Guardian Recovery (Social Recovery)

Guardian recovery replaces the one thing every self-custody identity system has historically gotten wrong: what happens when you lose the key. Lose an ordinary private key or seed phrase and the identity or funds behind it are gone: there is no customer support line that can help, by design, because no one else was ever supposed to hold the authority to move them. That property is also the failure mode. Guardian recovery keeps the "no one else holds unilateral authority" guarantee while removing the single point of failure: instead of one secret that must never be lost, the user names a set of guardians, people or devices they trust, and sets a threshold, k of n. Any k of those guardians co-signing is enough to rotate the identity to a new key. No single guardian, and no operator of the system, can do it alone.

This is different from a custodial "forgot password" flow in one specific way: the guardians' co-signatures are verified by the system itself, a smart contract, a blockchain's execution layer, not accepted on the say-so of a company's support team. The authority to approve a recovery is distributed among people the user picked, not centralized in an operator.

Where it comes from

Guardian-based social recovery is an Ethereum wallet-security idea, not a Solidus one. Vitalik Buterin wrote about social recovery as a core justification for account abstraction in 2021, arguing that seed phrases were the wrong security model for non-technical users and that a wallet should let its owner nominate trusted guardians instead. Argent built this into a shipping smart-contract wallet years earlier, starting around 2018-2019, guardians (other devices, trusted contacts, or optionally a custodial backup) could collectively approve a wallet recovery without any of them individually holding the owner's keys. The pattern predates Solidus by years and was refined inside the Ethereum wallet ecosystem, not invented here.

Solidus status

What Solidus built is its own implementation of the pattern: a chain-level primitive where a rotation transaction only executes once it carries co-signatures from k of the user's chosen n guardians, verified by the chain itself, plus an SDK, a relay backend to help guardians and users coordinate signatures, and a recovery UI. This has been verified end-to-end against Solidus's live testnet node using real guardian accounts, not just tested in isolation.

It is unaudited and runs on testnet only, no mainnet, no production users, no adversarial conditions yet. The threat model deserves stating plainly, not burying: because recovery is instant once the threshold is met, a colluding set of k guardians can recover, and take over. The account exactly as legitimately as the real owner could. The security of the whole scheme rests on picking guardians who won't collude, not on any cryptographic protection against them doing so.

One more consequence worth knowing before relying on this: a completed recovery mints a brand-new root key. Because Pairwise DIDs are derived from that root key, every per-verifier identity derived from the old key is severed the moment recovery completes, every relying party that recognized the user as a returning visitor now sees what looks like a new, unrecognized identity. That's an intentional tradeoff (a compromised key should not carry its old relationships forward), not an oversight, but it means recovery is not free: it costs every "remember me" relationship the account had built up.

See also

K-of-n Threshold is the general cryptographic pattern this recovery mechanism applies. Pairwise DID explains the per-verifier identities that recovery severs. did:solidus is the DID method whose keys this mechanism rotates.