How much should guardians know during social recovery?

As a wallet engineer, I like social recovery because a lost signing key should not necessarily mean losing tokenized ownership. Smart-contract wallets can encode threshold recovery, so guardians might approve a cryptographic change without learning what sits behind it. But that creates an uncomfortable blind spot: should they know which assets are being recovered, and why?

An inheritance may justify context; shared maker-equipment ownership may require confirming the right parties; a compromised phone may call for speed and minimal disclosure. Opaque approval can hide coercion, guardian collusion, or a fraudulent request. Full inventory and explanations, however, turn “self-custody” into a distributed surveillance arrangement and expose private family or business details. The draft ERC-7093 direction includes signed recovery data and mechanisms such as thresholds and delays, but not necessarily an asset inventory. Would you trust privacy-preserving social recovery for valuable tokenized assets, and what minimum safeguards would you require?

I would separate authorization from justification. Guardians should verify a narrowly defined recovery statement, destination, and policy state—not receive a portfolio. A delay and cancellation path are more useful than forcing someone to disclose an inheritance or a joint workshop’s assets.

The opaque version has a real threat model: a coerced guardian can approve something they cannot inspect, and colluding guardians can call it routine. I would want threshold diversity, signed human-readable recovery data, replay protection, and an auditable delay. Still no full inventory by default.

“Why” is the dangerous field. People will be pressured to write explanations that become permanent social evidence. I’d design the interface around what guardians can safely attest to, not around extracting a convincing personal story.

Worth keeping the standards language precise: ERC-7093 is a draft interface, not proof that a mature privacy-preserving system exists. Its example message fields do not inherently require an asset list or reason, but implementations could add both.

Users will choose the path with the fewest confusing screens, especially during a phone compromise. If privacy-preserving recovery requires guardians to understand wallet internals, many will either skip recovery or approve blindly. The product problem is part of the security model.

For shared equipment, I’d want a recovery policy tied to the ownership agreement, not a guardian improvising from a token list. Separate roles might help: some guardians authorize the threshold, while a designated process handles disputes without exposing everything to everyone.

Every extra witness is another person who can screenshot, gossip, lose an account, or misunderstand a prompt. “Trusted” is not a cryptographic property. Default disclosure should be boringly small.

I’m less comfortable with blind approval than the thread is. If a guardian cannot distinguish recovery of inherited tokens from a transfer to an unknown address, threshold signing becomes ceremony. Maybe disclose asset class and destination while hiding balances and unrelated holdings.

A useful compromise may be progressive disclosure: guardians first see a commitment and policy-compliant summary, then only unlock more detail if the recovery is challenged. That preserves a cancellation window without making every guardian a permanent observer.

Organizations will ask who can demonstrate that the recovery was authorized and under which policy. Minimal disclosure is good, but auditability cannot mean “trust the UI.” Signed records, role separation, and retention rules matter even when the asset list stays hidden.

Do not forget recovery races. A compromised phone and a legitimate lost-key recovery can produce competing requests. Timelocks and cancellation are more concrete safeguards than debating whether a guardian’s intuition is sufficient.

I’d accept asset category, destination commitment, threshold proof, and a cooling-off period. I would not send five friends the complete contents of a wallet because one device died. That is not resilience; it is a new breach surface.

The social arrangement is the overlooked ledger. Inheritance and shared tools already involve relationships, obligations, and disputes; cryptography cannot erase those. Privacy-preserving recovery is attractive, but the policy should make disagreement survivable rather than pretending guardians are interchangeable keys.