Review of Spark's trust model

Unilateral-exit readiness

Wallet usage history—not just balance—determines Spark's exit workload

Normal Spark use can split and re-split wallet state into multiple leaves, each with an independently sequenced exit chain. The workload of an emergency exit therefore depends on the wallet’s tree history as well as its displayed balance. 123

3 sourcesEvidence reviewed through July 14, 2026

What the evidence shows

Technical and product details

  1. Fragmentation mechanism

    Blink explains that ordinary payments split and re-split the Spark tree, causing a wallet to accumulate multiple leaves. 1

    Supporting material shown on this page

    Blink wallet-tree mechanicsPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    12A mobile Spark wallet holding **100,000 sats spread across 22 leaves**. Spark
    13wallets accumulate leaves through normal use (payments split and re-split the
    14tree), and each leaf carries its own exit chain: the on-chain transactions
    15that must confirm, level by level, to force the leaf onto Bitcoin without
    16operator cooperation. For this wallet that meant **253 transaction packages**
    17across the 22 chains — for 100k sats.
  2. Per-leaf graph

    Every current leaf carries its own chain of ancestor and refund transactions that must be forced onto Bitcoin. 1

    Supporting material shown on this page

    Blink wallet-tree mechanicsPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    12A mobile Spark wallet holding **100,000 sats spread across 22 leaves**. Spark
    13wallets accumulate leaves through normal use (payments split and re-split the
    14tree), and each leaf carries its own exit chain: the on-chain transactions
    15that must confirm, level by level, to force the leaf onto Bitcoin without
    16operator cooperation. For this wallet that meant **253 transaction packages**
    17across the 22 chains — for 100k sats.
  3. Sequential depth

    Mempool policy requires each level within a leaf's chain to confirm before the next level can enter the mempool. 2

    Supporting material shown on this page

    Blink TRUC sequencingPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    72one unconfirmed parent plus one child — that is what makes the pre-signed
    73zero-fee exit transactions safely fee-bumpable, and it also means **each level
    74of an exit chain must confirm before the next level can enter the mempool**.
    75A 15-package chain takes at least 15 blocks, no matter how it is submitted.
    76Any tooling that fires packages back-to-back will strand everything after the
    77first package per chain.
  4. Mechanical consequence

    Exit work is governed by the number of leaves and the depth of their chains, information that a displayed aggregate balance does not convey. 12

    Supporting material shown on this page

    Blink wallet-tree mechanicsPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    12A mobile Spark wallet holding **100,000 sats spread across 22 leaves**. Spark
    13wallets accumulate leaves through normal use (payments split and re-split the
    14tree), and each leaf carries its own exit chain: the on-chain transactions
    15that must confirm, level by level, to force the leaf onto Bitcoin without
    16operator cooperation. For this wallet that meant **253 transaction packages**
    17across the 22 chains — for 100k sats.
    Blink TRUC sequencingPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    72one unconfirmed parent plus one child — that is what makes the pre-signed
    73zero-fee exit transactions safely fee-bumpable, and it also means **each level
    74of an exit chain must confirm before the next level can enter the mempool**.
    75A 15-package chain takes at least 15 blocks, no matter how it is submitted.
    76Any tooling that fires packages back-to-back will strand everything after the
    77first package per chain.
  5. Mitigation

    Blink recommends consolidating leaves while Operators are cooperative, confirming that prior wallet activity affects the later emergency-exit burden. 3

    Supporting material shown on this page

    Blink consolidation takeawayPinned source code · github.com · checked 2026-07-14
    Relevant lines from the pinned source · open raw file
    1991. **A unilateral exit is a fire escape, not a door.** 253 packages, one
    200   block per package per chain, two weeks of timelock, and fees that would
    201   have consumed 79% of the balance if applied indiscriminately — for a
    202   100k-sat wallet. With economic triage, ~90% of the balance reached the
    203   destination. Self-custody on Spark is real, but the exit path is expensive
    204   and slow by construction; size expectations accordingly.

Scope control

What this does not establish

  • Leaf count and chain depth vary by wallet, and consolidation can reduce future work. This establishes history-dependent workload, not a fixed transaction multiplier or technical impossibility. 123

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.

1

Blink wallet-tree mechanics

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
2

Blink TRUC sequencing

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source
3

Blink consolidation takeaway

Pinned source code · github.com · Pinned or archival · checked 2026-07-14

Open original source

How sources, absence findings, and limitations were evaluated