spark.exposed

Centralization

Spark Operator code contains an identity-targeted refusal control

The wallet-identity gate can refuse relevant state-changing operations while preserving reads. Each operator controls its own setting. Separately, one required participant can block fresh all-operator preparation; two refusing operators can deny the two-share signing threshold. 1234

4 sourcesEvidence reviewed through September 11, 2026

Content checked against the September 11 source audit. Historical measurements and product searches retain their stated dates; deployed configuration and later releases are not independently attested.

What the evidence shows

Technical and product details

  1. Documented behavior

    Spark commit 08db5de, titled “Add wallet kill switch for state-mutating RPCs,” added 390 lines across 18 files. Its summary says it can disable state mutations for a specific wallet. 1

    Supporting material shown on this page

  2. Documented behavior

    The exact control is spark.so.killswitch.wallet@<identity_pubkey_hex> = 1. It targets a wallet identity public key while leaving read-only calls available. 2

    Supporting material shown on this page

    knob definitionPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    65	// KnobKillSwitchWallet blocks state-mutating user-facing operations for a
66	// specific wallet identity public key. Set
67	// spark.so.killswitch.wallet@<identity_pubkey_hex> = 1 to freeze that wallet.
68	// Default 0 (allowed). The check is per-SO; for a system-wide freeze set
69	// this on every SO's knob ConfigMap. Read-only RPCs are unaffected.
70	KnobKillSwitchWallet = "spark.so.killswitch.wallet"

Interpretation

Why this matters for Spark's trust model

Spark Operators already possess a selective denial primitive keyed to the durable identity encoded by a Spark address. No protocol upgrade, wallet release, or public on-chain action is needed to target one identity's ability to transact. 3

This section states the trust-model consequence of the cited evidence. Conditional or inferred claims remain bounded by the next section.

Scope control

What this does not establish

  • The gate is local to each operator and defaults to allowing wallets. The source comment about configuring every operator describes uniform gate deployment, not the minimum needed to obstruct every protocol flow. Fresh all-participant preparation can fail on one refusal; a failure after commit is different. No production activation or sanctions motive is established. Valid presigned Bitcoin exits remain independent of this gate. 1234

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

origin commit

Code commit · github.com · Pinned or archival · checked 2026-07-14

Open original source
2

knob definition

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
3

All-participant prepare failure

Pinned source code · github.com · Pinned or archival · checked 2026-09-11

Open original source
4

All-operator participant selection

Pinned source code · github.com · Pinned or archival · checked 2026-09-11

Open original source

How sources, absence findings, and limitations were evaluated