Review of Spark's trust model

Privacy, control, and safety

Lightspark is the fixed default coordinator and the reviewed SDKs do not fail over automatically

The reviewed Spark and Breez SDK snapshots each configure three Operators with a 2-of-3 threshold but select Lightspark SO0 by fixed identifier or index. No automatic coordinator rotation or failover was found in either snapshot; integrators can supply custom configurations. 123

3 sourcesEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

  1. Documented behavior

    The public/default topology has three Operators and a 2-of-3 signing threshold, but selects Lightspark SO0 as one fixed coordinator. 1

    Supporting material shown on this page

    default topology and coordinatorPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    191  readonly network?: NetworkType;
192  readonly signingOperators?: Readonly<Record<string, SigningOperator>>;
193  readonly tls?: TlsOptions;
194  readonly coordinatorIdentifier?: string;
195  readonly frostSignerAddress?: string;
196  readonly threshold?: number;
197  readonly tokenSignatures?: "ECDSA" | "SCHNORR";
  2. Documented behavior

    Numerous JavaScript flows call that configured coordinator; Breez's independent implementation likewise stores one coordinator index. Neither reviewed SDK contains automatic coordinator rotation or failover to SO1/SO2 when SO0 refuses or is unavailable. 123

    Supporting material shown on this page

    default topology and coordinatorPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    191  readonly network?: NetworkType;
192  readonly signingOperators?: Readonly<Record<string, SigningOperator>>;
193  readonly tls?: TlsOptions;
194  readonly coordinatorIdentifier?: string;
195  readonly frostSignerAddress?: string;
196  readonly threshold?: number;
197  readonly tokenSignatures?: "ECDSA" | "SCHNORR";
    JavaScript coordinator lookupPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    207  public getCoordinatorAddress(): string {
208    const coordinator =
209      this.config.signingOperators[this.config.coordinatorIdentifier];
210    if (!coordinator) {
211      throw new SparkError("coordinator not found in signing operators");
212    }
    Breez coordinator poolPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    17#[derive(Clone, Debug, Deserialize, Serialize)]
18pub struct OperatorPoolConfig {
19    coordinator_index: usize,
20    operators: Vec<OperatorConfig>,
21}

Interpretation

Why this matters for Spark's trust model

The threshold should not be mistaken for equivalent front-end liveness. Lightspark remains a practical coordination dependency for many ordinary operations even when two cryptographic signatures would suffice. 123

This section states the trust-model consequence of the cited evidence. Conditional or inferred claims remain bounded by the next section.

Scope control

What this does not establish

  • Custom configurations can choose another coordinator, and fixed coordination does not let SO0 forge the other Operators' signatures. 123

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

default topology and coordinator

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
2

JavaScript coordinator lookup

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
3

Breez coordinator pool

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source

How sources, absence findings, and limitations were evaluated