Review of Spark's trust model

Unilateral-exit readiness

Spark's dedicated beta manual lists prerequisites omitted from its short-form exit description

Spark's FAQ says a user can exit at any time by broadcasting a pre-signed transaction. Its dedicated beta manual separately requires Bitcoin Core v29, external L1 UTXOs, economic leaf selection, exact package ordering, mainnet signing and timelock handling, and warns that the wallet is unusable until completion. 13

4 sourcesEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

  1. Documented behavior

    Spark's FAQ says users can exit at any time by broadcasting “your pre-signed transaction,” and its sovereignty page calls the escape hatch unconditional and trustless. 12

    Supporting material shown on this page

    Spark FAQOfficial documentation · docs.spark.money · checked 2026-07-14
  2. Documented requirements

    The dedicated guide labels the feature beta, instructs users to exit only leaves above 16,348 sats, requires Bitcoin Core v29 and external L1 UTXOs, requires exact root-to-leaf ordering, assigns mainnet signing and timelock handling to the user, and says the wallet remains unusable until completion. 3

    Supporting material shown on this page

  3. Published case study

    Blink's published 100,000-sat wallet had a complete 22-leaf graph of 253 package steps. Its economically selected four-leaf recovery still required roughly 24 pre-refund package confirmations, later refund broadcasts, and separate sweeps. 4

    Supporting material shown on this page

    Blink case studyPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    1# Case study: a real Spark unilateral exit on Bitcoin mainnet
  4. Product consequence

    The short description omits the prerequisites that decide whether an ordinary user can exercise the exit during an outage. 134

    Supporting material shown on this page

    Spark FAQOfficial documentation · docs.spark.money · checked 2026-07-14
    Blink case studyPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    1# Case study: a real Spark unilateral exit on Bitcoin mainnet

Documented operational sequence

A durable recovery state machine—not one transaction

  1. Refresh and encrypt current leaves and ancestors while Operators are online
  2. Preserve the bundle separately from the mnemonic
  3. Load the matching seed and bundle during an outage
  4. Provide an external on-chain fee UTXO
  5. Construct and sign parent + CPFP-child packages
  6. Submit packages in valid root-to-leaf order
  7. Persist confirmations and resume after interruptions
  8. Wait through relative timelocks
  9. Construct and broadcast final sweeps
  10. Verify destination confirmations

No reviewed consumer wallet demonstrates this complete sequence in its mobile UI. This establishes an implementation and usability gap, not mobile impossibility.

Scope control

What this does not establish

  • The FAQ describes the protocol-level authorization property; the manual documents one current reference procedure. The contrast establishes omitted operational prerequisites, not that protocol-level exit is false or that every wallet has 253 packages. 134

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

Spark FAQ

Official documentation · docs.spark.money · Live source · checked 2026-07-14

Open original source
2

Spark sovereignty page

Official documentation · docs.spark.money · Live source · checked 2026-07-14

Open original source
3

current unilateral-exit manual

Official documentation · docs.spark.money · Live source · checked 2026-07-14

Open original source
4

Blink case study

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source

How sources, absence findings, and limitations were evaluated