Historical Spark policy grants a Lightspark-only SSP interface privileged reads

What the evidence shows

Technical and product details

1. Documented behavior

   The pinned historical Operator snapshot defines a build-tagged SparkSspInternalService as a “Lightspark-only SSP coordination surface.” Its IP-restricted methods include cross-wallet node, transfer, static-address, tree-snapshot, and node-detail queries. 1

   Supporting material shown on this page

   Lightspark-only SSP interfacePinned source code · github.com · checked 2026-07-14

   6	pbssp "github.com/lightsparkdev/spark/proto/spark_ssp_internal"
   7)
   8
   9// SparkSspInternalService is the Lightspark-only SSP coordination surface.
   10// Every method is IP-protected; subsets either accept anonymous callers (legacy "ops" RPCs) or require a session token
   11// (newer flows that go through the same sspcore client used by external partners).
   12func init() {

2. Documented behavior

   Transfer and node-query handlers skip ordinary wallet- privacy checks when invoked with the SSP flag. A pinned Spark commit says the static-address endpoint likewise passes isSSP=true so the SSP can keep reading addresses across wallets after the public privacy filter is enabled. 234

   Supporting material shown on this page

   SSP transfer privacy bypassPinned source code · github.com · checked 2026-07-14

   2208		hasReadAccess, err := NewWalletSettingHandler(h.config).HasReadAccessToWallet(ctx, *walletIdentityPubkey)
   2209		if err != nil {
   2210			return nil, fmt.Errorf("failed to check if viewer has read access to wallet %s: %w", walletIdentityPubkey, err)
   2211		}
   2212		if !hasReadAccess {
   2213			return &pb.QueryTransfersResponse{
   2214				Offset: -1,

   SSP node-query privacy bypassPinned source code · github.com · checked 2026-07-14

   74			return nil, errors.InvalidArgumentMalformedKey(fmt.Errorf("failed to parse owner identity public key: %w", err))
   75		}
   76		if !isSSP {
   77			hasReadAccess, err := NewWalletSettingHandler(h.config).HasReadAccessToWallet(ctx, ownerIdentityPubKey)
   78			if err != nil {
   79				return nil, fmt.Errorf("failed to check if privacy is enabled for owner: %w", err)
   80			}

   static-address bypass commitCode commit · github.com · checked 2026-07-14

Scope control

What this does not establish

• This is an internal, IP-restricted service, not a public authentication vulnerability. The code proves privileged read paths, not that every listed method returns every private record, how data is retained, or who inside Lightspark can access it. The policy_lightspark.go file was absent from the September 11 official checkout. Its absence does not establish removal from production; current fork implementations are separate evidence. 12345

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.