Review of Spark's trust model

Unilateral-exit readiness

A Spark destination amount does not disclose the exit's net economic recovery

Blink’s exit mechanics separate the amount eventually swept from the Spark wallet, leaf value excluded by economic triage, and independent on-chain bitcoin spent on CPFP and funding transactions. A destination amount is therefore not the same measure as net economic recovery. 123

3 sourcesEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

  1. Fee mechanism

    Spark exit and refund transactions are pre-signed at zero fee; the user must fund their CPFP fee bumps from an independent on-chain UTXO. 1

    Supporting material shown on this page

    Blink fee-funding mechanicsPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    40## Step 2: fee funding from the same seed
    41
    42Exit transactions are pre-signed with zero fee and pay fees through CPFP
    43ephemeral anchors, so the exit needs an independent L1 UTXO to fund fee bumps.
    44The CLI derives a dedicated funding address from the wallet seed itself
    45(path `m/8797556'/<account>/0`, only the purpose hardened so a watch-only
  2. Leaf triage

    Blink's recovery tool prices each leaf separately using the CPFP cost of its chain plus the final sweep cost, and skips leaves whose recovery cost exceeds their value by default. 2

    Supporting material shown on this page

    Blink leaf economicsPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    90Four leaves (32,768 + 32,768 + 16,384 + 8,192 sats) held 90% of the balance.
    91The other 18 — dust from routine wallet activity, some as small as 1 sat —
    92would each have cost 2,100–4,600 sats to exit: exiting everything would have
    93spent ~77.5k sats in fees to recover 100k. The tooling now computes this per
    94leaf and skips uneconomical leaves by default (`INCLUDE_UNECONOMICAL=1`
    95overrides; the economics math is regression-tested against this very bundle,
    96adapted to regtest, in
  3. Accounting consequence

    Value swept to the destination, Spark value omitted as uneconomical, and separately supplied on-chain fee funding are different components. The destination amount alone therefore cannot establish the user's net economic recovery. 123

    Supporting material shown on this page

    Blink fee-funding mechanicsPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    40## Step 2: fee funding from the same seed
    41
    42Exit transactions are pre-signed with zero fee and pay fees through CPFP
    43ephemeral anchors, so the exit needs an independent L1 UTXO to fund fee bumps.
    44The CLI derives a dedicated funding address from the wallet seed itself
    45(path `m/8797556'/<account>/0`, only the purpose hardened so a watch-only
    Blink leaf economicsPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    90Four leaves (32,768 + 32,768 + 16,384 + 8,192 sats) held 90% of the balance.
    91The other 18 — dust from routine wallet activity, some as small as 1 sat —
    92would each have cost 2,100–4,600 sats to exit: exiting everything would have
    93spent ~77.5k sats in fees to recover 100k. The tooling now computes this per
    94leaf and skips uneconomical leaves by default (`INCLUDE_UNECONOMICAL=1`
    95overrides; the economics math is regression-tested against this very bundle,
    96adapted to regtest, in
    Blink exit accountingPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    111| **arrives at the destination address** | **89,668** |
    112| dust in 18 uneconomical leaves, left behind in Spark | 9,888 |
    113
    114Spark exit and refund transactions are pre-signed with **zero fee** (fees ride
    115the CPFP anchors), so each refund output carries the full leaf value; the only
    116deduction from the wallet balance itself is the final sweep fee.
  4. Additional cost

    The transaction that funds the CPFP address is itself outside the displayed Spark balance and outside the destination amount. 13

    Supporting material shown on this page

    Blink fee-funding mechanicsPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    40## Step 2: fee funding from the same seed
    41
    42Exit transactions are pre-signed with zero fee and pay fees through CPFP
    43ephemeral anchors, so the exit needs an independent L1 UTXO to fund fee bumps.
    44The CLI derives a dedicated funding address from the wallet seed itself
    45(path `m/8797556'/<account>/0`, only the purpose hardened so a watch-only
    Blink exit accountingPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    111| **arrives at the destination address** | **89,668** |
    112| dust in 18 uneconomical leaves, left behind in Spark | 9,888 |
    113
    114Spark exit and refund transactions are pre-signed with **zero fee** (fees ride
    115the CPFP anchors), so each refund output carries the full leaf value; the only
    116deduction from the wallet balance itself is the final sweep fee.

Scope control

What this does not establish

  • This does not establish that every Spark exit is uneconomical. The result depends on fee rate and each leaf's value and chain depth; large, shallow leaves can remain economical. 23

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

Blink fee-funding mechanics

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
2

Blink leaf economics

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
3

Blink exit accounting

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source

How sources, absence findings, and limitations were evaluated