spark.exposed

The exit

No complete in-app unilateral exit was found across twelve reviewed consumer-wallet surfaces

The September 11 review covers nine public-source products, Club Orange’s 4.3.7 APK surface, and public records for Wallet of Satoshi and Bringin. No complete in-app operatorless workflow was found. The two documentation-only findings do not prove absence inside their applications. 1

1 sourceEvidence reviewed through September 11, 2026

Fresh source, release metadata, APK-surface and public-documentation review on September 11. Source and release versions are distinguished; no funded wallet runtime or operator-outage execution was performed.

What the evidence shows

Technical and product details

  1. Reviewed set

    The twelve primary products are Blink, Primal, Cake, Blitz, Radar, Flash, Agicash, Layerz, Club Orange, Wallet of Satoshi, Bringin and Stacker News. Three merchant/beta implementations are compared separately; additional Spark directory listings are unverified and outside the denominator. 1

    Supporting material shown on this page

  2. Fresh implementation review

    Current public source heads were inspected and pinned. Blitz 0.7.15, Cake 6.4.4, Primal Android 3.5.27 and Flash 0.7.1 release sources were also checked separately. Club Orange 4.3.7 was downloaded, hashed and inspected across five DEX files and its native binding. 1

    Supporting material shown on this page

  3. Closed-source boundary

    Wallet of Satoshi publishes clearer Spark-specific recovery guidance. Bringin publishes UI translations. Neither public record supplied a complete outage-recovery procedure; their private executable implementations remain unverified. 1

    Supporting material shown on this page

  4. Product consequence

    No complete in-app workflow was found at the reviewed snapshots. Export and SDK upgrades are useful prerequisites; a separate tool may recover funds when the required current state, keys and funding are available. 1

    Supporting material shown on this page

Product-level detail

What was found in each reviewed wallet

The conclusions below are reproduced here so the reader does not need to open the separate implementation review. Each result remains limited to the named source snapshot, published binary, or public product surface.

Blink

Surface reviewed: public mobile source

The tracked app backup and restore paths center on the mnemonic; no complete recovery-bundle export and operatorless execution workflow was found. The September 11 source snapshot explicitly describes unilateral-exit handling as flows the app never starts.

Capabilities that were present: mnemonic backup and restore; ordinary Breez Spark wallet operations.

The separate Blink command-line recovery project is not treated as an in-app mobile workflow.

Primal

Surface reviewed: public android and ios source

Primal Android now pins Breez 0.23.1 and receives the UnilateralExitStateChanged event, which the inspected handler forwards to its SDK event stream and logs. No application call to initiate, export or execute an exit was found. The iOS wallet still exposes seed-based restore through an opaque PrimalShared 0.3.2 binary dependency; its public UI did not expose a complete operatorless flow.

Capabilities that were present: seed backup and live-network wallet restore; ordinary Breez Spark wallet operations; Android SDK 0.23.1 upgrade and exit-state event handling; no matching application recovery command found.

The result is bounded to the two pinned public repositories and does not test an unpublished build.

Cake Wallet

Surface reviewed: public mobile source

Cake v6.4.4 and the current source pin Breez Flutter 0.23.0. The earlier statement that this wallet still used 0.14.0 is obsolete. The reviewed Lightning adapter calls ordinary SDK payments and deposit refunds, but no current exit-state export or complete operatorless recovery workflow was found.

Capabilities that were present: mnemonic or seed initialization; Spark, Lightning, and cooperative Bitcoin-address payments; upgraded Breez 0.23.0 dependency with SDK exit construction and state export/import capabilities.

The public Cake article describes a protocol-level response to an attack; it does not expressly claim that the audited UI contains an exit button.

Blitz Wallet

Surface reviewed: public mobile source

Stable Android v0.7.15 contains the recovery-bundle exporter previously described as pre-release. It refreshes available state and can export cached leaves and ancestors when the live fetch fails. Its export excludes every leaf below 16,348 sats and records the omitted total. The recovery link opens external Blink tooling; no complete in-app broadcast-and-resume executor was found.

Capabilities that were present: incremental local leaf and ancestor caching with retryable pending state; best-effort online refresh before export, with cached-state fallback when the leaf fetch fails; spark.unilateral-exit-bundle.v1 export through the device share sheet; separate totals for leaves excluded below the application’s 16,348-sat threshold; external Blink recovery tooling and Spark documentation links.

Export is a useful implemented prerequisite. It does not by itself execute an exit or prove the cached graph is complete and current.

Radar

Surface reviewed: public android and ios source

The unchanged Android and iOS source heads expose seed backup and ordinary Spark payments. Neither source-visible interface supplied current exit-state export and an operatorless broadcast, confirmation and restart-recovery workflow.

Capabilities that were present: seed backup and live-network restoration in a Spark-compatible wallet; ordinary Breez Spark wallet operations.

The result is bounded to the two pinned public repositories.

Flash

Surface reviewed: public mobile source and direct release

Flash has upgraded from Breez 0.13.6 to 0.22.3. Its reviewed adapter and recovery screens still provide ordinary payments, deposit refunds and mnemonic import; no current exit-state export or complete operatorless broadcast-and-resume flow was found.

Capabilities that were present: recovery-phrase backup and import; ordinary Spark, Lightning, and cooperative Bitcoin-address payments; user-facing statement that the BTC wallet is non-custodial.

The result is bounded to the pinned public source and does not test a privately distributed build.

Agicash

Surface reviewed: public web wallet source

Agicash now pins its Breez package at 0.23.0-1, replacing the older audited 0.13.5-1 dependency. The inspected account, payment and settings code contains no exit-state export or complete operatorless recovery interface. The dependency upgrade alone does not establish app integration of those capabilities.

Capabilities that were present: mnemonic-derived Spark accounts; Spark send and receive; client-side encryption of wallet data stored through hosted services.

This is a static review of the pinned public source plus the public web surface, not a funded runtime exit test.

Layerz Wallet

Surface reviewed: public multiplatform source and developer preview release

Layerz implements a polished flow named Spark Exit, but its own types specify that the SDK withdraw call is followed by the SSP signing and broadcasting the L1 transaction. It is a cooperative withdrawal, not the defined operatorless exit workflow.

Capabilities that were present: fee-quoted and resumable cooperative Spark withdrawal; persistent tracking of the SSP cooperative-exit request; ordinary Spark wallet operations across several interfaces.

Layerz labels itself a developer preview, so it is not represented as a mature production wallet.

Club Orange

Surface reviewed: published android apk

No unilateral-exit, exit, or recovery operation appears in the 46 exported BreezSdk method names, and the targeted DEX search found no corresponding user-flow strings. The bundled native library nevertheless contains lower-level unilateral-exit primitives.

Capabilities that were present: the bundled native library contains lower-level unilateral-exit primitives.

Symbol and string searches cannot prove the absence of obfuscated or indirectly invoked private code.

Wallet of Satoshi

Surface reviewed: public documentation and source availability

The new recovery-phrase article explicitly says a conventional Bitcoin wallet will not recreate the Spark balance and directs users to compatible Spark software. The disclosure still describes permissionless exits, but the reviewed public instructions do not supply an operator-outage procedure for preserving state and executing recovery. In-app exit support remains unverified because the application code and binary were not inspected.

Capabilities that were present: published description of unilateral exit as a permissionless alternative; seed-backup and ordinary wallet-restore guidance; explicit documentation that Spark recovery needs compatible key derivation and software.

No source-code absence claim is made.

Bringin

Surface reviewed: public documentation and source availability

Bringin now publishes mobile UI translations, but not the executable application in its public organization. The reviewed strings describe cloud and twelve-word backups; no operational operatorless-exit procedure was found in those strings or the cited product material. Its public claim of pre-signed exits remains an unverified implementation claim.

Capabilities that were present: first-party claim that each wallet ships with pre-signed exits and can leave without Bringin cooperation.

No source-code absence claim is made because Bringin does not publish the reviewed mobile-app source.

Stacker News

Surface reviewed: public web wallet source

The public source now offers Spark to all users, replacing the previously reviewed administrator-only restriction. Its wallet notice explicitly states that this wallet lacks unilateral exit. The reviewed adapter sends ordinary Lightning payments and provides no operatorless recovery executor.

Capabilities that were present: mnemonic-backed embedded Spark wallet and ordinary Lightning payments; explicit in-wallet warning that unilateral exit is absent.

The availability statement is verified in source; no logged-in production rollout or runtime exit test was performed.

See versions, search method, artifact hashes, and full review limits.

Scope control

What this does not establish

  • This is not a claim that unilateral exit is impossible, that every Spark wallet was audited, or that uninspected private code lacks recovery. Separate tools can recover with adequate current state and funding. No funded wallet runtime or outage exit was performed in this review. This is a static review of mixed source, binary and documentation evidence. A separate sweep is unnecessary when recovery already produces confirmed spendable wallet-controlled Bitcoin. 1

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

consumer-wallet exit audit manifest

Reproducible audit manifest · Review of Spark's trust model · Pinned or archival · checked 2026-09-11

Open original source

How sources, absence findings, and limitations were evaluated