Review of Spark's trust model

Privacy, control, and safety

Spark's preimage-share consensus path enforces the wallet gate even for SSP and LNURL callers

Spark's reviewed V2 preimage-share consensus path applies the wallet gate to the affected user even when an SSP, LNURL provider, or another hosted actor makes the call. The source says each Operator checks the identity during the Prepare phase. 1

1 sourceEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

  1. Documented behavior

    The preimage-share path intentionally lacks a normal caller/user session match because an SSP, LNURL provider, or other hosted actor may act for the user. It therefore applies the gate directly to the affected user's identity. 1

    Supporting material shown on this page

    preimage-share consensus handlerPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    176	// No session-identity check on the V2 path either: LNURL/hosted callers
177	// may store on behalf of the user. Apply the wallet kill switch on the
178	// affected user identity directly so an SSP (or any other caller) cannot
179	// store shares for a frozen wallet on this SO. Runs on every SO during
180	// the consensus Prepare phase, so a frozen identity aborts the run on all
181	// operators rather than just the coordinator.
182	if err := authz.EnforceWalletNotKillSwitched(ctx, userIdentityPubKey); err != nil {
  2. Documented behavior

    The code comment says the check runs on every SO during the consensus Prepare phase and aborts the run for the frozen identity. 1

    Supporting material shown on this page

    preimage-share consensus handlerPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    176	// No session-identity check on the V2 path either: LNURL/hosted callers
177	// may store on behalf of the user. Apply the wallet kill switch on the
178	// affected user identity directly so an SSP (or any other caller) cannot
179	// store shares for a frozen wallet on this SO. Runs on every SO during
180	// the consensus Prepare phase, so a frozen identity aborts the run on all
181	// operators rather than just the coordinator.
182	if err := authz.EnforceWalletNotKillSwitched(ctx, userIdentityPubKey); err != nil {

Interpretation

Why this matters for Spark's trust model

Moving the call through a hosted intermediary does not evade the control. The check is deliberately placed inside the multi-operator Lightning settlement path. 1

This section states the trust-model consequence of the cited evidence. Conditional or inferred claims remain bounded by the next section.

Scope control

What this does not establish

  • Each SO reads its own local knob. This proves enforcement in the reviewed V2 preimage-share consensus path, not every possible hosted Lightning operation; public code does not disclose production knob control or network-wide activation. 1

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

preimage-share consensus handler

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source

How sources, absence findings, and limitations were evaluated