stablecoin, they’ll also need enough cash on hand to transfer out to customers as requested. Their info on LavaUSD says that they’re holding cash and cash-equivalents, which means that if too many people try to withdraw LavaUSD to their bank accounts at once, the Lava project will need to sell or liquidate their treasuries in order to meet withdrawal demand.
Solana??
In order to make this protocol work, you *have* to have another on-chain USD denominated asset to execute the cross chain swap with. For the initial iteration of this protocol, they’re using Solana.
I found it notable that the bitcoin scripts used for the swaps and loan management portions are included in the paper; the Solana contract is not mentioned or cited, nor is there any trace of it in any of the Lava Github repos.
In fact, the only place where I was able to find mention of where the LavaUSD is issued/supported is on lava.xyz/lavausd in the FAQ.
Based on the lack of a mention of Solana anywhere, in any of the press information or otherwise about the project, I’m assuming this means that they’re planning to move off of Solana as their stablecoin chain (or add others) at some point in the future. Moving to a different chain won’t change the bitcoin portion of the contracts. Any chain that is publicly readable and can use hashes as locks on funds will work for executing the atomic swap.
In exitus
I really enjoyed figuring out what the bitcoin contracts are doing. Notably, the swap bitcoin contract uses an OP_CODESEPARATOR, which is a very niche Bitcoin script opcode. It’s used to make sure that the funds can be transferred only to the DLC contract when the borrower claims the LavaUSD for their loan on the Solana chain. The borrower gives the lender a signature that’s only valid in the if-case where the lender also signs and knows the secret for unlocking the swap collateral. The op-codeseparator prevents this same borrower’s signature from being usable for the timeout clause in the same contract.
As far as I can tell, the most novel part of this project is marrying the swap contract to the DLC contracts. Lava’s protocol lets you swap collateral for a USD-equivalent and then move it into a DLC contract that governs the lifetime of the loan.
It’s pretty nifty to see loan origination costs get cut down to just two onchain bitcoin transactions and some number of Solana ones!
This is a pretty cool project. It’s very cool to see bitcoin-backed loan logic moving into DLCs which determine who gets paid out what directly on the bitcoin chain.