Recovery
Recovery Reference
This page lists the recovery system's capabilities, implementation owners, and mainnet target. The currently reviewed deployment is testnet; verify service configuration for the deployment being used. See Recovery Overview for a plain-language explanation of the recovery process and its security checks.
| Feature: | Description: | Implementation: | Target: |
| Opt in policy | Each account either has recovery enabled or has no recovery; support cannot add it later | mpc-recovery install_policy | Mainnet |
| Single recovery path | Every case follows the same flow. The account balance does not change the process, and no person chooses the outcome | The House of Stake server | Mainnet |
| Attestation | The request must include proof signed by the recovery key set when the policy was installed | mpc-recovery, the House of Stake server | Mainnet |
| Timelock | A waiting period set by the policy, from sixty seconds to thirty days | mpc-recovery | Mainnet |
| Watcher quorum | A minimum number of independent watchers must approve the exact destination and recovery attempt | mpc-recovery, watcher services | Mainnet |
| Replay protection | Each request gets a new attempt number, and transfers preserve the latest number so it cannot be rolled back | mpc-recovery | Mainnet |
| Separate signing labels | Request and approval messages use different labels so they cannot be mistaken for each other | mpc-recovery proof module | Mainnet |
| Recovery of ordinary NEAR accounts | No rental required; MPC signs an AddKey transaction for a key created specifically for the account | NEAR MPC v1.signer, mpc-recovery | Mainnet |
| Recovery of leased names | A leased name has no key of its own; recovering its owning account restores every name it holds | hos-wallet extension list | Mainnet |
| PIN and security questions | Each name can have its own PIN and questions; they cannot be read back, and repeated failures are limited | The House of Stake server | Mainnet |
| Key created in the browser | The browser creates the new key and sends only the public key | The House of Stake frontend | Mainnet |
| Owner abort | The owner can cancel from Requested or Approved; support cannot do it for them | mpc-recovery abort_recovery | Mainnet |
| Reset on sale | A marketplace transfer removes the recovery policy and preserves the latest attempt number | hos-extension to mpc-recovery | Mainnet |
| Retryable finalization | If MPC cannot sign, the case returns to Approved instead of getting stuck | mpc-recovery on_signed | Mainnet |
| Mail delivery | Resend, webhook, or console fallback | The House of Stake server | Provider must be configured per deployment |