Recovery
Recovery Technical Reference
This page maps the documented recovery behavior to the frontend, backend, and on-chain system. Confirm the policy, watcher, mail, and method configuration for the deployment being used.
| Capability | Documented behavior | Implementation |
| Opt-in setup | Recovery must be enabled before access is lost; support cannot add it afterward | Recovery settings, enrollment service, mpc-recovery install_policy |
| Verified email | Setup and ordinary recovery verify ownership of the saved email with a six-digit code | Frontend and the House of Stake verification service |
| Anti-phishing word | Setup requires a personal word that appears in every official recovery email; it is a recognition cue, not a recovery method | Recovery profile and mail service |
| Enrollment requirement | After verifying email, the owner must add at least two different recovery method types: passkeys, password, recovery codes, security questions, or PIN | Recovery settings and enrollment service |
| Passkeys | One or more passkeys may be registered; all passkeys collectively count as one method | WebAuthn/passkey service |
| Recovery password | One recovery password counts as one method | Recovery-method verification service |
| Recovery codes | Setup creates ten codes; each is stored as a hash and can be redeemed once; the set counts as one method | The House of Stake recovery-code service |
| Security questions | The owner may configure 1–5 questions; all questions together count as one method | Recovery-method verification service |
| Recovery PIN | The user configures a 4–8 digit PIN, which counts as one method | Recovery-method verification service |
| Normal recovery checks | Recovery requires the saved-email code plus any one recovery method | Frontend and the House of Stake verification services |
| Lost-email checks | Changing an inaccessible recovery email requires two different recovery method types | Destination-change and recovery-method services |
| Ownership-account protection | The email and recovery methods belong to the ownership account and protect every rented account it controls | Recovery read and verification services |
| Persistent enrollment | Successful recovery does not consume or remove enrollment; the MPC recovery key and policy remain installed for future recoveries until the owner explicitly removes recovery | Account access keys, recovery settings, and mpc-recovery |
| Recovery removal | The owner verifies the saved email and one enrolled method; removal deletes all methods and removes the recovery key and policy | Recovery settings and enrollment service |
| Recovery-phrase delivery | A one-time retrieval link works from any device and expires after seven days or its first use | Recovery completion frontend and delivery service |
| Recovery grant | The user's wallet app creates or selects a new key. House of Stake gets the public part, which can be shared, but not the private part, which controls the account. | Wallet transaction, enrollment service, mpc-recovery |
| Attestation | The on-chain request must include proof that the required user checks passed for the exact account, destination, round, and expiry | The House of Stake server and mpc-recovery |
| Recovery wait | Recovery waits 72 hours before it can finish. | mpc-recovery policy |
| Watcher approval | Independent watchers approve the destination and request number after the 72-hour wait | mpc-recovery and watcher services |
| Replay protection | Every request gets a new round; transfers preserve the latest round so an older approval cannot be reused | mpc-recovery |
| Separate signing labels | Request and approval messages use different labels so one cannot be accepted as the other | mpc-recovery proof module |
| Ordinary account recovery | Multi-party computation (MPC) splits signing control among several parties. After checks pass, they use the shared key to sign an AddKey action that adds the user's new key. | NEAR MPC v1.signer, mpc-recovery |
| Public rented-account recovery | The user recovers the ownership account, restoring control of every rented account it owns | Recovery frontend and owner resolution |
| Direct name recovery | The contracts can move one rented name after signatures bind the proposed and expected owners, deadline, and round; this is not the current public flow | hos-extension, registry, watcher services |
| Owner cancellation | The owner can cancel before finalization or broadcast begins | Recovery service and mpc-recovery abort_recovery |
| Activity cancellation | Activity from the existing account cancels a pending recovery during the wait | Recovery service activity monitor |
| Recovery-email change | After two different recovery methods and new-email verification, the old email can stop the change during a separate 72-hour window | Destination-change service and notification flow |
| Recovery reset on sale | All recovery information connected to the transferred account is cleared. The previous owner's email, methods, policy, and open cases do not carry over. The latest round remains only for replay protection, and recovery stays active on the previous owner's ownership account. | hos-extension to mpc-recovery |
| Retryable finalization | Uncertain signing or broadcast results are checked against NEAR before retrying | Finalization service and mpc-recovery |
| Mail delivery | Production delivery requires the mail provider used by the service; console fallback does not send messages | The House of Stake mail service |
Current Defaults
- Recovery wait: 72 hours (
259,200seconds). - Recovery-email change delay: 72 hours (
259,200seconds). - Recovery codes created at setup: 10.
- Required setup: verified recovery email, anti-phishing word, and at least two different recovery method types.
- Available recovery methods: passkeys, password, ten one-time recovery codes, 1–5 security questions, and a PIN.
- Required normal recovery checks: saved-email code plus any one recovery method.
- Required lost-email checks: two different recovery method types, followed by verification of the new email.
- Recovery PIN length: 4–8 digits.
- Recovery enrollment lifetime: persists through successful recoveries until the owner explicitly removes it.
- Completion-link lifetime: seven days or until the recovery phrase is viewed once.
- Manual account entry: use the complete NEAR account ID exactly as it appears in your wallet.
These values describe the documented product configuration. On-chain policy values remain the source of truth for an individual account. A successful recovery does not remove the MPC recovery key or recovery policy.
Start with the Recovery Overview or follow the Recovery Walkthrough.