Social Recovery: Custody You Can Lose Differently

A social recovery wallet replaces one secret with several relationships. Instead of a seed phrase that either exists or does not, authority is split across a set of guardians who can collectively replace your signing key. You are not removing the risk of losing custody; you are choosing which risks to hold.

That trade is the whole design, and it is badly explained by most product pages. A social recovery wallet converts a single catastrophic failure — a lost or leaked phrase — into a set of slower, more negotiable failures involving people, coordination and time. Some of those failures are easier to survive. A few are harder.

• Guardians hold authority, not keys. In a contract-based design they approve a new owner key rather than receiving a share of your secret.
• The timelock is the actual security control. A delay you can cancel is what stops a fraudulent recovery from completing.
• Quorum size cuts both ways. Raising the threshold makes collusion harder and unavailability more likely.
• Correlated guardians are one guardian. Five people who share a city, an employer or a family chat fail together.

What a social recovery wallet actually changes

It moves authority from a secret you hold to a rule about who can act, and enforces that rule in code rather than in trust. The account is a contract or a smart account with an owner key that can be replaced by a quorum of guardians, subject to a delay.

The owner key and the guardian set

You sign ordinary transactions with the owner key, which behaves much like any hot or hardware-backed key. Guardians do not sign payments and cannot move funds on their own; they can only approve a change of owner. In the common design, a guardian submits an approval to the contract, and once the threshold is met the contract schedules the change. This is why a guardian being compromised is not immediately a loss — it is one vote, and one vote is usually not enough.

Timelocks and the cancellation window

The delay is the part that makes the model survivable. When a recovery is scheduled, the contract typically waits a fixed period before the new owner takes effect, and the current owner can cancel during that window. A generous delay protects you from a fraudulent recovery but also slows down a genuine one, which matters if you actually lost the key and need access. Choosing the delay is choosing which of those two problems you would rather have.

The failure modes you are trading into

Social recovery removes one failure and adds four. Knowing them is the difference between a setup that helps and a setup that quietly moves the single point of failure from a piece of paper to a group chat.

Correlated guardians

Guardians are only independent if their lives are independent. Three siblings who share a household, four colleagues at one company, or five people in one city all fail together in the same flood, the same layoff, the same legal action. Availability calculations assume independence; real guardian sets rarely have it. Ask what single event could make two or three of your guardians unreachable at once, and if the answer is easy, the quorum is smaller than it looks.

Guardians who approve the wrong request

Guardians are usually asked to confirm something they cannot verify: that the person contacting them is you, and that the new owner address is yours. An attacker who compromises your messaging accounts can ask guardians to approve a “recovery” to an address they control, and a helpful guardian may comply. This is why recovery requests should require an out-of-band confirmation and why a long, cancellable delay matters more than a large guardian set. Never ask a guardian to approve a change you have not described to them in person or by a channel they already trust.

The third column assumes each guardian is reachable with 95% probability and that failures are independent — an optimistic assumption, which is exactly why the reading column is more useful than the number.

How much safety does a social recovery wallet threshold buy

It buys two different things at once, and the numbers move in opposite directions. Raising the threshold makes theft harder and unavailability more likely; the useful threshold is the one where both numbers stay acceptable.

Take a guardian reachable with probability 0.95 in any given year. For a 2-of-3 set, the chance that fewer than two guardians respond is the chance of zero responders, 0.05³ = 0.000125, plus the chance of exactly one, 3 × 0.95 × 0.05² = 0.007125, giving about 0.73%. For a 3-of-5 set, the same calculation gives 0.05⁵ = 0.0000003 for zero, 5 × 0.95 × 0.05⁴ = 0.0000297 for one, and 10 × 0.9025 × 0.05³ = 0.00113 for two, totalling roughly 0.12%. Moving from 2-of-3 to 3-of-5 cuts the chance of being locked out by about six times, while raising the number of approvals an attacker needs from two to three.

That is a genuinely better trade, and it is why 3-of-5 is a common default. But the arithmetic assumes independence, and independence is the assumption most likely to be wrong. If two of the five guardians are in the same city and a third shares their employer, the effective set is closer to 2-of-3 in a bad year. The calculation is a way to think, not a certificate.

A quorum protects you from any one guardian failing. It does not protect you from the reason they fail together.

Setting one up without creating a new single point of failure

1. Pick a quorum you can actually reach under stress, and count only guardians you could contact without the accounts an attacker might control.
2. Diversify by circumstance, not by count: different cities, different employers, different age groups, at least one who is not in your family.
3. Write a short, dated instruction for each guardian describing what they will be asked to approve and what they must never do.
4. Tell each guardian who the others are, or at least how many approvals are needed, so nobody approves alone out of politeness.
5. Set a delay long enough to notice and cancel a fraudulent request, and short enough that a real recovery is not punishing.
6. Test the flow on a small balance with a throwaway owner key before the account holds anything that matters.
7. Review the guardian set once a year, and after any change in someone’s circumstances, health or location.