Rotating a static deposit address does not rotate its Operator-side identity

What the evidence shows

Technical and product details

1. Documented behavior

   Spark's implementation describes static-address rotation as useful for privacy, but archives the old address and creates its replacement under the same authenticated owner identity key. 1

   Supporting material shown on this page

   static-address rotation and identityPinned source code · github.com · checked 2026-07-14

   799	if err != nil {
   800		return nil, fmt.Errorf("failed to create archive statement: %w", err)
   801	}
   802	signature := ecdsa.Sign(config.IdentityPrivateKey.ToBTCEC(), messageHash)
   803
   804	// Send gossip message to archive the address on all other SOs
   805	selection := helper.OperatorSelection{Option: helper.OperatorSelectionOptionExcludeSelf}

2. Documented behavior

   Deposit-address rows bind each immutable address to an immutable owner identity. The address query groups records by that identity without excluding archived addresses. 23

   Supporting material shown on this page

   immutable address-to-identity recordsPinned source code · github.com · checked 2026-07-14

   51		field.Enum("network").GoType(btcnetwork.Unspecified).
   52			Immutable().
   53			Comment("Network on which the deposit address is valid.").
   54			Optional().
   55			Annotations(entexample.Default(btcnetwork.Regtest)),
   56		field.Bytes("owner_identity_pubkey").
   57			Immutable().

   identity-grouped static-address queryPinned source code · github.com · checked 2026-07-14

   428	if err != nil {
   429		return nil, errors.InvalidArgumentMalformedField(fmt.Errorf("failed to convert proto network to common network: %w", err))
   430	}
   431	query := db.DepositAddress.Query().
   432		Where(depositaddress.OwnerIdentityPubkey(idPubKey)).
   433		Where(depositaddress.IsStatic(true)).
   434		Order(ent.Desc(depositaddress.FieldID)).

3. Documented behavior

   Rotation gossips the owner identity and old address to every other Operator so that all Operators archive the same record. 14

   Supporting material shown on this page

   static-address rotation and identityPinned source code · github.com · checked 2026-07-14

   799	if err != nil {
   800		return nil, fmt.Errorf("failed to create archive statement: %w", err)
   801	}
   802	signature := ecdsa.Sign(config.IdentityPrivateKey.ToBTCEC(), messageHash)
   803
   804	// Send gossip message to archive the address on all other SOs
   805	selection := helper.OperatorSelection{Option: helper.OperatorSelectionOptionExcludeSelf}

   archive gossip fieldsPinned source code · github.com · checked 2026-07-14

   182// This marks the old address as archived (is_default=false) on all SOs.
   183// Archived addresses are still queryable and able to accept deposits.
   184// The coordinator signs this operation to prevent unauthorized archiving by rogue SOs.
   185message GossipMessageArchiveStaticDepositAddress {
   186    bytes owner_identity_public_key = 1;
   187    spark.Network network = 2;
   188    string address = 3;  // Specific address to archive

Scope control

What this does not establish

• Rotation can still reduce address reuse and improve privacy against external Bitcoin-chain observers. The precise finding is the retained Operator-side cluster; public queryability remains subject to privacy enforcement. 13

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.