Review of Spark's trust model

Privacy, control, and safety

Current Spark code contains an identity-targeted wallet kill switch

The reviewed Operator snapshot defines a per-wallet, per-Operator control named as a wallet kill switch and keyed by the wallet identity public key. Relevant state-changing handlers enforce it while read-only calls remain available; a network-wide freeze requires configuring every Operator. 12

2 sourcesEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

  1. Documented behavior

    Spark commit 08db5de, titled “Add wallet kill switch for state-mutating RPCs,” added 390 lines across 18 files. Its summary says it can disable state mutations for a specific wallet. 1

    Supporting material shown on this page

  2. Documented behavior

    The exact control is spark.so.killswitch.wallet@<identity_pubkey_hex> = 1. It targets a wallet identity public key while leaving read-only calls available. 2

    Supporting material shown on this page

    knob definitionPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    65	// KnobKillSwitchWallet blocks state-mutating user-facing operations for a
66	// specific wallet identity public key. Set
67	// spark.so.killswitch.wallet@<identity_pubkey_hex> = 1 to freeze that wallet.
68	// Default 0 (allowed). The check is per-SO; for a system-wide freeze set
69	// this on every SO's knob ConfigMap. Read-only RPCs are unaffected.
70	KnobKillSwitchWallet = "spark.so.killswitch.wallet"

Interpretation

Why this matters for Spark's trust model

Spark Operators already possess a selective denial primitive keyed to the durable identity encoded by a Spark address. No protocol upgrade, wallet release, or public on-chain action is needed to target one identity's ability to transact. 12

This section states the trust-model consequence of the cited evidence. Conditional or inferred claims remain bounded by the next section.

Scope control

What this does not establish

  • The knob is local to each SO. The source says a system-wide freeze requires configuring every Operator; the public record does not show a production value or say the control was created for sanctions. 12

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

origin commit

Code commit · github.com · Pinned or archival · checked 2026-07-14

Open original source
2

knob definition

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source

How sources, absence findings, and limitations were evaluated