Review of Spark's trust model

Unilateral-exit readiness

Blitz's “no third parties” recovery tool performs a cooperative withdrawal

Blitz's separate recovery site describes recovery without third parties, but its implementation restores a Spark wallet through live services and calls cooperative withdrawal. It does not construct or broadcast unilateral-exit packages. 1

3 sourcesEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

  1. First-party claim

    Blitz's separate Spark Wallet Recovery Tool advertises “Self-custodial. Stateless. Trustless. No third parties involved.” 1

    Supporting material shown on this page

  2. Source behavior

    It initializes a live mainnet SparkWallet, reads balance through getBalance(), requests getWithdrawalFeeQuote(), calls withdraw(), and records a coopExitTxid/COOPERATIVE_EXIT. 1

    Supporting material shown on this page

  3. Absent behavior

    It contains no recovery-bundle ingestion, offline tree state, CPFP construction, ordered broadcast, timelock monitor, or sweep. 1

    Supporting material shown on this page

  4. Related pre-release

    Blitz's wallet can now export a bundle, but sends the user to the external Blink developer repository for the actual exit. 23

    Supporting material shown on this page

    Blitz PR 999Repository record · github.com · checked 2026-07-14

Product-level detail

What Blitz implemented—and what remains external

The conclusions below are reproduced here so the reader does not need to open the separate implementation review. Each result remains limited to the named source snapshot, published binary, or public product surface.

Blitz Wallet

Surface reviewed: public mobile source

The pre-release adds a meaningful exit-state exporter, but the app does not itself fund CPFP children, construct and broadcast the full sequence, persist confirmation progress, wait through timelocks, broadcast refunds, or sweep final outputs.

Capabilities that were present: best-effort online refresh of eligible leaf ancestry; spark.unilateral-exit-bundle.v1 export through the device share sheet; links to external Blink and Spark recovery documentation.

Bundle export is a real prerequisite and is not characterized as useless.

See versions, search method, artifact hashes, and full review limits.

Scope control

What this does not establish

  • This finding concerns the cited Blitz recovery tool and reviewed pre-release. It does not say that cooperative recovery is useless or that Blitz cannot add an in-wallet unilateral path later. 123

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

Blitz recovery tool

Repository record · github.com · Pinned or archival · checked 2026-07-14

Open original source
2

Blitz PR 999

Repository record · github.com · Live source · checked 2026-07-14

Open original source
3

Android 0.7.13-pre6

Repository record · github.com · Live source · checked 2026-07-14

Open original source

How sources, absence findings, and limitations were evaluated