Privacy, control, and safety

Spark token transactions are publicly and globally enumerable

Spark expressly excludes tokens from privacy mode, permits anonymous token queries with no wallet filter, and paginates the complete token-transaction table. Returned records expose owner public keys, exact amounts, outputs, status, and timestamps. 1 2 3 4 5 6

6 sourcesEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

Documented behavior

Spark's privacy documentation expressly excludes token transactions. The Operator policy marks token metadata, transaction, and output query methods as unauthenticated. 1 2

Supporting material shown on this page

Spark privacy modeOfficial documentation · docs.spark.money · checked 2026-07-14

unauthenticated token policyPinned source code · github.com · checked 2026-07-14

Relevant lines from the pinned source · open raw file

226	return map[string]Policy{
227		pbtoken.SparkTokenService_StartTransaction_FullMethodName:       {AuthMode: AuthSession},
228		pbtoken.SparkTokenService_CommitTransaction_FullMethodName:      {AuthMode: AuthSession},
229		pbtoken.SparkTokenService_QueryTokenMetadata_FullMethodName:     {AuthMode: AuthUnauthenticated},
230		pbtoken.SparkTokenService_QueryTokenTransactions_FullMethodName: {AuthMode: AuthUnauthenticated},
231		pbtoken.SparkTokenService_QueryTokenOutputs_FullMethodName:      {AuthMode: AuthUnauthenticated},
232		pbtoken.SparkTokenService_FreezeTokens_FullMethodName:           {AuthMode: AuthSession},

Documented behavior

The official read-only client accepts an empty token-query filter. The server then starts from the complete token-transaction table and paginates it, rather than requiring a wallet address or transaction ID. 3 4

Supporting material shown on this page

empty-filter read-only clientPinned source code · github.com · checked 2026-07-14

Relevant lines from the pinned source · open raw file

787      const result = await tokenClient.query_token_transactions({
788        queryType: {
789          $case: "byFilters" as const,
790          byFilters: {
791            outputIds: outputIds ?? [],
792            ownerPublicKeys: ownerPublicKeys ?? [],
793            issuerPublicKeys: issuerPublicKeys?.map(hexToBytes) ?? [],

global token query pathPinned source code · github.com · checked 2026-07-14

Relevant lines from the pinned source · open raw file

454// queryWithEnt runs an ent-based query for simple cases without complicated filters
455func (h *QueryTokenTransactionsHandler) queryWithEnt(ctx context.Context, params *queryParams, db *ent.Client) ([]*ent.TokenTransaction, error) {
456	baseQuery := db.TokenTransaction.Query()
457
458	if len(params.tokenTransactionHashes) > 0 {

Documented behavior
Returned token records contain owner public keys, exact 128-bit amounts, transaction status, outputs, and timestamps. The sanitized live feed observation independently found mint, burn, single-output, and multi-output token records in an unauthenticated network sample. 5 6
Supporting material shown on this page
token output fieldsPinned source code · github.com · checked 2026-07-14
Relevant lines from the pinned source · open raw file
118// structure. This proto is deterministically hashed to generate the 119// token_transaction_hash that is cooperatively signed by the SO group to 120// confirm a token transaction. 121message TokenTransaction { 122 // For mint transactions issuer_public_key will be specified without any 123 // outputs_to_spend. For transfer transactions the token amount in the input 124 // leaves must match the token amount in the output leaves.
sanitized mainnet observationReproducible audit manifest · Review of Spark's trust model · checked 2026-07-14

Interpretation

Why this matters for Spark's trust model

Spark's token layer is not merely visible when an observer already knows a victim's address. It is a globally enumerable pseudonymous ledger from which an observer can discover addresses, follow inputs and outputs, identify change patterns, rank holdings, and build a transaction graph. Enabling Spark privacy does not alter that result. 1 2 3 4 5 6

This section states the trust-model consequence of the cited evidence. Conditional or inferred claims remain bounded by the next section.

Scope control

What this does not establish

Public keys are pseudonyms, not real-world identities by themselves. The design is publicly documented rather than a hidden backdoor, and it does not mean that privacy-enabled Bitcoin transfer history is globally enumerable through the same empty-filter path. 1 4 5

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.