Accounts, Multisig and Social Recovery
An account is a rule, not a record
There are no plain keypair accounts here. Every account is a policy, and moving value means satisfying that policy — the model Starknet made native, where an account is a contract rather than a privileged address the protocol knows about.
Accounts are themselves a kind, which sounds like a curiosity and is actually the point: it means "who may move this" and "what moving it means" are two halves of one rule instead of two systems that have to agree. Consuming a resource runs two predicates in order. The owning account proves authority. Then the asset kind enforces effects — conservation, limits, whatever it defines. Creating a resource needs no authority proof at all, because creation is always downstream of a consumption that was already authorised and conservation-bound.
The policy set is closed. There are exactly three:
Single key
Authority is knowledge of one secret. There is no signature: the proof demonstrates knowledge of the key bound to this specific action, so a proof for one action cannot be replayed against another. No curve is involved, which is unusual enough to be worth repeating — the thing standing in for a signature is a hash preimage.
Multisig — a threshold without curve signatures
Threshold signing normally means an elliptic-curve scheme where participants produce signature shares. That is exactly what a quantum adversary breaks, so this design does it differently.
Each of the n participants holds their own secret share, committed in a published tree. To authorise, m distinct participants each prove knowledge of their own share, bound to the action by a hash that absorbs the action's digest. Three properties fall out:
- No party ever reconstructs a master secret. Reconstruction would mean somebody, somewhere, briefly holds the whole key — the property that makes threshold schemes worth having is that nobody does.
- The coordinator is untrusted. It sees finished proofs, never a share. A malicious coordinator can refuse to assemble, which is a liveness problem with a known answer: retry with whichever participants are responsive.
- Distinctness is enforced. Without it, one participant could supply m shares and satisfy an m-of-n policy alone.
The cost is real: the check scales with m, and because proofs are padded to a uniform shape so the account type stays private, a single-key account pays close to threshold cost. Privacy of who can move what is not free.
Social recovery
Guardians, not a seed phrase in a drawer. A quorum of guardians can authorise rotating the account's authority to a new key. Two details matter.
Rotation is forward-only — it publishes a new authority commitment rather than editing an old one, so there is no migration path to get wrong.
And the veto is not a timer. Argent-style recovery gives the current key holder a wall-clock window to object; here the window is counted in settled state roots, so the holder's chance to veto a hostile recovery is measured by the chain's own progress rather than by a clock the protocol would have to trust. A frivolous recovery attempt can be vetoed and costs its initiator a fee.
What this does not give you
If you lose a single-key account's key and set no guardians, the value is gone. No operator can restore it, because there is no operator — the same absence of privileged control that means no administrator can be compromised into taking your funds. That trade is the whole design, and it runs in both directions.