spark.exposed

Hosted routing, settlement order, and recovery

Lightning swaps

How the reviewed default SSP paths handle invoices, send ordering, receive validation, and conditional retained-key risk.

How to read this topic: 3 principal evidence groups organize 4 supporting records by the question they answer.

Critical boundary: These findings describe the reviewed default flows and conditional cryptographic requirements. They do not prove payment failure, key retention, collusion, loss, or the absence of configurable SSP alternatives.

Review the argumentReview the method

Evidence group 01

The hosted service boundary

The default SSP's referenced server logic is not public, so server-side policy cannot be independently reviewed from the available repository.

Scope boundary: Non-public code does not establish hidden screening, misconduct, or why the implementation is private.

Lightning swaps

The referenced server logic for Spark’s default Lightspark SSP is not publicly accessible

Spark's public repository directs local SSP work to a separate Lightspark Sparkcore path that was not publicly accessible when checked. The public repository exposes the SSP schema, clients, and flow documents, but not the referenced Python handlers or full server-side decision logic. [10 sources]

Pinned source code · Referenced non-public implementation · Blog or announcementRead the analysis

Evidence group 02

Send and receive settlement order

The reviewed send path prepares and locks selected leaves before requesting SSP payment, while the receive path validates the inbound transfer before releasing preimage shares.

Scope boundary: The ordering is not proof of failed atomicity or loss. The cited protocol includes recovery branches, and the receive checks protect the recipient.

Evidence group 03

Forward security and historical-key assumptions

Spark's post-transfer security depends on deletion of historical key material that users cannot independently attest on the Operator servers.

Scope boundary: The public code contains concrete deletion controls. No reviewed evidence shows retained production keys or a failure of those controls.