Review of Spark's trust model

Privacy, control, and safety

Spark's forward security depends on unverifiable deletion of old Operator shares

Spark's own research calls deletion of historical Operator shares an unverifiable operational promise. The implementation contains real ephemeral-storage and cleanup controls, but it permits brief version coexistence, best-effort deletion, and a documented legacy main-database fallback. 12345

5 sourcesEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

  1. Documented behavior

    Spark's own statechain research calls old-key deletion an operational promise rather than a cryptographic guarantee and says there is no proof or on-chain mechanism that can verify data destruction. 12

    Supporting material shown on this page

  2. Documented behavior

    The reviewed implementation creates a separate ephemeral database for secrets that must not be backed up, rotates secret versions, and attempts to delete prior versions. Its documentation says old and new versions may coexist briefly and describes deletion as best effort, backed by a later cleanup task. 345

    Supporting material shown on this page

    old-version deletion logicPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    238		return
239	}
240
241	if keyshare.SecretVersion != nil && *keyshare.SecretVersion == newVersion {
242		recordSigningKeyshareSecretCleanupOutcome(ctx, "main_references_new")
243		if oldVersion != nil && !deleteSigningKeyshareSecretVersionBestEffort(ctx, signingKeyshareID, *oldVersion, reason+" delete old") {
244			recordSigningKeyshareSecretCleanupOutcome(ctx, "delete_old_failed")
    Operator share rotationPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    847// TweakKeyShare tweaks the given keyshare with the given tweak, updates the keyshare in the database and returns the updated keyshare.
848func (sk *SigningKeyshare) TweakKeyShare(ctx context.Context, shareTweak keys.Private, pubKeyTweak keys.Public, pubKeySharesTweak map[string]keys.Public) (*SigningKeyshare, error) {
849	ctx, span := tracer.Start(ctx, "SigningKeyshare.TweakKeyShare")
850	defer span.End()
851
852	if err := HydrateSigningKeyshareSecrets(ctx, []*SigningKeyshare{sk}); err != nil {
853		return nil, err
  3. Documented behavior

    The same implementation documents a legacy fallback that stores the secret share in the main database when the ephemeral database is unavailable; public sources do not attest which production storage and backup configuration each Operator uses. 3

    Supporting material shown on this page

Interpretation

Why this matters for Spark's trust model

Users cannot independently verify the act on which forward security depends. If a threshold of historical Operator shares and the matching former-owner key survive, those keys can still authorize a fresh conflicting spend. 12345

This section states the trust-model consequence of the cited evidence. Conditional or inferred claims remain bounded by the next section.

Scope control

What this does not establish

  • The public code contains concrete deletion and cleanup controls. Nothing reviewed shows those controls failing in production or any Operator intentionally retaining an old share. 345

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

Spark statechain key-deletion analysis

Web source · spark.money · Live source · checked 2026-07-14

Open original source
2

Spark trust model

Official documentation · docs.spark.money · Live source · checked 2026-07-14

Open original source
3

ephemeral secret-storage design

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
4

old-version deletion logic

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
5

Operator share rotation

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source

How sources, absence findings, and limitations were evaluated